Qualify hosted development and compose service ownership

2026-10-11 13:53:36 -07:00
parent 6e591d5588
commit f67294f26d
4 changed files with 65 additions and 22 deletions
@@ -0,0 +1,28 @@
+# Trusted host construction only. Authored Workers cannot choose the caller,
+# reserved identities, engine directory or sandbox executable.
+{
+  pkgs,
+  sandbox,
+  authorityUser ? "quixos-graph",
+  engineDirectory ? "/run/quixos-restricted-engines",
+  firstUid ? 610000,
+  identityCount ? 64,
+}:
+assert builtins.match "[a-z][a-z0-9_-]{0,63}" authorityUser != null;
+assert builtins.match "/run/[a-zA-Z0-9_/-]+" engineDirectory != null;
+assert !(pkgs.lib.hasInfix ".." engineDirectory);
+assert !(pkgs.lib.hasSuffix "/" engineDirectory);
+assert builtins.stringLength engineDirectory < 80;
+assert builtins.isInt firstUid && builtins.isInt identityCount;
+assert firstUid >= 610000 && firstUid + identityCount <= 2147483647;
+assert identityCount >= 1 && identityCount <= 64;
+pkgs.runCommand "quixos-restricted-identity-launcher" { nativeBuildInputs = [ pkgs.stdenv.cc ]; } ''
+  mkdir -p "$out/bin"
+  $CC -O2 -Wall -Wextra -Werror ${./identity-launcher.c} \
+    -DSANDBOX_EXECUTABLE='"${sandbox}/bin/quixos-restricted-sandbox"' \
+    -DAUTHORITY_USER='"${authorityUser}"' \
+    -DENGINE_DIRECTORY='"${engineDirectory}"' \
+    -DENGINE_FIRST_UID=${toString firstUid} \
+    -DENGINE_IDENTITY_COUNT=${toString identityCount} \
+    -o "$out/bin/quixos-restricted-engine"
+''