sandlock_core/checkpoint/
mod.rs

1use serde::{Serialize, Deserialize};
2use std::path::PathBuf;
3use crate::sandbox::Sandbox;
4
5pub(crate) mod capture;
6mod image;
7mod inject;
8mod regs;
9pub(crate) mod resume;
10
11pub(crate) use capture::capture;
12
13/// A frozen snapshot of sandbox state.
14#[derive(Debug, Clone, Serialize, Deserialize)]
15pub struct Checkpoint {
16    pub name: String,
17    pub policy: Sandbox,
18    pub process_state: ProcessState,
19    pub fd_table: Vec<FdInfo>,
20    pub cow_snapshot: Option<PathBuf>,
21    pub app_state: Option<Vec<u8>>,
22}
23
24/// Captured process state via ptrace (registers) + process_vm_readv (memory) + /proc (metadata).
25#[derive(Debug, Clone, Serialize, Deserialize)]
26pub struct ProcessState {
27    pub pid: i32,
28    pub cwd: String,
29    pub exe: String,
30    pub regs: Vec<u64>,
31    pub fpregs: Vec<u8>,
32    pub memory_maps: Vec<MemoryMap>,
33    pub memory_data: Vec<MemorySegment>,
34}
35
36#[derive(Debug, Clone, Serialize, Deserialize)]
37pub struct MemorySegment {
38    pub start: u64,
39    pub data: Vec<u8>,
40}
41
42#[derive(Debug, Clone, Serialize, Deserialize)]
43pub struct MemoryMap {
44    pub start: u64,
45    pub end: u64,
46    pub perms: String,
47    pub offset: u64,
48    pub path: Option<String>,
49}
50
51impl MemoryMap {
52    pub fn writable(&self) -> bool {
53        self.perms.starts_with("rw")
54    }
55
56    pub fn private(&self) -> bool {
57        self.perms.contains('p')
58    }
59
60    pub fn is_special(&self) -> bool {
61        self.path.as_ref().map_or(false, |p| {
62            p.starts_with("[vdso]") || p.starts_with("[vvar]") || p.starts_with("[vsyscall]")
63        })
64    }
65}
66
67#[derive(Debug, Clone, Serialize, Deserialize)]
68pub struct FdInfo {
69    pub fd: i32,
70    pub path: String,
71    pub flags: i32,
72    pub offset: u64,
73}
sandlock_core/checkpoint/mod.rs

sandlock_core/checkpoint/
mod.rs
