ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Centralize sandbox destination authority

Browse source
This commit is contained in:
ms2k 2026-07-19 04:36:44 +09:00
commit f8849cdb5f
2 changed files with 112 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

15
crates/lazaret-host-coordinator/src/runtime_selector.rs
View file

@ -21,9 +21,10 @@ use lazaret_prepared_lower::{
};
use lazaret_runtime_supervisor::network::{DnsProbeTarget, NetworkProbeRequest, TcpProbeTarget};
use lazaret_runtime_supervisor::sandbox::{
CREDENTIALS_DESTINATION, ESCALATION_CLIENT_DESTINATION, MAILBOX_REQUESTS_DESTINATION,
MAILBOX_RESULTS_DESTINATION, RootProcess, SANDBOX_INIT_DESTINATION, TERMINFO_ROOT_DESTINATION,
WORKSPACE_DESTINATION,
CREDENTIALS_DESTINATION, DEV_DESTINATION, ESCALATION_CLIENT_DESTINATION,
MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION, NETWORK_NAMESPACE_PATH,
PROC_DESTINATION, RootProcess, SANDBOX_INIT_DESTINATION, SYS_DESTINATION,
TERMINFO_ROOT_DESTINATION, WORKSPACE_DESTINATION,
};
use lazaret_storage_catalog::{Catalog, CatalogError};
use rustix::fs::{Mode, OFlags, ResolveFlags, openat2};
@ -33,8 +34,6 @@ use crate::domain_store::HostCoordinatorDomainStore;
use crate::recovery::recover_before_cold_start;
use crate::sandbox_init::PRIVATE_SANDBOX_INIT_ROLE;
const NETWORK_NAMESPACE_PATH: &str = "/proc/self/ns/net";
#[derive(Debug)]
pub enum RuntimeSelectionError {
PreparedLower(PreparedLowerError),
@ -240,9 +239,9 @@ async fn select_runtime_for_platform(
fn prepared_destinations(configuration: &ResolvedDomainConfiguration) -> Vec<PreparedDestination> {
let mut destinations = [
"/dev",
"/proc",
"/sys",
DEV_DESTINATION,
PROC_DESTINATION,
SYS_DESTINATION,
"/tmp",
"/etc",
"/home",

2
crates/lazaret-host-coordinator/src/waiter.rs
View file

@ -726,7 +726,7 @@ mod tests {
xdg_data_home: None,
xdg_runtime_dir: runtime,
environment: BTreeMap::new(),
sandbox_layout: lazaret_core::configuration::SandboxLayoutV1::default_layout().unwrap(),
sandbox_layout: lazaret_runtime_supervisor::sandbox::default_sandbox_layout().unwrap(),
})
.unwrap()
}