sergio
f8a2547b45
Dos ChildPreExec nuevos en el hook declarativo pre-execve:
- MountOverlay { target, options } — monta OverlayFS (capa base RO +
capa de sesión RW + workdir).
- PivotRoot { new_root, put_old, old_root_after } — bind-mount de
new_root sobre sí mismo + pivot_root + chdir("/") + umount2 lazy
(MNT_DETACH) del root viejo.
Builders ergonómicos en ChildSetup:
- with_overlay(lower, upper, work, merged)
- with_pivot_root(new_root, put_old_name)
Ambas ops corren en el hijo post-clone, dentro del mount namespace,
async-signal-safe (solo libc, sin allocator). Las consumirán mirada
(compositor Wayland) y matilda Ghost para rootfs aislados.
19 tests arje-incarnate verdes (3 nuevos: builders overlay/pivot).
cargo check --workspace verde. Pendiente: integration test en entorno
con namespaces reales.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
48 lines
1.5 KiB
Rust
48 lines
1.5 KiB
Rust
use std::path::PathBuf;
|
|
|
|
#[derive(Debug, thiserror::Error)]
|
|
pub enum IncarnateError {
|
|
#[error("namespace `{ns}` requires CAP_SYS_ADMIN or CLONE_NEWUSER (neither available)")]
|
|
NamespaceCapMissing { ns: &'static str },
|
|
|
|
#[error("user namespaces blocked by sysctl kernel.unprivileged_userns_clone=0")]
|
|
UserNsDisabledBySysctl,
|
|
|
|
#[error("user namespaces restricted by LSM (apparmor/selinux)")]
|
|
UserNsRestrictedByLsm,
|
|
|
|
#[error("cgroup path `{path}` is not writable (delegation missing?)")]
|
|
CgroupNotWritable { path: PathBuf },
|
|
|
|
#[error("payload is not executable in this incarnation path (Wasm/Virtual not supported here)")]
|
|
NonExecutablePayload,
|
|
|
|
#[error("clone(2) failed: {0}")]
|
|
Clone(#[source] nix::errno::Errno),
|
|
|
|
#[error("pipe2(2) failed: {0}")]
|
|
Pipe(#[source] nix::errno::Errno),
|
|
|
|
#[error("post-clone setup: {0}")]
|
|
PostClone(#[source] anyhow::Error),
|
|
|
|
#[error(transparent)]
|
|
Io(#[from] std::io::Error),
|
|
|
|
#[error("invalid argv: contains NUL byte")]
|
|
InvalidArgv,
|
|
|
|
#[error("rootfs path contains NUL byte (pivot_root / overlayfs)")]
|
|
InvalidRootfsPath,
|
|
}
|
|
|
|
/// Cuando `strict_caps = false`, errores no-fatales se reportan como
|
|
/// `Degradation` y la encarnación continúa con menos aislamiento del pedido.
|
|
#[derive(Debug, Clone)]
|
|
pub enum Degradation {
|
|
NamespaceSkipped { ns: &'static str },
|
|
CgroupSkipped { path: PathBuf, reason: String },
|
|
CpuAffinitySkipped { reason: String },
|
|
UidMapFailed { reason: String },
|
|
}
|