ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Replace runtime argv handoff with a sealed typed record

Browse source
This commit is contained in:
ms2k 2026-07-19 03:56:49 +09:00
commit d70f483844
1 changed files with 725 additions and 465 deletions
Download patch file Download diff file Expand all files Collapse all files

386
crates/lazaret-runtime-supervisor/src/supervision.rs
View file

@ -2,6 +2,7 @@ use std::ffi::{OsStr, OsString};
use std::fs::File;
use std::io::{self, Read};
use std::os::fd::{AsFd, AsRawFd, OwnedFd};
use std::os::unix::ffi::{OsStrExt, OsStringExt};
use std::os::unix::fs::FileExt;
use std::path::PathBuf;
use std::time::{Duration, Instant};
@ -18,7 +19,7 @@ use lazaret_core::records::{
};
use lazaret_ignored_workspace::{GitSentry, PRIVATE_ROUTER_ROLE};
use lazaret_linux::capability;
use lazaret_linux::filesystem::{mount_identity, sealed_memfd};
use lazaret_linux::filesystem::{mount_identity, require_write_sealed, sealed_memfd};
use lazaret_linux::process::{
ChildStandardIo, ParentEdge, ProcessOwnershipContext, RetainedProcess, TargetCommand,
child_broker, current_process_identity,
@ -44,6 +45,7 @@ use crate::sandbox::RunscCommand;
pub const PRIVATE_RUNTIME_ROLE: &str = "--lazaret-runtime-supervisor-role";
const MAX_CONTROL_MESSAGE: usize = 16 * 1024;
const MAX_RUNTIME_HANDOFF_BYTES: usize = 64 * 1024;
const READINESS_TIMEOUT: Duration = Duration::from_secs(30);
const TERMINATION_GRACE: Duration = Duration::from_secs(2);
@ -302,6 +304,7 @@ impl CoordinatorChannel {
pub struct RuntimeSupervisorLaunch {
target: TargetCommand,
handoff_file: Option<File>,
ownership: ProcessOwnershipContext,
policy_file: Option<File>,
policy_digest: Option<DerivedPolicyDigest>,
@ -414,21 +417,9 @@ impl RuntimeSupervisorLaunch {
"Runtime Supervisor requires foreground attached runsc",
));
}
let mut target = TargetCommand::new("/proc/self/exe")
.argument(PRIVATE_RUNTIME_ROLE)
.argument("--domain")
.argument(hex(ownership.domain_id.as_bytes()))
.argument("--generation")
.argument(ownership.generation_id.get().to_string())
.argument("--coordinator")
.argument(hex(ownership.coordinator_id.as_bytes()))
.argument("--runsc")
.argument(command.program());
for argument in command.arguments() {
target = target.argument(argument);
}
Ok(Self {
target: target.with_lifetime_pipe_parent_edge(),
let mut launch = Self {
target: TargetCommand::new("/usr/bin/false").with_lifetime_pipe_parent_edge(),
handoff_file: None,
ownership,
policy_file: None,
policy_digest: None,
@ -437,7 +428,9 @@ impl RuntimeSupervisorLaunch {
runsc_command: command.clone(),
state_anchor: None,
git_routing: None,
})
};
launch.refresh_target()?;
Ok(launch)
}
/// Builds the RS-owned network path with one inherited sealed policy document.
@ -449,161 +442,44 @@ impl RuntimeSupervisorLaunch {
command: &RunscCommand,
network: RuntimeNetworkLaunch<'_>,
) -> io::Result<Self> {
let runtime_supervisor_executable = std::env::current_exe()?;
let mut launch = Self::from_runsc_command(ownership, command)?;
let policy_file = sealed_memfd("lazaret-network-policy", network.policy.canonical_bytes())?;
fcntl_setfd(policy_file.as_fd(), FdFlags::empty())?;
let policy_fd = policy_file.as_raw_fd();
let target = std::mem::replace(
&mut launch.target,
TargetCommand::new("/usr/bin/false").with_lifetime_pipe_parent_edge(),
);
launch.target = TargetCommand::new(runtime_supervisor_executable)
.argument(PRIVATE_RUNTIME_ROLE)
.argument("--domain")
.argument(hex(ownership.domain_id.as_bytes()))
.argument("--generation")
.argument(ownership.generation_id.get().to_string())
.argument("--coordinator")
.argument(hex(ownership.coordinator_id.as_bytes()))
.argument("--network-policy-fd")
.argument(policy_fd.to_string())
.argument("--network-policy-digest")
.argument(hex(network.policy.digest().as_bytes()))
.argument("--configuration-fingerprint")
.argument(hex(network.configuration_fingerprint.as_bytes()))
.argument("--network-sidecar")
.argument(hex(network.network_sidecar_id.as_bytes()))
.argument("--runsc")
.argument(command.program());
for argument in command.arguments() {
launch.target = launch.target.argument(argument);
}
launch.target = launch.target.with_lifetime_pipe_parent_edge();
drop(target);
launch.policy_file = Some(policy_file);
launch.policy_digest = Some(network.policy.digest());
launch.configuration_fingerprint = Some(network.configuration_fingerprint);
launch.network_sidecar_id = Some(network.network_sidecar_id);
launch.refresh_target()?;
Ok(launch)
}
/// Adds exact inherited State Anchor authorities without beginning physical acquisition.
#[must_use]
pub fn with_state_anchor(mut self, authority: StateAnchorLaunchAuthority) -> Self {
/// # Errors
/// Refuses an invalid or unsealable State Anchor handoff.
pub fn with_state_anchor(mut self, authority: StateAnchorLaunchAuthority) -> io::Result<Self> {
self.state_anchor = Some(authority);
self.rebuild_target();
self
self.refresh_target()?;
Ok(self)
}
#[must_use]
pub fn with_git_routing(mut self, authority: RuntimeGitRoutingLaunch) -> Self {
/// # Errors
/// Refuses an invalid or unsealable Git-routing handoff.
pub fn with_git_routing(mut self, authority: RuntimeGitRoutingLaunch) -> io::Result<Self> {
self.git_routing = Some(authority);
self.rebuild_target();
self
self.refresh_target()?;
Ok(self)
}
fn rebuild_target(&mut self) {
let mut target = TargetCommand::new("/proc/self/exe")
fn refresh_target(&mut self) -> io::Result<()> {
let encoded = build_runtime_handoff(self)?;
let handoff = sealed_memfd("lazaret-runtime-handoff", &encoded)?;
fcntl_setfd(&handoff, FdFlags::empty())?;
self.target = TargetCommand::new("/proc/self/exe")
.argument(PRIVATE_RUNTIME_ROLE)
.argument("--domain")
.argument(hex(self.ownership.domain_id.as_bytes()))
.argument("--generation")
.argument(self.ownership.generation_id.get().to_string())
.argument("--coordinator")
.argument(hex(self.ownership.coordinator_id.as_bytes()));
if let Some(authority) = &self.state_anchor {
let (device, inode) = authority.expected_lower();
target = target
.argument("--state-lower-fd")
.argument(authority.lower_fd().to_string())
.argument("--state-lower-label")
.argument(authority.lower_label())
.argument("--state-persistent-root-fd")
.argument(authority.persistent_root_fd().to_string())
.argument("--state-persistent-fd")
.argument(authority.persistent_anchor_fd().to_string())
.argument("--state-persistent-label")
.argument(authority.persistent_anchor_label())
.argument("--state-runtime-root-fd")
.argument(authority.runtime_root_fd().to_string())
.argument("--state-runtime-fd")
.argument(authority.runtime_anchor_fd().to_string())
.argument("--state-runtime-label")
.argument(authority.runtime_anchor_label())
.argument("--state-lower-device")
.argument(device.to_string())
.argument("--state-lower-inode")
.argument(inode.to_string())
.argument("--state-persistent-count")
.argument(authority.persistent_destinations().len().to_string());
for destination in authority.persistent_destinations() {
target = target
.argument("--state-persistent-destination")
.argument(destination);
}
}
if let Some(authority) = &self.git_routing {
target = target
.argument("--git-workspace-fd")
.argument(authority.workspace.as_raw_fd().to_string())
.argument("--git-workspace-label")
.argument(&authority.workspace_label)
.argument("--git-isolated-fd")
.argument(authority.isolated.as_raw_fd().to_string())
.argument("--git-mountpoint-fd")
.argument(authority.mountpoint.as_raw_fd().to_string())
.argument("--git-mountpoint-label")
.argument(&authority.mountpoint_label)
.argument("--git-common-fd")
.argument(authority.git_common.as_raw_fd().to_string())
.argument("--git-common-label")
.argument(&authority.git_common_label)
.argument("--git-hooks-fd")
.argument(authority.transient_hooks.as_raw_fd().to_string())
.argument("--git-hooks-label")
.argument(&authority.transient_hooks_label)
.argument("--git-config-fd")
.argument(authority.transient_config.as_raw_fd().to_string())
.argument("--git-config-label")
.argument(&authority.transient_config_label)
.argument("--git-global-excludes")
.argument(
authority
.global_excludes
.as_deref()
.unwrap_or_else(|| std::path::Path::new("")),
)
.argument("--git-isolate-ignored")
.argument(if authority.isolate_ignored {
"true"
} else {
"false"
});
}
if let (Some(policy_file), Some(digest), Some(fingerprint), Some(sidecar)) = (
&self.policy_file,
self.policy_digest,
self.configuration_fingerprint,
self.network_sidecar_id,
) {
target = target
.argument("--network-policy-fd")
.argument(policy_file.as_raw_fd().to_string())
.argument("--network-policy-digest")
.argument(hex(digest.as_bytes()))
.argument("--configuration-fingerprint")
.argument(hex(fingerprint.as_bytes()))
.argument("--network-sidecar")
.argument(hex(sidecar.as_bytes()));
}
target = target
.argument("--runsc")
.argument(self.runsc_command.program());
for argument in self.runsc_command.arguments() {
target = target.argument(argument);
}
self.target = target.with_lifetime_pipe_parent_edge();
.argument(handoff.as_raw_fd().to_string())
.with_lifetime_pipe_parent_edge();
self.handoff_file = Some(handoff);
Ok(())
}
#[must_use]
@ -662,8 +538,7 @@ pub fn dispatch_private_runtime_role(arguments: &[OsString]) -> Option<io::Resul
{
return None;
}
let result =
parse_runtime_arguments(&arguments[1..]).and_then(|parsed| run_supervisor(&parsed));
let result = parse_runtime_handoff(&arguments[1..]).and_then(|parsed| run_supervisor(&parsed));
if let Err(error) = &result {
let _ = send_message(
std::io::stdout(),
@ -718,204 +593,7 @@ struct RuntimeNetworkArguments {
network_sidecar_id: NetworkSidecarId,
}
#[allow(clippy::too_many_lines)]
fn parse_runtime_arguments(arguments: &[OsString]) -> io::Result<RuntimeArguments> {
let mut arguments = arguments.iter().peekable();
let domain = parse_fixed_hex(named(&mut arguments, "--domain")?)?;
let generation = named(&mut arguments, "--generation")?
.to_str()
.and_then(|value| value.parse().ok())
.ok_or_else(|| io::Error::other("Runtime Supervisor generation is invalid"))?;
let coordinator = parse_fixed_hex(named(&mut arguments, "--coordinator")?)?;
let state_anchor = if arguments
.peek()
.is_some_and(|value| *value == "--state-lower-fd")
{
let lower_fd = parse_number(named(&mut arguments, "--state-lower-fd")?)?;
let lower_label = PathBuf::from(named(&mut arguments, "--state-lower-label")?);
let persistent_root_fd =
parse_number(named(&mut arguments, "--state-persistent-root-fd")?)?;
let persistent_anchor_fd = parse_number(named(&mut arguments, "--state-persistent-fd")?)?;
let persistent_anchor_label =
PathBuf::from(named(&mut arguments, "--state-persistent-label")?);
let runtime_root_fd = parse_number(named(&mut arguments, "--state-runtime-root-fd")?)?;
let runtime_anchor_fd = parse_number(named(&mut arguments, "--state-runtime-fd")?)?;
let runtime_anchor_label = PathBuf::from(named(&mut arguments, "--state-runtime-label")?);
let expected_lower = (
parse_number(named(&mut arguments, "--state-lower-device")?)?,
parse_number(named(&mut arguments, "--state-lower-inode")?)?,
);
let count: usize = parse_number(named(&mut arguments, "--state-persistent-count")?)?;
let persistent_destinations = (0..count)
.map(|_| named(&mut arguments, "--state-persistent-destination").map(PathBuf::from))
.collect::<io::Result<Vec<_>>>()?;
Some(RuntimeStateAnchorArguments {
lower_fd,
lower_label,
persistent_root_fd,
persistent_anchor_fd,
persistent_anchor_label,
runtime_root_fd,
runtime_anchor_fd,
runtime_anchor_label,
expected_lower,
persistent_destinations,
})
} else {
None
};
let git_routing = if arguments
.peek()
.is_some_and(|value| *value == "--git-workspace-fd")
{
let workspace_fd = parse_descriptor(named(&mut arguments, "--git-workspace-fd")?)?;
let workspace_label = PathBuf::from(named(&mut arguments, "--git-workspace-label")?);
let isolated_fd = parse_descriptor(named(&mut arguments, "--git-isolated-fd")?)?;
let mountpoint_fd = parse_descriptor(named(&mut arguments, "--git-mountpoint-fd")?)?;
let mountpoint_label = PathBuf::from(named(&mut arguments, "--git-mountpoint-label")?);
let git_common_fd = parse_descriptor(named(&mut arguments, "--git-common-fd")?)?;
let git_common_label = PathBuf::from(named(&mut arguments, "--git-common-label")?);
let transient_hooks_fd = parse_descriptor(named(&mut arguments, "--git-hooks-fd")?)?;
let transient_hooks_label = PathBuf::from(named(&mut arguments, "--git-hooks-label")?);
let transient_config_fd = parse_descriptor(named(&mut arguments, "--git-config-fd")?)?;
let transient_config_label = PathBuf::from(named(&mut arguments, "--git-config-label")?);
let global_excludes = match named(&mut arguments, "--git-global-excludes")? {
value if value.is_empty() => None,
value => Some(PathBuf::from(value)),
};
let isolate_ignored = match named(&mut arguments, "--git-isolate-ignored")?.to_str() {
Some("true") => true,
Some("false") => false,
_ => {
return Err(io::Error::other(
"Runtime Supervisor Git isolation mode is invalid",
));
}
};
Some(RuntimeGitRoutingArguments {
workspace_fd,
workspace_label,
isolated_fd,
mountpoint_fd,
mountpoint_label,
git_common_fd,
git_common_label,
transient_hooks_fd,
transient_hooks_label,
transient_config_fd,
transient_config_label,
global_excludes,
isolate_ignored,
})
} else {
None
};
let network = if arguments
.peek()
.is_some_and(|value| *value == "--network-policy-fd")
{
Some(parse_network_arguments(&mut arguments)?)
} else {
None
};
if arguments.next().is_none_or(|value| value != "--runsc") {
return Err(io::Error::other(
"Runtime Supervisor runsc separator is missing",
));
}
let program = arguments
.next()
.ok_or_else(|| io::Error::other("Runtime Supervisor runsc program is missing"))?;
if program != "runsc" {
return Err(io::Error::other("Runtime Supervisor target is not runsc"));
}
Ok(RuntimeArguments {
ownership: ProcessOwnershipContext {
domain_id: DomainId::new(domain),
generation_id: GenerationId::new(generation),
coordinator_id: CoordinatorId::new(coordinator),
slot: HostProcessOwnershipSlot::SandboxAttachedRunsc,
},
state_anchor,
git_routing,
network,
runsc_program: (*program).clone(),
runsc_arguments: arguments.cloned().collect(),
})
}
fn parse_number<T>(value: &OsStr) -> io::Result<T>
where
T: std::str::FromStr,
{
value
.to_str()
.and_then(|value| value.parse().ok())
.ok_or_else(|| io::Error::other("Runtime Supervisor numeric argument is invalid"))
}
fn parse_descriptor(value: &OsStr) -> io::Result<i32> {
parse_number(value)
.ok()
.filter(|descriptor| *descriptor >= 0)
.ok_or_else(|| io::Error::other("Runtime Supervisor descriptor is invalid"))
}
fn parse_network_arguments<'a>(
arguments: &mut impl Iterator<Item = &'a OsString>,
) -> io::Result<RuntimeNetworkArguments> {
let policy_fd = named(arguments, "--network-policy-fd")?
.to_str()
.and_then(|value| value.parse().ok())
.filter(|value| *value >= 0)
.ok_or_else(|| io::Error::other("Runtime Supervisor policy descriptor is invalid"))?;
let policy_digest = DerivedPolicyDigest::new(parse_fixed_hex(named(
arguments,
"--network-policy-digest",
)?)?);
let configuration_fingerprint = ConfigurationFingerprint::new(parse_fixed_hex(named(
arguments,
"--configuration-fingerprint",
)?)?);
let network_sidecar_id =
NetworkSidecarId::new(parse_fixed_hex(named(arguments, "--network-sidecar")?)?);
Ok(RuntimeNetworkArguments {
policy_fd,
policy_digest,
configuration_fingerprint,
network_sidecar_id,
})
}
fn named<'a>(
arguments: &mut impl Iterator<Item = &'a OsString>,
name: &str,
) -> io::Result<&'a OsString> {
if arguments.next().is_none_or(|value| value != name) {
return Err(io::Error::other(format!(
"Runtime Supervisor argument {name} is missing"
)));
}
arguments
.next()
.ok_or_else(|| io::Error::other(format!("Runtime Supervisor argument {name} has no value")))
}
fn parse_fixed_hex(value: &OsStr) -> io::Result<[u8; 32]> {
let value = value
.to_str()
.ok_or_else(|| io::Error::other("Runtime Supervisor identity is not UTF-8"))?;
if value.len() != 64 || !value.bytes().all(|byte| byte.is_ascii_hexdigit()) {
return Err(io::Error::other("Runtime Supervisor identity is invalid"));
}
let mut bytes = [0_u8; 32];
for (index, byte) in bytes.iter_mut().enumerate() {
*byte = u8::from_str_radix(&value[index * 2..index * 2 + 2], 16)
.map_err(|_| io::Error::other("Runtime Supervisor identity is invalid"))?;
}
Ok(bytes)
}
include!("supervision/handoff.rs");
include!("supervision/startup.rs");
include!("supervision/runtime.rs");
include!("supervision/tests.rs");