Add Linux NativeJail hard resource enforcement

.github/workflows/ci.yml

@@ -15,6 +15,27 @@ jobs:
       coverage-script: scripts/check-coverage.sh
       module-e2e-script: scripts/test-e2e.sh
       feature-test-script: scripts/test-features.sh
+      apt-packages: bubblewrap
+  native-resource-live:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          submodules: recursive
+      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249
+      - name: Install rootless native jail prerequisites
+        run: |
+          source scripts/ci/prepare-rootless-native-resources.sh
+      - name: Run required Linux native resource proofs
+        shell: bash
+        run: |
+          set -euo pipefail
+          uid="$(id -u)"
+          runtime_dir="/run/user/${uid}"
+          export XDG_RUNTIME_DIR="$runtime_dir"
+          export DBUS_SESSION_BUS_ADDRESS="unix:path=$runtime_dir/bus"
+          TINYBOX_REQUIRE_NATIVE_RESOURCE_TESTS=1 cargo test -j1 -p tinybox-module native_
+          TINYBOX_REQUIRE_NATIVE_RESOURCE_TESTS=1 cargo test -j1 -p tinybox-module resource_aware_bus_exec_cancellation_reports_events_and_reaps_descendants
   docker-network-live:
     name: Docker Egress and denied network connectivity
     runs-on: ubuntu-22.04

crates/tinybox-bus/src/jail.rs

@@ -38,6 +38,36 @@ pub struct NativeJailConfig {
     pub resources: Option<crate::ResourceLimits>,
 }
 
+/// Hard resource limits requested by the contract 2.1 native jail members.
+/// Each dimension is independently optional so a backend can enforce a real
+/// supported subset without weakening a requested limit. Disk is represented
+/// explicitly so implementations must refuse it when they cannot enforce it.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub struct NativeJailResourceRequest {
+    /// CPU budget in thousandths of one CPU (for example, 1 is 0.1%).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub cpu_millis: Option<u64>,
+    /// Maximum resident memory in bytes.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub memory_bytes: Option<u64>,
+    /// Maximum number of processes and threads.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub pids_max: Option<u64>,
+    /// Maximum writable disk bytes. Backends without a hard disk quota refuse.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub disk_bytes: Option<u64>,
+}
+
+/// Source-compatible extension of [`NativeJailConfig`] for contract 2.1.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct NativeJailRequest {
+    /// Existing filesystem, network and process jail configuration.
+    pub jail: NativeJailConfig,
+    /// Additional hard resource dimensions; any explicit unsupported one fails closed.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub resources: Option<NativeJailResourceRequest>,
+}
+
 #[cfg(test)]
 #[path = "jail_tests.rs"]
 mod tests;

crates/tinybox-bus/src/jail_tests.rs

@@ -66,3 +66,37 @@ fn native_resource_limits_are_optional_typed_and_round_trip() -> Result<(), serd
     assert_eq!(serde_json::to_value(config)?, request);
     Ok(())
 }
+
+#[test]
+fn native_jail_21_resource_subset_is_additive_and_keeps_disk_explicit()
+-> Result<(), serde_json::Error> {
+    let jail = NativeJailConfig {
+        read_only: vec![],
+        read_write: vec![],
+        allow_net: false,
+        allow_subprocess: true,
+        enforcement: JailEnforcement::Enforced,
+        require_process_isolation: true,
+        deny_read: vec![],
+        resources: None,
+    };
+    let request = NativeJailRequest {
+        jail: jail.clone(),
+        resources: Some(NativeJailResourceRequest {
+            cpu_millis: Some(1),
+            memory_bytes: Some(64 * 1024 * 1024),
+            pids_max: Some(16),
+            disk_bytes: Some(1024),
+        }),
+    };
+    let encoded = serde_json::to_value(&request)?;
+    let decoded: NativeJailRequest = serde_json::from_value(encoded.clone())?;
+    assert_eq!(decoded, request);
+    assert_eq!(decoded.jail, jail);
+    assert_eq!(
+        decoded.resources.and_then(|limits| limits.disk_bytes),
+        Some(1024)
+    );
+    assert_eq!(crate::NATIVE_JAIL_RESOURCES_VERSION, (2, 1));
+    Ok(())
+}

crates/tinybox-bus/src/lib.rs

@@ -19,7 +19,7 @@ mod grants;
 pub use grants::{LocalGrantConfig, LocalGrants, ProtectedPaths, ResolveLocalGrantsRequest};
 
 mod jail;
-pub use jail::{JailEnforcement, NativeJailConfig};
+pub use jail::{JailEnforcement, NativeJailConfig, NativeJailRequest, NativeJailResourceRequest};
 
 mod shell_execution;
 mod shell_selection;
@@ -82,7 +82,19 @@ pub use files::{
 /// 2.0 removes TinyBox-owned command policy classification and the
 /// `AnalyzeShell.hidden_execution` policy signal. Generic shell structure facts
 /// and transport helpers remain.
-pub const CONTRACT_VERSION: (u32, u32) = (2, 0);
+/// 2.1 adds separate resource-aware native jail request members without
+/// changing the 2.0 Rust request shapes.
+pub const CONTRACT_VERSION: (u32, u32) = (2, 1);
+
+/// Minimum contract version required for resource-aware native jail members.
+pub const NATIVE_JAIL_RESOURCES_VERSION: (u32, u32) = (2, 1);
+
+/// Whether a module explicitly advertises support for the resource-aware
+/// native jail members. Hosts must check this before sending a 2.1 request.
+#[must_use]
+pub fn supports_native_jail_resources(module: (u32, u32)) -> bool {
+    module.0 == NATIVE_JAIL_RESOURCES_VERSION.0 && module.1 >= NATIVE_JAIL_RESOURCES_VERSION.1
+}
 
 /// Whether this host vocabulary can bind to a module's advertised version.
 /// The major must match and the module's minor must include every host member.
@@ -207,6 +219,8 @@ pub mod names {
     pub const KILL_STDIO: &str = "KillStdio";
     /// Wire name of the `StdioStatus` member.
     pub const STDIO_STATUS: &str = "StdioStatus";
+    /// Wire name of the 2.1 resource-aware jailed exec member.
+    pub const START_JAILED_EXEC_WITH_RESOURCES: &str = "StartJailedExecWithResources";
 }
 
 /// Supported methods in this contract, including the original discovery
@@ -253,6 +267,7 @@ pub const METHODS: &[&str] = &[
     names::CLOSE_STDIN,
     names::KILL_STDIO,
     names::STDIO_STATUS,
+    names::START_JAILED_EXEC_WITH_RESOURCES,
 ];
 
 /// Facts about the detected native directory-jail backend.

crates/tinybox-bus/src/lib_tests.rs

@@ -51,7 +51,7 @@ fn docker_run_vocabulary_is_typed_bounded_and_additive() -> Result<(), serde_jso
     assert_eq!(METHODS[28], "CleanupDocker");
     assert_eq!(METHODS[29], "RunDockerWithoutWorkspace");
     assert_eq!(METHODS[33], "StartNativeShellExec");
-    assert_eq!(CONTRACT_VERSION, (2, 0));
+    assert_eq!(CONTRACT_VERSION, (2, 1));
     assert_eq!(MAX_DOCKER_RUN_TIMEOUT_MS, 86_400_000);
     let serialized = serde_json::to_value(&request)?;
     assert_eq!(serialized["read_only_rootfs"], false);
@@ -129,7 +129,7 @@ fn host_gateway_and_docker_facts_are_additive_and_default_safely() -> Result<(),
 #[test]
 fn version_and_capability_wire_snapshot_preserve_contract_compatibility()
 -> Result<(), serde_json::Error> {
-    assert_eq!(CONTRACT_VERSION, (2, 0));
+    assert_eq!(CONTRACT_VERSION, (2, 1));
     assert!(is_compatible(CONTRACT_VERSION));
     assert!(!is_compatible((1, 21)));
     assert!(!is_compatible((1, 8)));
@@ -143,14 +143,18 @@ fn version_and_capability_wire_snapshot_preserve_contract_compatibility()
     assert!(!is_compatible((0, 99)));
     assert!(!is_compatible((1, 22)));
     assert!(!is_compatible((3, 0)));
+    assert!(!is_compatible((2, 0)));
     assert!(is_compatible((2, 1)));
+    assert!(!supports_native_jail_resources((2, 0)));
+    assert!(supports_native_jail_resources((2, 1)));
+    assert!(supports_native_jail_resources((2, 2)));
     let capabilities = ModuleCapabilities {
         contract_version: CONTRACT_VERSION,
         create_backends: vec!["passthrough".into()],
         exec_backends: Vec::new(),
         spawn_backends: Vec::new(),
     };
-    let snapshot = serde_json::json!({"contract_version":[2,0],"create_backends":["passthrough"],"exec_backends":[],"spawn_backends":[]});
+    let snapshot = serde_json::json!({"contract_version":[2,1],"create_backends":["passthrough"],"exec_backends":[],"spawn_backends":[]});
     assert_eq!(serde_json::to_value(&capabilities)?, snapshot);
     assert_eq!(
         serde_json::from_value::<ModuleCapabilities>(snapshot)?,
@@ -169,7 +173,7 @@ fn no_workspace_docker_operation_is_present_in_the_contract() {
             .count(),
         1
     );
-    assert_eq!(CONTRACT_VERSION, (2, 0));
+    assert_eq!(CONTRACT_VERSION, (2, 1));
 }
 
 #[test]
@@ -182,7 +186,7 @@ fn shell_analysis_wire_shape_contains_only_structural_facts() -> Result<(), serd
 
 #[test]
 fn contract_two_drops_command_classification_but_keeps_structural_shell_analysis() {
-    assert_eq!(CONTRACT_VERSION, (2, 0));
+    assert_eq!(CONTRACT_VERSION, (2, 1));
     assert!(!METHODS.contains(&"AnalyzeCommand"));
     assert!(METHODS.contains(&"AnalyzeShell"));
 }
@@ -358,6 +362,7 @@ fn named_members_resolve_to_the_method_catalogue_in_order() {
         CLOSE_STDIN,
         KILL_STDIO,
         STDIO_STATUS,
+        START_JAILED_EXEC_WITH_RESOURCES,
     ];
     assert_eq!(METHODS, &expected[..]);
     assert_eq!(DESCRIBE, "Describe");

crates/tinybox-jail/src/bwrap/args.rs

@@ -318,9 +318,10 @@ fn deny_masks(denied: &[PathBuf], mounts: &[Mount]) -> io::Result<Vec<OsString>>
                 os("/dev/null"),
                 deny.clone().into_os_string(),
             ]),
-            // Bubblewrap creates a missing --tmpfs destination on the host
-            // before mounting over it. Refuse instead of mutating a granted
-            // directory or preventing a future file from being created there.
+            // Bubblewrap's `--tmpfs` creates a missing destination on the host
+            // before mounting it. Refuse prospective denials rather than
+            // mutating a granted host directory or preventing that path from
+            // later being created as a file.
             Err(error) if error.kind() == io::ErrorKind::NotFound => {
                 return Err(io::Error::new(
                     io::ErrorKind::NotFound,

crates/tinybox-jail/src/bwrap/args_tests.rs

@@ -240,10 +240,7 @@ fn deny_read_of_a_missing_path_is_refused() -> io::Result<()> {
     let root = tempfile::tempdir()?;
     let mut j = jail(root.path());
     j.deny_read = vec![root.path().join("later")];
-    assert_eq!(
-        jail_args(&j, None, OPTS).err().map(|error| error.kind()),
-        Some(io::ErrorKind::NotFound)
-    );
+    assert_eq!(build(&j).unwrap_err().kind(), io::ErrorKind::NotFound);
     Ok(())
 }
 
@@ -254,10 +251,7 @@ fn missing_denial_inside_a_read_only_grant_is_refused() -> io::Result<()> {
     let denied = grant.path().join("later");
     let mut j = jail(root.path()).add_read_only(grant.path());
     j.deny_read = vec![denied.clone()];
-    assert_eq!(
-        jail_args(&j, None, OPTS).err().map(|error| error.kind()),
-        Some(io::ErrorKind::NotFound)
-    );
+    assert_eq!(build(&j).unwrap_err().kind(), io::ErrorKind::NotFound);
     Ok(())
 }
 

crates/tinybox-linux/src/lib.rs

@@ -45,4 +45,7 @@ mod sandbox;
 
 pub use probe::{NamespaceProbe, UsernsStatus};
 
-pub use sandbox::{NAME, NamespaceSandbox, WORKSPACE_MOUNT};
+pub use sandbox::{
+    NAME, NamespaceSandbox, NativeJailCommand, WORKSPACE_MOUNT, native_jail_argv,
+    native_jail_argv_with_programs, trusted_systemd_run_program,
+};