Validate complete engine addresses and retain shared socket inputs (#503)

restricted-execution/identity-launcher.nix

@@ -12,17 +12,31 @@ assert builtins.match "[a-z][a-z0-9_-]{0,63}" authorityUser != null;
 assert builtins.match "/run/[a-zA-Z0-9_/-]+" engineDirectory != null;
 assert !(pkgs.lib.hasInfix ".." engineDirectory);
 assert !(pkgs.lib.hasSuffix "/" engineDirectory);
-assert builtins.stringLength engineDirectory < 80;
 assert builtins.isInt firstUid && builtins.isInt identityCount;
 assert firstUid >= 610000 && firstUid + identityCount <= 2147483647;
 assert identityCount >= 1 && identityCount <= 64;
-pkgs.runCommand "quixos-restricted-identity-launcher" { nativeBuildInputs = [ pkgs.stdenv.cc ]; } ''
-  mkdir -p "$out/bin"
-  $CC -O2 -Wall -Wextra -Werror ${./identity-launcher.c} \
-    -DSANDBOX_EXECUTABLE='"${sandbox}/bin/quixos-restricted-sandbox"' \
-    -DAUTHORITY_USER='"${authorityUser}"' \
-    -DENGINE_DIRECTORY='"${engineDirectory}"' \
-    -DENGINE_FIRST_UID=${toString firstUid} \
-    -DENGINE_IDENTITY_COUNT=${toString identityCount} \
-    -o "$out/bin/quixos-restricted-engine"
-''
+pkgs.runCommand "quixos-restricted-identity-launcher"
+  {
+    nativeBuildInputs = [
+      pkgs.stdenv.cc
+      pkgs.nodejs_24
+    ];
+    QUIXOS_RESTRICTED_ENGINE_DIRECTORY = engineDirectory;
+  }
+  ''
+    # Validate the complete generated filename with the shared UTF-8 policy,
+    # before compiling or installing a launcher for this configured /run root.
+    node --input-type=module <<'JS'
+    import { checkedSocketPath } from '${../socket-address.mjs}';
+    for (const filename of ["broker.sock", "engine.sock"])
+      checkedSocketPath(process.env.QUIXOS_RESTRICTED_ENGINE_DIRECTORY + "/qx-engine-XXXXXX/" + filename);
+    JS
+    mkdir -p "$out/bin"
+    $CC -O2 -Wall -Wextra -Werror ${./identity-launcher.c} \
+      -DSANDBOX_EXECUTABLE='"${sandbox}/bin/quixos-restricted-sandbox"' \
+      -DAUTHORITY_USER='"${authorityUser}"' \
+      -DENGINE_DIRECTORY='"${engineDirectory}"' \
+      -DENGINE_FIRST_UID=${toString firstUid} \
+      -DENGINE_IDENTITY_COUNT=${toString identityCount} \
+      -o "$out/bin/quixos-restricted-engine"
+  ''