nx_container_image_test.nx source
↩ module page · 55 lines · 2279 B
1// nx_container_image_test.nx -- rootless container running a REAL IMAGE (a
2// prepared rootfs directory, not rootfs="/"). Proves the full oracle-container
3// path: CLONE_NEWUSER + uid/gid map -> unshare(mount|uts|ipc) -> chroot into
4// /tmp/oraclerootfs -> mount /proc -> execve /bin/exit42 (a static sovereign
5// ELF placed inside the image) -> capture 42. This is the racing-bench oracle
6// lane v2.5: a benchmark binary spins up in an isolated sovereign image as an
7// unprivileged user, runs, and the jail tears down with the process.
8// The harness prepares /tmp/oraclerootfs/bin/exit42 before running this.
9// expect_exit: 0. license_tier: ORIGINAL No hw writes (Rule 26).
10import "nx_syscalls_x86_64.nx"
11import "nx_container.nx"
12
13const CLONE_NEWNS: i64 = 0x00020000
14const CLONE_NEWUTS: i64 = 0x04000000
15const CLONE_NEWIPC: i64 = 0x08000000
16
17func main(argc: i64, av_in: *i64) -> i64 {
18 // entrypoint path INSIDE the image (after chroot). argv[1] overrides the
19 // default so the same runner spins up ANY oracle placed in the rootfs.
20 var ep: *u8 = "/bin/exit42" as *u8
21 if argc >= 2 { ep = av_in[1] as *u8 }
22 var epl: i64 = 0
23 while ep[epl] != (0 as u8) { epl = epl + 1 }
24
25 let argv: *i64 = sys_mmap(32) as *i64
26 argv[0] = ep as i64
27 // pass through argv[2..] (e.g. the fannkuch N) as the oracle's argv[1..].
28 var ai: i64 = 1
29 while ai < argc - 1 { argv[ai] = av_in[ai + 1]; ai = ai + 1 }
30 argv[ai] = 0
31
32 let host: *u8 = sys_mmap(64)
33 host[0]=111 as u8; host[1]=114 as u8; host[2]=99 as u8 // "orc"
34 host[3]=108 as u8; host[4]=101 as u8; host[5]=0 as u8 // "le"
35
36 let rootfs: *u8 = "/tmp/oraclerootfs" as *u8
37 var rfl: i64 = 0
38 while rootfs[rfl] != (0 as u8) { rfl = rfl + 1 }
39
40 let spec: *ContainerSpec = sys_mmap(128) as *ContainerSpec
41 spec.rootfs_path = rootfs
42 spec.rootfs_path_len = rfl // > 1 => chroot into the image
43 spec.entry_path = ep
44 spec.entry_path_len = epl
45 spec.argv = argv
46 spec.hostname = host
47 spec.namespace_flags = CLONE_NEWUTS | CLONE_NEWIPC | CLONE_NEWNS
48 spec.rootless = 1
49
50 let res: *ContainerResult = sys_mmap(64) as *ContainerResult
51 nx_container_run(spec, res)
52
53 if res.exit_code != 42 { return 50 + res.verdict }
54 return 0
55}