Centralize sandbox destination authority

crates/lazaret-sandbox-contract/Cargo.toml

@@ -0,0 +1,12 @@
+[package]
+name = "lazaret-sandbox-contract"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+
+[dependencies]
+lazaret-core = { version = "=0.0.0", path = "../lazaret-core" }
+
+[lints]
+workspace = true

crates/lazaret-sandbox-contract/src/lib.rs

@@ -0,0 +1,50 @@
+#![doc = "Shared destination authority for configuration resolution and sandbox bundles."]
+
+use lazaret_core::configuration::{ConfigurationError, SandboxLayoutV1};
+
+pub const WORKSPACE_DESTINATION: &str = "/workspace";
+pub const CONTROL_ROOT_DESTINATION: &str = "/run/lazaret";
+pub const CREDENTIALS_DESTINATION: &str = "/run/lazaret/credentials";
+pub const MAILBOX_REQUESTS_DESTINATION: &str = "/run/lazaret/mailbox/requests";
+pub const MAILBOX_RESULTS_DESTINATION: &str = "/run/lazaret/mailbox/results";
+pub const ESCALATION_CLIENT_DESTINATION: &str = "/run/lazaret/bin/lazaret-escalate";
+pub const SANDBOX_INIT_DESTINATION: &str = "/run/lazaret/bin/lazaret-sandbox-init";
+pub const TERMINFO_ROOT_DESTINATION: &str = "/run/lazaret/terminfo";
+pub const PROC_DESTINATION: &str = "/proc";
+pub const SYS_DESTINATION: &str = "/sys";
+pub const DEV_DESTINATION: &str = "/dev";
+
+/// Returns the protected roots derived from the destinations owned by sandbox construction.
+///
+/// # Errors
+/// Returns an error if the fixed destination contract is not a closed normalized layout.
+pub fn default_sandbox_layout() -> Result<SandboxLayoutV1, ConfigurationError> {
+    SandboxLayoutV1::from_protected_destinations([
+        WORKSPACE_DESTINATION.to_owned(),
+        CONTROL_ROOT_DESTINATION.to_owned(),
+        PROC_DESTINATION.to_owned(),
+        SYS_DESTINATION.to_owned(),
+        DEV_DESTINATION.to_owned(),
+    ])
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeSet;
+
+    use super::*;
+
+    #[test]
+    fn protected_roots_are_derived_from_bundle_destinations() {
+        assert_eq!(
+            default_sandbox_layout().unwrap().protected_destinations(),
+            &BTreeSet::from([
+                DEV_DESTINATION.to_owned(),
+                PROC_DESTINATION.to_owned(),
+                CONTROL_ROOT_DESTINATION.to_owned(),
+                SYS_DESTINATION.to_owned(),
+                WORKSPACE_DESTINATION.to_owned(),
+            ])
+        );
+    }
+}