Module guest_stub 

The supervisor’s side of the guest-stub restricted mode.

Where neither ptrace nor a user namespace lets the supervisor reach a guest’s memory (see access), a stub inside every guest process moves the memory each served syscall uses into a mailbox both sides map. The stub is part of the exec shim (exec/shim/src/stub.rs), which loads every program in place instead of exec’ing it so the stub stays armed; layout is the contract between the two, compiled into both.

Here the mailbox is created and mapped into the supervisor, where tracee::mem serves guest addresses inside it and refuses every other, so the handlers in syscall::notify and syscall::direct read and write the staged copies as if they were the guest’s memory. The first tracee maps the gate page and execs the shim through the allow gate, the one exec the filter lets through without the stub.

Modules

layout

What the supervisor and the guest stub agree on in the guest-stub restricted mode: fixed addresses, the mailbox format, and which memory each trapped syscall reads or writes, for the x86_64 and i386 ABIs of an x86_64 host and the aarch64 and 32-bit ARM ABIs of an aarch64 host.

Structs

Mailbox

The mailbox memfd. The supervisor’s mapping lives as long as the process.

Functions

exec_through_gate 🔒 ^⚠

execve through the allow gate. Allocation free.

exec_trampoline^⚠

Execs the trampoline in the first tracee, through the allow gate, with the mailbox descriptor it inherited kept open for it. Allocation free, for use between fork and execve.

map_gates 🔒

Maps the gate page in the calling process. Allocation free, for the first tracee between fork and its exec of the shim.