ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Clarify trusted runtime network capability scope

Browse source
This commit is contained in:
ms2k 2026-07-12 14:23:42 +09:00
commit a1ed8b9984
1 changed files with 13 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

22
docs/specification.md
View file

@ -507,14 +507,18 @@ override Lazaret's host control plane.
### 3.6 Network Isolation
The Network Sidecar role is realized on the Runtime Supervisor-owned install
path: the Runtime Supervisor (or a packaging-equivalent installer still bound to
the same Network Sidecar ID) holds network-administration capability only for
install and attestation in the Domain enforcement network namespace. The Agent
Sandbox does not receive that capability and may join only that prepared
enforcement namespace, not the host network namespace. Production connectivity uses
`slirp4netns`. Installing policy by driving nftables through runsc into the guest
is not a production path. Protocol helper ownership, network readiness, and
publication gates follow the protocol model.
path. The Runtime Supervisor holds network-administration capability while it
installs and attests policy and while attached runsc imports the Domain
enforcement network namespace. It irreversibly drops that capability after the
initial runsc handoff and before publication. Stock attached runsc retains
network-administration capability in the subordinate Domain user namespace for
its generation lifetime; it is a trusted host runtime process and has no
authority over initial-user-namespace host network resources. The Agent Sandbox
OCI process does not receive the capability and may join only that prepared
enforcement namespace, not the host network namespace. Production connectivity
uses `slirp4netns`. Installing policy by driving nftables through runsc into the
guest is not a production path. Protocol helper ownership, network readiness,
and publication gates follow the protocol model.
#### Derived policy and readiness encoding
@ -628,7 +632,7 @@ not duplicated here.
| **SR-1** | Agent processes shall execute in a rootless gVisor sandbox and shall not receive host root authority. |
| **SR-3** | Host paths outside the Agent Workspace, developer-configured volumes, and Lazaret-owned fixed control mounts shall not be accessible to the Agent Sandbox. |
| **SR-4** | The sandbox shall be unable to modify the host repository's `.git/config` or default `.git/hooks` directory through the workspace mount. |
| **SR-5** | Network-administration capability for policy installation shall be confined to the Runtime Supervisor-owned Network Sidecar install path; the Agent Sandbox process specification shall omit that capability. |
| **SR-5** | The Runtime Supervisor shall irreversibly drop network-administration capability after initial attached-runsc network import and before publication. Trusted attached runsc may retain that capability only in the subordinate Domain user namespace for its generation lifetime. The Agent Sandbox process specification shall omit the capability and set `noNewPrivileges`. |
| **SR-6** | Network policy shall cover every enabled address family and shall deny equal-specificity policy conflicts. Default and configured deny prefixes shall be enforced with loopback-unicast deny routes in the Domain enforcement network namespace; Linux blackhole routes shall not be the production deny representation. |
| **SR-10** | Domain sockets, mailboxes, and coordination files shall reside in a host-private directory owned by the developer. |
| **SR-11** | Runtime and persistent path construction shall begin from validated Domain roots, include the Domain ID in resource identities, and verify stored Domain identity before reuse. |