mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-02 07:34:45 +08:00

Files

T

History

grs b52eed72e3 test(binary-identity): stabilize procfs identity fixtures (#3708 )

* test(binary-identity): stabilize procfs identity fixtures

Signed-off-by: Gordon Sim <gsim@redhat.com>

* test(binary-identity): wait for child fixture readiness

Signed-off-by: Gordon Sim <gsim@redhat.com>

---------

Signed-off-by: Gordon Sim <gsim@redhat.com>

2026-09-26 00:01:04 +00:00

src

test(binary-identity): stabilize procfs identity fixtures (#3708 )

2026-09-26 00:01:04 +00:00

Cargo.toml

feat(isolation): implement the RFC 0012 sandbox architecture (#2942 )

2026-09-16 00:49:14 +00:00

README.md

fix(identity): assess leaf and ancestor executable identities (#3633 )

2026-09-23 21:07:24 +00:00

README.md

Binary identity

openshell-binary-identity provides shared executable-identity resolution for RFC 0012 isolation backends. Runtime-specific observers remain in their backend: Docker obtains an authoritative thread ID from seccomp notification, while the co-located Linux path maps an accepted socket to its owning processes.

Given an authoritative Linux PID and an optional trusted process-tree root, the crate opens the leaf and bounded ancestor /proc/<pid>/exe objects, hashes those already-open live objects, and returns path-and-digest evidence for the whole executable chain. It also collects diagnostic command-line paths, which never authorize network access. Resolution fails without returning a partial identity if any executable cannot be opened, hashed, or validated after hashing. The caller receives ResolveError and denies the associated connection.

The crate does not intercept connections, authenticate remote observers, or evaluate policy. The isolation backend remains responsible for binding the resolved identity to the active boundary and exact accepted connection before constructing PendingTcpOpen.