sandlock_core/seccomp/
ctx.rs

1use std::os::unix::io::RawFd;
2use std::sync::Arc;
3use tokio::sync::Mutex;
4
5use super::notif::NotifPolicy;
6use super::state::{
7    ChrootState, CowState, NetworkState, PolicyFnState, ProcessIndex, ProcfsState, ResourceState,
8    TimeRandomState,
9};
10
11/// Holds all supervisor state and policy. Passed to every handler.
12pub struct SupervisorCtx {
13    /// Resource-limit state (memory, processes, checkpoint).
14    pub resource: Arc<Mutex<ResourceState>>,
15    /// Copy-on-write filesystem state.
16    pub cow: Arc<Mutex<CowState>>,
17    /// /proc virtualization state.
18    pub procfs: Arc<Mutex<ProcfsState>>,
19    /// Network policy and port remapping state.
20    pub network: Arc<Mutex<NetworkState>>,
21    /// Deterministic time/random state.
22    pub time_random: Arc<Mutex<TimeRandomState>>,
23    /// Dynamic policy callback state.
24    pub policy_fn: Arc<Mutex<PolicyFnState>>,
25    /// Chroot-specific runtime state.
26    pub chroot: Arc<Mutex<ChrootState>>,
27    /// NETLINK_ROUTE virtualization state.
28    pub netlink: Arc<crate::netlink::NetlinkState>,
29    /// Per-process registry: pid → PidKey. Source of truth for
30    /// "which processes are in the sandbox" and the anchor for
31    /// unified per-process state cleanup. Wraps an internal RwLock,
32    /// so handlers can query it synchronously without `.await`.
33    pub processes: Arc<ProcessIndex>,
34    /// Immutable policy — no lock needed.
35    pub policy: Arc<NotifPolicy>,
36    /// pidfd for the child process (immutable after spawn).
37    pub child_pidfd: Option<RawFd>,
38    /// Seccomp notification fd (for on-behalf operations).
39    pub notif_fd: RawFd,
40}
sandlock_core/seccomp/ctx.rs

sandlock_core/seccomp/
ctx.rs
