1e2817537b
Closes the gap Workstream D's in-process capability scoping left open: build_scoped_env only gated presence of bread.* bindings, but os.execute/ io.open/debug.* remained fully reachable since a module's Lua still ran inside breadd's own process. A module that declares [[permissions]] in bread.module.toml (including an explicit empty list) is now spawned as a separate bread-module-host process instead, restricted by a Landlock ruleset breadd builds from that module's granted permissions and applies via Command::pre_exec before the child executes any Lua at all. A module with no manifest at all keeps today's in-process, ungated behavior for backward compatibility. - bread-module-host: new minimal binary (mlua + tokio + serde_json) that connects to breadd's existing IPC socket, presents a one-time spawn token, and proxies bread.* calls as RPC instead of direct bindings. - breadd/src/module_host.rs: spawn + token registry + apply_sandbox (Landlock ruleset construction), with unit tests that spawn a real child and verify denial at the OS level, not a Lua-level check. - breadd/src/ipc/module_host_bridge.rs: the module_host.* RPC bridge (on/once/off/emit/after/every/cancel, fs.read/write, exec/exec_capture, state.get, log/warn/error, status) plus the hello handshake. Bumped API_VERSION to 1.6.0. - breadd/tests/module_host_sandbox.rs: end-to-end acceptance tests going through a real spawned breadd + bread-module-host + IPC handshake — os.execute/io.open denied outside a module's granted fs.read scope, and kill -9 on a module-host child leaving breadd and other modules intact while breadd reports bread.module.crashed. - bread-shared/src/module_host_ipc.rs: shared wire types (hello result, tagged event/timer push envelope) so breadd and bread-module-host can't drift on the handshake/push shape. Deferred (documented in Documentation.md's Workstream G section): the trust="in-process" opt-out, remaining bread.* namespaces over RPC (hyprland/widget/machine/bluetooth/notify/state.watch), network sandboxing, and a fully static build that would remove the Execute grant Landlock's dynamic-linker requirement forces on system library dirs.
29 lines
713 B
TOML
29 lines
713 B
TOML
[package]
|
|
name = "breadd"
|
|
version = "0.7.0"
|
|
edition = "2021"
|
|
|
|
[dependencies]
|
|
bread-shared = { path = "../bread-shared" }
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
tokio.workspace = true
|
|
anyhow.workspace = true
|
|
tracing.workspace = true
|
|
tracing-subscriber.workspace = true
|
|
mlua = { version = "0.9", features = ["lua54", "vendored", "async", "serialize"] }
|
|
async-trait = "0.1"
|
|
toml = "0.8"
|
|
udev = { version = "0.9", features = ["send"] }
|
|
rtnetlink = "0.9"
|
|
zbus = { version = "3.13", features = ["tokio"] }
|
|
futures-util = "0.3"
|
|
netlink-packet-route = "0.11"
|
|
netlink-packet-core = "0.4"
|
|
libc = "0.2"
|
|
notify = "6.1"
|
|
landlock.workspace = true
|
|
uuid.workspace = true
|
|
|
|
[dev-dependencies]
|
|
tempfile.workspace = true
|