ms2k
73e3e9fdee
Resolve and verify canonical caller subordinate ranges, launch preparation and runtime workers through mapped causal acquisition, and keep runsc in the existing user namespace. Repair descriptor-relative OCI cleanup and absent-mount recovery so failed launches can progress to the corrected path.
87 lines
3.1 KiB
Rust
87 lines
3.1 KiB
Rust
use std::ffi::OsString;
|
|
use std::io;
|
|
|
|
use lazaret_core::protocol::PRIVATE_CLIENT_BOOTSTRAP_ROLE;
|
|
use lazaret_ignored_workspace::{PRIVATE_ROUTER_ROLE, dispatch_private_router};
|
|
use lazaret_linux::private_role::{PrivateRole, PrivateRoleRegistry};
|
|
use lazaret_linux::process::{PRIVATE_PROCESS_ROLE, dispatch_private_process_role};
|
|
use lazaret_runtime_supervisor::supervision::{
|
|
PRIVATE_RUNTIME_ROLE, dispatch_private_runtime_role,
|
|
};
|
|
use lazaret_state_anchor::{
|
|
PRIVATE_STATE_ANCHOR_RECOVERY_ROLE, dispatch_private_state_anchor_recovery,
|
|
};
|
|
|
|
use crate::client_bootstrap::dispatch_private_client_bootstrap;
|
|
use crate::prepared_worker::{PRIVATE_PREPARED_WORKER_ROLE, dispatch_private_prepared_worker};
|
|
use crate::sandbox_init::{
|
|
PRIVATE_SANDBOX_INIT_ROLE, PRIVATE_SESSION_EXEC_ROLE, PRIVATE_SESSION_IDENTITY_ROLE,
|
|
dispatch_private_sandbox_init,
|
|
};
|
|
|
|
fn sandbox_init(arguments: &[OsString]) -> Option<io::Result<()>> {
|
|
dispatch_exact(PRIVATE_SANDBOX_INIT_ROLE, arguments)
|
|
}
|
|
|
|
fn client_bootstrap(arguments: &[OsString]) -> Option<io::Result<()>> {
|
|
dispatch_private_client_bootstrap(arguments)
|
|
.map(|result| result.map_err(|error| io::Error::other(error.to_string())))
|
|
}
|
|
|
|
fn session_exec(arguments: &[OsString]) -> Option<io::Result<()>> {
|
|
dispatch_exact(PRIVATE_SESSION_EXEC_ROLE, arguments)
|
|
}
|
|
|
|
fn session_identity(arguments: &[OsString]) -> Option<io::Result<()>> {
|
|
dispatch_exact(PRIVATE_SESSION_IDENTITY_ROLE, arguments)
|
|
}
|
|
|
|
fn dispatch_exact(role: &str, arguments: &[OsString]) -> Option<io::Result<()>> {
|
|
(arguments.first() == Some(&OsString::from(role))).then(|| {
|
|
dispatch_private_sandbox_init(arguments)
|
|
.unwrap_or_else(|| Err(io::Error::other("private role arguments are malformed")))
|
|
})
|
|
}
|
|
|
|
static ROLES: [PrivateRole; 9] = [
|
|
PrivateRole::new(PRIVATE_CLIENT_BOOTSTRAP_ROLE, client_bootstrap),
|
|
PrivateRole::new(
|
|
PRIVATE_PREPARED_WORKER_ROLE,
|
|
dispatch_private_prepared_worker,
|
|
),
|
|
PrivateRole::new(PRIVATE_SANDBOX_INIT_ROLE, sandbox_init),
|
|
PrivateRole::new(PRIVATE_SESSION_EXEC_ROLE, session_exec),
|
|
PrivateRole::new(PRIVATE_SESSION_IDENTITY_ROLE, session_identity),
|
|
PrivateRole::new(
|
|
PRIVATE_STATE_ANCHOR_RECOVERY_ROLE,
|
|
dispatch_private_state_anchor_recovery,
|
|
),
|
|
PrivateRole::new(PRIVATE_PROCESS_ROLE, dispatch_private_process_role),
|
|
PrivateRole::new(PRIVATE_ROUTER_ROLE, dispatch_private_router),
|
|
PrivateRole::new(PRIVATE_RUNTIME_ROLE, dispatch_private_runtime_role),
|
|
];
|
|
|
|
pub static REGISTRY: PrivateRoleRegistry = PrivateRoleRegistry::new(&ROLES);
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
|
|
#[test]
|
|
fn host_coordinator_declares_exact_ordered_roles() {
|
|
assert_eq!(
|
|
REGISTRY.names(),
|
|
[
|
|
PRIVATE_CLIENT_BOOTSTRAP_ROLE,
|
|
PRIVATE_PREPARED_WORKER_ROLE,
|
|
PRIVATE_SANDBOX_INIT_ROLE,
|
|
PRIVATE_SESSION_EXEC_ROLE,
|
|
PRIVATE_SESSION_IDENTITY_ROLE,
|
|
PRIVATE_STATE_ANCHOR_RECOVERY_ROLE,
|
|
PRIVATE_PROCESS_ROLE,
|
|
PRIVATE_ROUTER_ROLE,
|
|
PRIVATE_RUNTIME_ROLE,
|
|
]
|
|
);
|
|
}
|
|
}
|