Add phase-aware pidfs process ownership records

crates/lazaret-core/src/identity.rs

@@ -2,6 +2,7 @@ use serde::{Deserialize, Serialize};
 
 pub const OPAQUE_ID_BYTES: usize = 32;
 pub const SHA256_BYTES: usize = 32;
+pub const BOOT_ID_BYTES: usize = 16;
 
 macro_rules! opaque_identity {
     ($($name:ident),+ $(,)?) => {
@@ -98,15 +99,34 @@ digest_identity!(
 
 numeric_identity!(
     GenerationId(u64),
-    ProcessId(u32),
-    ProcessStartTime(u64),
+    HostPidLocator(u32),
+    ProcessStartTimeTicks(u64),
+    GuestProcessId(u32),
+    GuestProcessStartTimeTicks(u64),
     GuestProcessGroupId(u32),
     FileDescriptor(i32),
     DeviceId(u64),
     InodeId(u64),
+    PidfsDeviceId(u64),
+    PidfsInodeId(u64),
     MountId(u64),
 );
 
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+pub struct BootId([u8; BOOT_ID_BYTES]);
+
+impl BootId {
+    #[must_use]
+    pub const fn new(bytes: [u8; BOOT_ID_BYTES]) -> Self {
+        Self(bytes)
+    }
+
+    #[must_use]
+    pub const fn as_bytes(&self) -> &[u8; BOOT_ID_BYTES] {
+        &self.0
+    }
+}
+
 #[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
 pub struct HostPath(Vec<u8>);
 
@@ -137,10 +157,79 @@ impl SourceIdentity {
     }
 }
 
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+pub struct PidfsProcessAuthorityV1 {
+    pub boot_id: BootId,
+    pub pidfs_st_dev: PidfsDeviceId,
+    pub pidfs_st_ino: PidfsInodeId,
+}
+
 #[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, PartialEq, Serialize)]
-pub struct ProcessIdentity {
-    pub pid: ProcessId,
-    pub start_time: ProcessStartTime,
+pub struct PidfsProcessIdentityV1 {
+    authority: PidfsProcessAuthorityV1,
+    host_pid: HostPidLocator,
+    start_time_ticks: ProcessStartTimeTicks,
+}
+
+impl PidfsProcessIdentityV1 {
+    #[must_use]
+    pub const fn new(
+        authority: PidfsProcessAuthorityV1,
+        host_pid: HostPidLocator,
+        start_time_ticks: ProcessStartTimeTicks,
+    ) -> Self {
+        Self {
+            authority,
+            host_pid,
+            start_time_ticks,
+        }
+    }
+
+    #[must_use]
+    pub const fn authority(&self) -> PidfsProcessAuthorityV1 {
+        self.authority
+    }
+
+    #[must_use]
+    pub const fn host_pid(&self) -> HostPidLocator {
+        self.host_pid
+    }
+
+    #[must_use]
+    pub const fn start_time_ticks(&self) -> ProcessStartTimeTicks {
+        self.start_time_ticks
+    }
+
+    #[must_use]
+    pub fn has_same_authority(&self, other: &Self) -> bool {
+        self.authority == other.authority
+    }
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, PartialEq, Serialize)]
+pub struct LegacyUnverifiedProcessIdentityV1 {
+    host_pid: HostPidLocator,
+    start_time_ticks: ProcessStartTimeTicks,
+}
+
+impl LegacyUnverifiedProcessIdentityV1 {
+    #[must_use]
+    pub const fn new(host_pid: HostPidLocator, start_time_ticks: ProcessStartTimeTicks) -> Self {
+        Self {
+            host_pid,
+            start_time_ticks,
+        }
+    }
+
+    #[must_use]
+    pub const fn host_pid(&self) -> HostPidLocator {
+        self.host_pid
+    }
+
+    #[must_use]
+    pub const fn start_time_ticks(&self) -> ProcessStartTimeTicks {
+        self.start_time_ticks
+    }
 }
 
 #[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, PartialEq, Serialize)]
@@ -162,8 +251,11 @@ mod tests {
     use std::collections::HashSet;
 
     use super::{
-        ContainerId, CoordinatorId, DomainId, GenerationId, MountIdentity, NamespaceIdentity,
-        NetworkSidecarId, PreparedArtifactId, ProcessIdentity, RequestId, SandboxId, SessionId,
+        BootId, ContainerId, CoordinatorId, DeviceId, DomainId, GenerationId, GuestProcessId,
+        GuestProcessStartTimeTicks, HostPidLocator, LegacyUnverifiedProcessIdentityV1,
+        MountIdentity, NamespaceIdentity, NetworkSidecarId, PidfsDeviceId, PidfsInodeId,
+        PidfsProcessAuthorityV1, PidfsProcessIdentityV1, PreparedArtifactId, ProcessStartTimeTicks,
+        RequestId, SandboxId, SessionId,
     };
 
     #[test]
@@ -178,7 +270,17 @@ mod tests {
             TypeId::of::<RequestId>(),
             TypeId::of::<PreparedArtifactId>(),
             TypeId::of::<ContainerId>(),
-            TypeId::of::<ProcessIdentity>(),
+            TypeId::of::<BootId>(),
+            TypeId::of::<PidfsProcessAuthorityV1>(),
+            TypeId::of::<PidfsProcessIdentityV1>(),
+            TypeId::of::<LegacyUnverifiedProcessIdentityV1>(),
+            TypeId::of::<HostPidLocator>(),
+            TypeId::of::<ProcessStartTimeTicks>(),
+            TypeId::of::<GuestProcessId>(),
+            TypeId::of::<GuestProcessStartTimeTicks>(),
+            TypeId::of::<PidfsDeviceId>(),
+            TypeId::of::<PidfsInodeId>(),
+            TypeId::of::<DeviceId>(),
             TypeId::of::<NamespaceIdentity>(),
             TypeId::of::<MountIdentity>(),
         ];