capsule_runtime/
lib.rs

1// `security::harden_process_dumpable` needs one `unsafe { libc::prctl(...) }` call on Linux;
2// `#[allow(unsafe_code)]` on that item overrides this crate-level default of `deny` rather
3// than `forbid`, since `forbid` cannot be overridden by a narrower `allow` anywhere in the crate.
4#![deny(unsafe_code)]
5
6pub(crate) mod a2a;
7pub(crate) mod agent;
8#[cfg(feature = "alloc-bench")]
9pub mod alloc_bench;
10pub mod artifact;
11pub mod artifact_config;
12pub mod bindings;
13pub(crate) mod cancel;
14pub(crate) mod cgroup;
15pub mod child_launch;
16pub mod containment;
17pub(crate) mod conversation;
18pub(crate) mod conversation_import;
19pub mod delegation;
20pub mod delegation_plane;
21pub mod detached;
22pub(crate) mod detached_reconcile;
23pub(crate) mod dns_resolver;
24pub(crate) mod egress_proxy;
25pub mod errors;
26pub(crate) mod fence;
27pub(crate) mod hooks;
28pub(crate) mod http_client;
29pub(crate) mod identity;
30pub(crate) mod inference_credential;
31pub(crate) mod inference_gateway;
32pub(crate) mod inference_import;
33pub mod lanes;
34pub mod limits;
35pub mod mac_token;
36pub mod murmur_home;
37pub(crate) mod murmur_md;
38pub mod network_namespace;
39pub(crate) mod network_policy;
40pub mod origin;
41pub(crate) mod otel;
42pub(crate) mod outgoing;
43pub mod peer_handoff;
44pub mod plan;
45pub(crate) mod protected_paths;
46pub(crate) mod reachability;
47pub(crate) mod recipes;
48pub mod registration;
49pub mod resource_plane;
50pub mod resources;
51pub mod retention;
52pub mod running;
53pub mod runtime;
54pub(crate) mod sandbox;
55pub mod sealed;
56pub mod security;
57pub(crate) mod shell;
58pub mod spawn_credential;
59pub mod spawn_envelope;
60pub(crate) mod spend;
61pub mod staged_runtime;
62pub mod state_store;
63pub(crate) mod streaming;
64pub(crate) mod task_io_import;
65pub(crate) mod tokens_import;
66pub(crate) mod tool_annotations;
67pub(crate) mod trace;
68pub(crate) mod trace_blobs;
69pub mod types;
70pub mod workdir_writes;
71
72pub use artifact_config::{
73    configured_artifact_names, lower_artifact_config, ARTIFACT_CONFIG_ENV,
74    MAX_ARTIFACT_CONFIG_BYTES,
75};
76pub use containment::{
77    check_containment_floor, containment_shortfall_reason, detect_achieved_containment,
78    detect_sealed_blocker, detect_userns_grant, explain_scope, read_only_advisory_for,
79    render_read_only, ExportsFilesReport, FilesystemBoundaryReport, FilesystemRestriction,
80    PreopenReport, PreopenSurface, ScopeReport, StateStoreReport,
81};
82pub use network_namespace::{
83    check_egress_namespace, detect_egress_namespace_blocker, skip_without_egress_namespace,
84    EgressNamespaceBlocker,
85};
86// `network_policy` is a private module; `preopen_reports` is re-exported because `mur run
87// --explain-scope` and `mur doctor` both resolve the preopen set the same way `stage_session`
88// does, and one resolver shared by all three is what keeps the report a description of the launch.
89pub use network_policy::preopen_reports;
90// `sandbox` is a private module; `HostProbe` is re-exported because the freshness of a session's
91// host reading is asserted from integration tests outside this crate. `find_on_path` is re-exported
92// so a caller outside this crate resolves a binary name the way the shell allowlist and the
93// invoked-binary report already resolve one, rather than open-coding the `PATH` walk again.
94pub use sandbox::{find_on_path, HostProbe};
95pub use sealed::{
96    classify_installed_profile, classify_profile_attachment, inspect_installed_profile,
97    inspect_profile_attachment, InstalledProfileState, ProfileAttachment, SealedBlocker,
98    UsernsGrant, SEALED_APPARMOR_ATTACHMENT_PATHS, SEALED_APPARMOR_PROFILE_PATH,
99    SEALED_APPARMOR_PROFILE_SHA256,
100};
101// `cgroup` is a private module, but the entry points below are consumed from `murmur-cli` — the
102// three test-support probes from its integration tests, and the `io.max` reporting from
103// `mur run --explain-scope`, which has to answer the same question a launch does without staging
104// a session. Re-exported here rather than duplicating either probe once per crate that needs it.
105pub use cgroup::{
106    cgroup_delegation_available, io_max_device_available, probe_io_max, requires_process_bounding,
107    skip_without_host_support, IoMaxReport, IoMaxStatus,
108};
109pub use child_launch::{
110    child_workdir_for, launch_child_capsule, ChildLaunchRequest, LaunchedChild, MUR_BINARY_ENV,
111};
112// The delegation types and constants stay module-qualified beyond these: `Spawner` and
113// `SpawnerHandle` are what a caller of `launch_child_capsule` composes, and the rest of the
114// module — the outcome, the file, the two headers — is read by name from `delegation::`.
115pub use delegation::{CompletionAddress, Spawner, SpawnerHandle};
116// The delegating side's own types. `DelegationPlane` is built by `launch_session` and reached
117// only through the `delegate-task` dispatch branch, so what leaves this crate is the vocabulary a
118// reader of a trace or a tool result needs, plus the bound and its override.
119pub use delegation_plane::{
120    DelegationLaunch, DelegationOrigin, DelegationPlane, DelegationRequest, DelegationResult,
121    DELEGATION_RESULT_TIMEOUT, DELEGATION_TIMEOUT_ENV,
122};
123// `reachability` is a private module, but both of its entry points are consumed from
124// `murmur-cli`'s `mur doctor` as well as from `stage_session`, so they are re-exported here — the
125// same facade shape `check_staged_runtime_floor` has, without making the module's internals
126// (`shebang_interpreter_name`, the probe, the prefix helpers) part of any crate's API.
127pub use errors::{RuntimeError, UnreachableEntrypoint};
128pub use lanes::TaskLane;
129pub use limits::ExecutionLimits;
130pub use murmur_artifact::{AfterTask, LifecycleConfig, LifecycleOverride, TaskAcceptance};
131// The types and header names are flat; `origin::from_wire` and `origin::stamp_for_peer` stay
132// module-qualified, because their bare names say nothing about tasks.
133pub use origin::{TaskOrigin, TaskProvenance, TrustClass, PEER_ORIGIN_HEADER, PEER_TRUST_HEADER};
134pub use peer_handoff::{
135    audience_from_card, handle_id, handle_peer_request, is_peer_path, mint, stored_path_for,
136    verify, HandleError, HandlePayload, MintedHandle, PeerError, PeerMintKey, PeerPlane,
137    AUDIENCE_HEADER, HANDLE_ID_HEADER, PEER_INBOX_DIR, PEER_PATH_PREFIX,
138};
139pub use reachability::{
140    check_interpreted_entrypoints_reachable, warn_on_unreachable_toolchain_helpers,
141    ToolchainHelperReport, ToolchainHelperWarning, UnprobedToolchainDriver,
142};
143pub use registration::{check_roost_health, deregister_session, register_session, SessionOutcome};
144pub use resource_plane::{
145    check_export_root, check_peer_files_root, handle_resource_request, reason_phrase,
146    symlink_policy, DeclaredExport, ListEntry, ListResponse, ReadResponse, ResourceError,
147    ResourcePlane, ResourceResponse, SymlinkPolicy, RESOURCE_PATH_PREFIX,
148};
149pub use resources::HostResourceLimits;
150// `retention` is its own public module rather than a set of flat re-exports: `mur conversation`
151// consumes six of its entry points and four of its types, and a facade that wide is a second
152// place for the names to drift.
153pub use retention::{
154    list_records, locate_message, prune_records, prune_sessions, remove_record, truncate_record,
155    MessageLocation, MessageStatus, PrunedRecord, PrunedSession, RecordHeader, RecordSummary,
156    RemovedRecord, TruncationMarker, TruncationOutcome,
157};
158// The running-capsule vocabulary a reader of a record needs. The verbs stay module-qualified —
159// `running::list`, `running::verify`, `running::prune`, `running::running_dir` — on the same terms
160// as `origin::from_wire`: their bare names say nothing about capsules.
161pub use running::{Liveness, ProcessState, RunningGuard, RunningRecord, SignalOutcome};
162pub use runtime::{
163    check_env_allow_reaches_guests, check_no_reserved_tool_names, launch_session,
164    launch_session_handling_sigterm, secret_shaped_env_grants, stage_session,
165    stripped_env_allow_entries, warn_on_inference_endpoint_in_network_allow,
166    warn_on_interpreter_runtime_grants, warn_on_launch_only_inference_credential,
167    warn_on_machine_spend_ceiling_under_process_transport, warn_on_secret_shaped_env_grants,
168    warn_on_userns_restriction_disabled_host_wide, warn_on_workdir_exec, SecretShapedEnvGrant,
169    StrippedEnvAllowEntry,
170};
171// The one question about a variable name a caller outside the runtime needs answered: would the
172// credential backstop drop it, and by which pattern. `shell` is otherwise crate-private, and these
173// are what `secret_shaped_env_grants` and `check_env_allow_reaches_guests` judge a
174// `capabilities.env.allow` entry with.
175pub use shell::{
176    credential_backstop_drops, credential_backstop_match, BackstopMatch, BackstopPatternSource,
177};
178pub use spawn_credential::{
179    SpawnApproval, SpawnCredential, SPAWN_APPROVAL_HEADER, SPAWN_CREDENTIAL_HEADER,
180};
181pub use spawn_envelope::{EnvelopeAxis, EnvelopeViolation, SpawnEnvelope};
182pub use staged_runtime::check_staged_runtime_floor;
183pub use state_store::{
184    ensure_state_store, state_store_reports, validate_store_name, STATE_PREOPEN_NAME,
185};
186pub use trace::{PlanTraceAppender, ResourceTraceAppender};
187pub use types::{
188    capability_policy_from_runtime_manifest, ArtifactRequest, CapabilityPolicy,
189    InstalledArtifactSummary, LaunchResult, LockExpectation, ResolvedLockArtifact, ResumeMode,
190    ResumeRequest, StageRequest, StagedSession,
191};
192// The declaration `--explain-scope` prints and `trace.jsonl` carries as
193// `session_start.effective_grants.runtime_writes`. Flat, on the same terms as the other report
194// types: a consumer of a scope report reads these names off it.
195pub use workdir_writes::{
196    render_runtime_writes, RuntimeWriteCondition, RuntimeWriteKind, RuntimeWriteReport,
197    RuntimeWriteScope, SESSION_ID_PLACEHOLDER,
198};
capsule_runtime/lib.rs

capsule_runtime/
lib.rs
