184 lines
4.7 KiB
TOML
184 lines
4.7 KiB
TOML
schema = 2
|
|
|
|
[policy]
|
|
id = "causal-child-acquisition-v1"
|
|
broker_crate = "lazaret-process-broker"
|
|
broker_state = "unimplemented"
|
|
production_roots = ["crates"]
|
|
lint_config = ".clippy.toml"
|
|
lint_allow_paths = []
|
|
dynamic_scenario = "process-safety-baseline-exercised-paths"
|
|
dynamic_coverage = "registered-exercised-paths-only"
|
|
completion_owner = "IP-03"
|
|
trace_expression = "process,wait4,waitid,rt_sigaction"
|
|
forbidden_syscall_patterns = [
|
|
'^clone3?\(',
|
|
'^execveat\(',
|
|
'^fork\(',
|
|
'^vfork\(',
|
|
'^wait4\(',
|
|
'^waitid\(',
|
|
'^rt_sigaction\(SIGCHLD,',
|
|
]
|
|
disallowed_types = [
|
|
"std::process::Child",
|
|
"std::process::Command",
|
|
"tokio::process::Child",
|
|
"tokio::process::Command",
|
|
]
|
|
disallowed_methods = [
|
|
"libc::clone",
|
|
"libc::execve",
|
|
"libc::execveat",
|
|
"libc::fork",
|
|
"libc::posix_spawn",
|
|
"libc::sigaction",
|
|
"libc::signal",
|
|
"libc::vfork",
|
|
"libc::wait",
|
|
"libc::wait4",
|
|
"libc::waitid",
|
|
"libc::waitpid",
|
|
"nix::sys::signal::sigaction",
|
|
"nix::sys::wait::wait",
|
|
"nix::sys::wait::waitid",
|
|
"nix::sys::wait::waitpid",
|
|
"nix::unistd::execve",
|
|
"nix::unistd::execveat",
|
|
"nix::unistd::fork",
|
|
"nix::unistd::vfork",
|
|
"rustix::process::kill_process",
|
|
"rustix::process::kill_process_group",
|
|
"rustix::process::pidfd_open",
|
|
"rustix::process::pidfd_send_signal",
|
|
"rustix::process::waitid",
|
|
"rustix::process::waitpid",
|
|
"std::process::Child::kill",
|
|
"std::process::Child::try_wait",
|
|
"std::process::Child::wait",
|
|
"std::process::Child::wait_with_output",
|
|
"std::process::Command::output",
|
|
"std::process::Command::spawn",
|
|
"std::process::Command::status",
|
|
]
|
|
|
|
[[trace_case]]
|
|
binary = "lazaret"
|
|
args = []
|
|
expected_exit_code = 0
|
|
initial_execve_count = 1
|
|
|
|
[[trace_case]]
|
|
binary = "lazaret-escalation-client"
|
|
args = []
|
|
expected_exit_code = 0
|
|
initial_execve_count = 1
|
|
|
|
[[trace_case]]
|
|
binary = "lazaret-host-coordinator"
|
|
args = []
|
|
expected_exit_code = 0
|
|
initial_execve_count = 1
|
|
|
|
[[trace_case]]
|
|
binary = "lazaret-network-sidecar"
|
|
args = []
|
|
expected_exit_code = 0
|
|
initial_execve_count = 1
|
|
|
|
[[trace_case]]
|
|
binary = "lazaret-runtime-supervisor"
|
|
args = []
|
|
expected_exit_code = 0
|
|
initial_execve_count = 1
|
|
|
|
[[runtime_dependency]]
|
|
name = "cobs"
|
|
version = "0.3.0"
|
|
checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
|
|
features = []
|
|
reviewed_process_apis = []
|
|
|
|
[[runtime_dependency]]
|
|
name = "embedded-io"
|
|
version = "0.4.0"
|
|
checksum = "ef1a6892d9eef45c8fa6b9e0086428a2cca8491aca8f787c534a3d6d0bcb3ced"
|
|
features = ["alloc"]
|
|
reviewed_process_apis = []
|
|
|
|
[[runtime_dependency]]
|
|
name = "embedded-io"
|
|
version = "0.6.1"
|
|
checksum = "edd0f118536f44f5ccd48bcb8b111bdc3de888b58c74639dfb034a357d0f206d"
|
|
features = ["alloc"]
|
|
reviewed_process_apis = []
|
|
|
|
[[runtime_dependency]]
|
|
name = "postcard"
|
|
version = "1.1.3"
|
|
checksum = "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24"
|
|
features = ["alloc", "use-std"]
|
|
reviewed_process_apis = []
|
|
|
|
[[runtime_dependency]]
|
|
name = "proc-macro2"
|
|
version = "1.0.106"
|
|
checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
|
|
features = ["default", "proc-macro"]
|
|
reviewed_process_apis = []
|
|
|
|
[[runtime_dependency]]
|
|
name = "quote"
|
|
version = "1.0.46"
|
|
checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
|
|
features = ["default", "proc-macro"]
|
|
reviewed_process_apis = []
|
|
|
|
[[runtime_dependency]]
|
|
name = "serde"
|
|
version = "1.0.228"
|
|
checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
|
|
features = ["alloc", "default", "derive", "serde_derive", "std"]
|
|
reviewed_process_apis = []
|
|
|
|
[[runtime_dependency]]
|
|
name = "serde_core"
|
|
version = "1.0.228"
|
|
checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
|
|
features = ["alloc", "result", "std"]
|
|
reviewed_process_apis = []
|
|
|
|
[[runtime_dependency]]
|
|
name = "serde_derive"
|
|
version = "1.0.228"
|
|
checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
|
|
features = ["default"]
|
|
reviewed_process_apis = []
|
|
|
|
[[runtime_dependency]]
|
|
name = "syn"
|
|
version = "2.0.118"
|
|
checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
|
|
features = ["clone-impls", "default", "derive", "parsing", "printing", "proc-macro"]
|
|
reviewed_process_apis = []
|
|
|
|
[[runtime_dependency]]
|
|
name = "thiserror"
|
|
version = "2.0.18"
|
|
checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
|
|
features = []
|
|
reviewed_process_apis = []
|
|
|
|
[[runtime_dependency]]
|
|
name = "thiserror-impl"
|
|
version = "2.0.18"
|
|
checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
|
|
features = []
|
|
reviewed_process_apis = []
|
|
|
|
[[runtime_dependency]]
|
|
name = "unicode-ident"
|
|
version = "1.0.24"
|
|
checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
|
|
features = []
|
|
reviewed_process_apis = []
|