Expand description
Per-plugin process isolation runtime.
On FreeBSD each plugin can run inside its own pdfork child process
confined to a Capsicum capability sandbox. The host (parent) and the plugin
(child) communicate over a Unix-domain socketpair using the length-prefixed
framing defined in this module on top of the crate::proto messages.
§0.1.0 scope
The control loop — [Request::Ping], [Request::GetMetadata],
[Request::Instantiate], [Request::Process], and EOF-driven shutdown —
is fully implemented. The child dlopens the plugin, verifies its ABI,
copies out its metadata, restricts the IPC socket to READ | WRITE,
enters capability mode (cap_enter, irreversible), then serves the control
loop until the host closes the IPC socket.
Real-time audio-frame marshalling (shared-memory transport between the
host RT thread and the sandboxed child) is a documented follow-up: in
0.1.0 [Request::Process] is acknowledged with [Response::Processed]
without running actual DSP inside the child.
§Platform availability
spawn_isolated and SandboxedProcess are defined on every target so
the public API compiles everywhere, but the runtime only works on FreeBSD.
On non-FreeBSD targets spawn_isolated always returns
[PluginError::Sandbox] and no SandboxedProcess can ever be
constructed.
§Verification
Because Capsicum and pdfork are FreeBSD-only, the FreeBSD path is
verified by cargo check --target x86_64-unknown-freebsd (compilation)
plus Layer 4 VM regression; it is never executed on a Linux host. The
non-FreeBSD stub is unit-tested on Linux.
Structs§
- Sandboxed
Process FreeBSD - A plugin running inside its own
pdforkchild process, confined to a Capsicum capability sandbox.
Functions§
- spawn_
isolated FreeBSD - Spawn an isolated plugin child process.