ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Centralize sandbox destination authority

Browse source
This commit is contained in:
ms2k 2026-07-19 04:36:44 +09:00
commit f8849cdb5f
4 changed files with 112 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

1
crates/lazaret-runtime-supervisor/Cargo.toml
View file

@ -14,6 +14,7 @@ hickory-proto.workspace = true
lazaret-core = { version = "=0.0.0", path = "../lazaret-core" }
lazaret-ignored-workspace = { version = "=0.0.0", path = "../lazaret-ignored-workspace" }
lazaret-linux = { version = "=0.0.0", path = "../lazaret-linux" }
lazaret-sandbox-contract = { version = "=0.0.0", path = "../lazaret-sandbox-contract" }
lazaret-state-anchor = { version = "=0.0.0", path = "../lazaret-state-anchor" }
oci-spec.workspace = true
serde.workspace = true

16
crates/lazaret-runtime-supervisor/src/sandbox.rs
View file

@ -10,6 +10,12 @@ use std::path::{Component, Path, PathBuf};
use lazaret_core::configuration::{ConfinedPathPlan, ResolvedDomainConfiguration, SandboxLayoutV1};
use lazaret_core::identity::{ConfigurationFingerprint, ContainerId, DomainId, NamespaceIdentity};
use lazaret_core::records::VolumeAccess;
pub use lazaret_sandbox_contract::{
CONTROL_ROOT_DESTINATION, CREDENTIALS_DESTINATION, DEV_DESTINATION,
ESCALATION_CLIENT_DESTINATION, MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION,
PROC_DESTINATION, SANDBOX_INIT_DESTINATION, SYS_DESTINATION, TERMINFO_ROOT_DESTINATION,
WORKSPACE_DESTINATION,
};
use oci_spec::runtime::{
Capabilities, LinuxBuilder, LinuxCapabilitiesBuilder, LinuxIdMappingBuilder,
LinuxNamespaceBuilder, LinuxNamespaceType, Mount, MountBuilder, ProcessBuilder, RootBuilder,
@ -18,14 +24,6 @@ use oci_spec::runtime::{
use rustix::fs::{AtFlags, FileType, Mode, OFlags, ResolveFlags, StatxFlags, openat2, statx};
use sha2::{Digest, Sha256};
pub const WORKSPACE_DESTINATION: &str = "/workspace";
pub const CONTROL_ROOT_DESTINATION: &str = "/run/lazaret";
pub const CREDENTIALS_DESTINATION: &str = "/run/lazaret/credentials";
pub const MAILBOX_REQUESTS_DESTINATION: &str = "/run/lazaret/mailbox/requests";
pub const MAILBOX_RESULTS_DESTINATION: &str = "/run/lazaret/mailbox/results";
pub const ESCALATION_CLIENT_DESTINATION: &str = "/run/lazaret/bin/lazaret-escalate";
pub const SANDBOX_INIT_DESTINATION: &str = "/run/lazaret/bin/lazaret-sandbox-init";
pub const TERMINFO_ROOT_DESTINATION: &str = "/run/lazaret/terminfo";
pub const NETWORK_NAMESPACE_PATH: &str = "/proc/self/ns/net";
const OCI_VERSION: &str = "1.2.1";
@ -604,7 +602,7 @@ impl SandboxBundle {
/// # Errors
/// Returns an error if the fixed layout violates the configuration layout contract.
pub fn default_sandbox_layout() -> Result<SandboxLayoutV1, SandboxBuildError> {
SandboxLayoutV1::default_layout().map_err(|error| {
lazaret_sandbox_contract::default_sandbox_layout().map_err(|error| {
SandboxBuildError::new(
SandboxBuildErrorKind::InvalidPath,
format!("default sandbox layout is invalid: {error}"),

12
crates/lazaret-runtime-supervisor/src/sandbox/mounts.rs
View file

@ -1,8 +1,13 @@
fn standard_mounts() -> Result<Vec<Mount>, SandboxBuildError> {
[
("/proc", "proc", "proc", vec!["nosuid", "noexec", "nodev"]),
(
"/dev",
PROC_DESTINATION,
"proc",
"proc",
vec!["nosuid", "noexec", "nodev"],
),
(
DEV_DESTINATION,
"tmpfs",
"tmpfs",
vec!["nosuid", "strictatime", "mode=755", "size=65536k"],
@ -32,7 +37,7 @@ fn standard_mounts() -> Result<Vec<Mount>, SandboxBuildError> {
vec!["nosuid", "noexec", "nodev"],
),
(
"/sys",
SYS_DESTINATION,
"sysfs",
"sysfs",
vec!["nosuid", "noexec", "nodev", "ro"],
@ -107,4 +112,3 @@ fn bind_mount(
.build()
.map_err(oci_error)
}

19
crates/lazaret-runtime-supervisor/tests/sandbox_builder.rs
View file

@ -9,10 +9,11 @@ use lazaret_core::configuration::{
};
use lazaret_core::identity::{ContainerId, DeviceId, InodeId, NamespaceIdentity};
use lazaret_runtime_supervisor::sandbox::{
CREDENTIALS_DESTINATION, ESCALATION_CLIENT_DESTINATION, HostTerminal,
MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION, NETWORK_NAMESPACE_PATH, RootProcess,
SANDBOX_INIT_DESTINATION, SandboxBuildErrorKind, SandboxBuildRequest, SandboxBundle,
TERMINFO_ROOT_DESTINATION, WORKSPACE_DESTINATION, build_sandbox_bundle,
CONTROL_ROOT_DESTINATION, CREDENTIALS_DESTINATION, DEV_DESTINATION,
ESCALATION_CLIENT_DESTINATION, HostTerminal, MAILBOX_REQUESTS_DESTINATION,
MAILBOX_RESULTS_DESTINATION, NETWORK_NAMESPACE_PATH, PROC_DESTINATION, RootProcess,
SANDBOX_INIT_DESTINATION, SYS_DESTINATION, SandboxBuildErrorKind, SandboxBuildRequest,
SandboxBundle, TERMINFO_ROOT_DESTINATION, WORKSPACE_DESTINATION, build_sandbox_bundle,
build_sandbox_bundle_with_workspace, default_sandbox_layout, stage_host_terminal,
};
use serde_json::Value;
@ -648,11 +649,11 @@ fn default_layout_reserves_every_mount_root() {
assert_eq!(
layout.protected_destinations(),
&BTreeSet::from([
"/dev".to_owned(),
"/proc".to_owned(),
"/run/lazaret".to_owned(),
"/sys".to_owned(),
"/workspace".to_owned(),
DEV_DESTINATION.to_owned(),
PROC_DESTINATION.to_owned(),
CONTROL_ROOT_DESTINATION.to_owned(),
SYS_DESTINATION.to_owned(),
WORKSPACE_DESTINATION.to_owned(),
])
);
assert_eq!(TERMINFO_ROOT_DESTINATION, "/run/lazaret/terminfo");