capsule_runtime/
lib.rs

1// `security::harden_process_dumpable` needs one `unsafe { libc::prctl(...) }` call on Linux;
2// `#[allow(unsafe_code)]` on that item overrides this crate-level default of `deny` rather
3// than `forbid`, since `forbid` cannot be overridden by a narrower `allow` anywhere in the crate.
4#![deny(unsafe_code)]
5
6pub(crate) mod a2a;
7#[cfg(test)]
8mod a2a_card_conformance;
9#[cfg(test)]
10mod a2a_card_conformance_tests;
11pub(crate) mod agent;
12#[cfg(feature = "alloc-bench")]
13pub mod alloc_bench;
14pub mod artifact;
15pub mod artifact_config;
16pub(crate) mod artifact_removal;
17pub mod bindings;
18pub(crate) mod cancel;
19pub(crate) mod cgroup;
20pub mod child_launch;
21pub(crate) mod compiled_forms;
22pub mod containment;
23pub(crate) mod control_plane;
24pub(crate) mod conversation;
25pub(crate) mod conversation_import;
26pub mod delegation;
27pub mod delegation_plane;
28pub mod detached;
29pub(crate) mod detached_reconcile;
30pub mod door_auth;
31pub(crate) mod driver_choice;
32// Public so the `runtime_out!` / `runtime_err!` macros resolve `$crate::diagnostic` from outside
33// this crate, and so `mur run`'s launch path writes its lines the same way the runtime does.
34pub(crate) mod credential_gateway;
35pub mod diagnostic;
36pub(crate) mod dns_resolver;
37pub(crate) mod egress_proxy;
38pub mod errors;
39pub(crate) mod fence;
40pub mod formation;
41pub mod formation_credentials;
42pub mod formation_launch;
43pub(crate) mod gateway_credential;
44pub(crate) mod harness_session;
45pub(crate) mod hooks;
46pub mod host_warnings;
47pub(crate) mod http_client;
48pub(crate) mod identity;
49pub(crate) mod inference_import;
50pub(crate) mod install_grant;
51pub mod lanes;
52pub mod lifeline;
53pub mod limits;
54pub mod mac_token;
55pub(crate) mod member_call;
56pub mod murmur_home;
57pub(crate) mod murmur_md;
58pub mod network_namespace;
59pub(crate) mod network_policy;
60pub mod origin;
61pub(crate) mod otel;
62pub(crate) mod outgoing;
63pub mod peer_handoff;
64pub(crate) mod peer_tasks;
65#[cfg(test)]
66mod pinned_port;
67pub mod plan;
68pub mod precompile;
69pub mod process_driver;
70pub(crate) mod protected_paths;
71pub(crate) mod reachability;
72pub(crate) mod recipes;
73pub mod registration;
74pub(crate) mod required_fields;
75pub mod resource_plane;
76pub mod resources;
77pub mod retention;
78pub mod roster;
79pub mod running;
80pub mod runtime;
81pub(crate) mod sandbox;
82pub mod sealed;
83pub mod security;
84pub(crate) mod shell;
85#[cfg(test)]
86mod source_scan;
87pub mod spawn_credential;
88pub mod spawn_envelope;
89pub(crate) mod spend;
90pub mod staged_runtime;
91pub mod state_store;
92pub(crate) mod stream_events;
93pub(crate) mod streaming;
94pub(crate) mod task_io_import;
95pub(crate) mod tokens_import;
96pub(crate) mod tool_annotations;
97pub(crate) mod tool_call_progress;
98pub(crate) mod trace;
99pub(crate) mod trace_blobs;
100pub mod types;
101pub(crate) mod wit_versions;
102pub mod workdir_writes;
103
104pub use artifact_config::{
105    configured_artifact_names, lower_artifact_config, ARTIFACT_CONFIG_ENV,
106    MAX_ARTIFACT_CONFIG_BYTES,
107};
108pub use containment::{
109    check_containment_floor, containment_shortfall_reason, detect_achieved_containment,
110    detect_sealed_blocker, detect_userns_grant, explain_scope, read_only_advisory_for,
111    render_install, render_read_only, ExportsFilesReport, FilesystemBoundaryReport,
112    FilesystemRestriction, PreopenReport, PreopenSurface, ScopeReport, StateStoreReport,
113};
114pub use diagnostic::{diagnostic_workdir, set_diagnostic_workdir, Emitted};
115pub use network_namespace::{
116    check_egress_namespace, detect_egress_namespace_blocker, skip_without_egress_namespace,
117    EgressNamespaceBlocker,
118};
119// `network_policy` is a private module; `preopen_reports` is re-exported because `mur run
120// --explain-scope` and `mur doctor` both resolve the preopen set the same way `stage_session`
121// does, and one resolver shared by all three is what keeps the report a description of the launch.
122pub use network_policy::preopen_reports;
123// `sandbox` is a private module; `HostProbe` is re-exported because the freshness of a session's
124// host reading is asserted from integration tests outside this crate. `find_on_path` is re-exported
125// so a caller outside this crate resolves a binary name the way the shell allowlist and the
126// invoked-binary report already resolve one, rather than open-coding the `PATH` walk again.
127pub use sandbox::{find_on_path, HostProbe};
128pub use sealed::{
129    classify_installed_profile, classify_profile_attachment, inspect_installed_profile,
130    inspect_profile_attachment, InstalledProfileState, ProfileAttachment, SealedBlocker,
131    UsernsGrant, SEALED_APPARMOR_ATTACHMENT_PATHS, SEALED_APPARMOR_PROFILE_PATH,
132    SEALED_APPARMOR_PROFILE_SHA256,
133};
134// `cgroup` is a private module, but the entry points below are consumed from `murmur-cli` — the
135// three test-support probes from its integration tests, the `io.max` reporting from
136// `mur run --explain-scope` and the swap-bound reporting from `mur doctor`, each of which has to
137// answer the question a launch does without staging a session. Re-exported here rather than
138// duplicating a probe once per crate that needs it.
139pub use cgroup::{
140    active_swap_areas, cgroup_delegation_available, io_max_device_available, probe_io_max,
141    probe_swap_control, requires_process_bounding, skip_without_host_support, IoMaxReport,
142    IoMaxStatus, SwapControl, SCOPE_SWAP_MAX,
143};
144pub use child_launch::{
145    child_workdir_for, launch_child_capsule, ChildLaunchRequest, LaunchedChild, MUR_BINARY_ENV,
146    READINESS_TOKENS_FLAG,
147};
148// The delegation types and constants stay module-qualified beyond these: `Spawner` and
149// `SpawnerHandle` are what a caller of `launch_child_capsule` composes, and the rest of the
150// module — the outcome, the file, the two headers — is read by name from `delegation::`.
151pub use delegation::{CompletionAddress, Spawner, SpawnerHandle};
152// The delegating side's own types. `DelegationPlane` is built by `launch_session` and reached
153// only through the `delegate-task` dispatch branch, so what leaves this crate is the vocabulary a
154// reader of a trace or a tool result needs, plus the bound and its override.
155pub use delegation_plane::{
156    DelegationLaunch, DelegationOrigin, DelegationPlane, DelegationRequest, DelegationResult,
157    StartedDelegation, DELEGATION_RESULT_TIMEOUT, DELEGATION_TIMEOUT_ENV,
158};
159// `reachability` is a private module, but both of its entry points are consumed from
160// `murmur-cli`'s `mur doctor` as well as from `stage_session`, so they are re-exported here — the
161// same facade shape `check_staged_runtime_floor` has, without making the module's internals
162// (`shebang_interpreter_name`, the probe, the prefix helpers) part of any crate's API.
163pub use door_auth::{
164    bearer_header, door_posture, is_loopback_bind, public_door_bind_warning, public_door_warning,
165    render_public_door_warning, AuthRefusal, DoorAuth, DoorExposure, DoorGrant, DoorToken,
166    PublicDoorDisclosure, DOOR_TOKEN_ENV,
167};
168pub use errors::{RuntimeError, UnreachableEntrypoint};
169pub use formation::{FormationId, FormationPeer, FormationPeers};
170pub use formation_credentials::{
171    FormationAuthority, FormationBundle, FormationMember, FormationToken, FormationVerifier,
172    FormationVerifyKey, FORMATION_CALL_SCOPES, FORMATION_CHANNEL_ENV,
173};
174pub use host_warnings::{
175    host_warnings_reported, host_warnings_reported_in, HOST_WARNINGS_REPORTED_ENV,
176};
177pub use lanes::TaskLane;
178#[cfg(unix)]
179pub use lifeline::{ChildLifeline, FormationLifeline, MemberLifeline, SpawnerLifeline};
180pub use lifeline::{FORMATION_LIFELINE_ENV, SPAWNER_LIFELINE_ENV};
181pub use limits::ExecutionLimits;
182pub use murmur_artifact::{AfterTask, LifecycleConfig, LifecycleOverride, TaskAcceptance};
183// The types and header names are flat; `origin::from_wire` and `origin::stamp_for_peer` stay
184// module-qualified, because their bare names say nothing about tasks.
185pub use origin::{TaskOrigin, TaskProvenance, TrustClass, PEER_ORIGIN_HEADER, PEER_TRUST_HEADER};
186pub use peer_handoff::{
187    audience_from_card, handle_id, handle_peer_request, is_peer_path, mint, stored_path_for,
188    verify, HandleError, HandlePayload, MintedHandle, PeerError, PeerMintKey, PeerPlane,
189    AUDIENCE_HEADER, HANDLE_ID_HEADER, PEER_INBOX_DIR, PEER_PATH_PREFIX,
190};
191pub use reachability::{
192    check_interpreted_entrypoints_reachable, warn_on_unreachable_toolchain_helpers,
193    ToolchainHelperReport, ToolchainHelperWarning, UnprobedToolchainDriver,
194};
195pub use registration::{check_roost_health, deregister_session, register_session, SessionOutcome};
196pub use resource_plane::{
197    check_export_root, check_peer_files_root, handle_resource_request, reason_phrase,
198    symlink_policy, DeclaredExport, ListEntry, ListResponse, ReadResponse, ResourceError,
199    ResourcePlane, ResourceResponse, SymlinkPolicy, RESOURCE_PATH_PREFIX,
200};
201pub use resources::HostResourceLimits;
202// `retention` is its own public module rather than a set of flat re-exports: `mur conversation`
203// consumes six of its entry points and four of its types, and a facade that wide is a second
204// place for the names to drift.
205pub use retention::{
206    list_records, locate_message, prune_records, prune_sessions, remove_record, truncate_record,
207    MessageLocation, MessageStatus, PrunedRecord, PrunedSession, RecordHeader, RecordSummary,
208    RemovedRecord, TruncationMarker, TruncationOutcome,
209};
210pub use roster::{
211    admit_roster, admit_roster_file, caller_overflow_fix, caller_overflow_warning, AdmittedMember,
212    AdmittedRoster, CallerOverflow, RosterEdge, RosterRefusal,
213};
214// The running-capsule vocabulary a reader of a record needs. The verbs stay module-qualified —
215// `running::list`, `running::verify`, `running::prune`, `running::running_dir` — on the same terms
216// as `origin::from_wire`: their bare names say nothing about capsules.
217pub use running::{Liveness, ProcessState, RunningGuard, RunningRecord, SignalOutcome};
218pub use runtime::{
219    check_env_allow_reaches_guests, check_no_reserved_tool_names, launch_session,
220    launch_session_handling_sigterm, secret_shaped_env_grants, stage_session,
221    stripped_env_allow_entries, undeclarable_runtime_pin_role,
222    warn_on_gateway_endpoint_in_network_allow, warn_on_interpreter_runtime_grants,
223    warn_on_launch_only_gateway_credential, warn_on_secret_shaped_env_grants,
224    warn_on_unmetered_gateways, warn_on_userns_restriction_disabled_host_wide,
225    warn_on_workdir_exec, SecretShapedEnvGrant, StrippedEnvAllowEntry,
226};
227// The one question about a variable name a caller outside the runtime needs answered: would the
228// credential backstop drop it, and by which pattern. `shell` is otherwise crate-private, and these
229// are what `secret_shaped_env_grants` and `check_env_allow_reaches_guests` judge a
230// `capabilities.env.allow` entry with.
231pub use shell::{
232    credential_backstop_drops, credential_backstop_match, BackstopMatch, BackstopPatternSource,
233};
234pub use spawn_credential::{
235    SpawnApproval, SpawnCredential, SPAWN_APPROVAL_HEADER, SPAWN_CREDENTIAL_HEADER,
236};
237pub use spawn_envelope::{EnvelopeAxis, EnvelopeViolation, SpawnEnvelope};
238pub use staged_runtime::check_staged_runtime_floor;
239pub use state_store::{
240    ensure_state_store, state_store_reports, validate_store_name, STATE_PREOPEN_NAME,
241};
242pub use trace::{PlanTraceAppender, ResourceTraceAppender};
243pub use types::{
244    capability_policy_from_runtime_manifest, ArtifactRequest, CapabilityPolicy,
245    InstalledArtifactSummary, LaunchEnding, LaunchResult, LockExpectation, ResolvedLockArtifact,
246    ResumeMode, ResumeRequest, StageRequest, StagedSession,
247};
248// The declaration `--explain-scope` prints and `trace.jsonl` carries as
249// `session_start.effective_grants.runtime_writes`. Flat, on the same terms as the other report
250// types: a consumer of a scope report reads these names off it.
251pub use workdir_writes::{
252    render_runtime_writes, RuntimeWriteCondition, RuntimeWriteKind, RuntimeWriteReport,
253    RuntimeWriteScope, SESSION_ID_PLACEHOLDER,
254};
255// The served version of each `murmur:*` package, which `mur doctor` compares installed artifacts
256// against.
257pub use wit_versions::SERVED_WIT_PACKAGES;
capsule_runtime/lib.rs

capsule_runtime/
lib.rs
