Syscall tier: network "loopback" allows IPv4 and IPv6 sockets cc462b56fbbb

## Unreleased

- **Runner builds in releases (oxygenhub#322):** a `dist` job (`scripts/dist.sh`, on a change to `Cargo.toml` or the script) builds `flow` stripped for Linux x86_64, aarch64 and riscv64 (glibc 2.28 and later) as `flow-linux-ARCH`, named by the architecture a runner reports, with `SHA256SUMS`: the files a release carries for runners that update themselves.

- **Runners ask the hub for their update (oxygenhub#322):** once the hub has answered a claim, and every 15 minutes, a runner asks `GET /api/v1/flow/runner/update`; when the hub offers a build, it downloads it (kept in the home's `updates/`), refuses it unless its size and BLAKE3 are those the hub attests, and installs it as `flow runner update` does, leaving within 600 s, or for a dry run checks it and says what would happen. What it did goes back to the hub once per outcome, and a proof or a rollback is told at the next start. `[runner.update] allow = false` refuses and says so; a hub without runner updates (404) is simply asked again later.

- **The runner update protocol's types (oxygenhub#322):** `UpdateAnswer`, `UpdatePolicy`, `UpdateOffer` and `UpdateReport` in flow-core, for `GET`/`POST /api/v1/flow/runner/update`: the policy that applies to a runner once every level is applied, and the release asset it should run.

//! network, IPC and UTS namespaces, on the rootfs image's tree (unpacked

//! once per hash, read-only) with the workspace directory at `/src` and a

//! tmpfs at `/tmp`. Landlock limits writes to `/src`, `/tmp` and `/dev`; a

//! reach past the sandbox (`ptrace`, `mount`, `bpf`, `perf_event_open`,

//! keys, modules, io_uring); and the sandbox's CPU and memory limits apply

//! through a cgroup v2 group of the runner's own delegated cgroup. Without

            return Err("Landlock is not enabled in this kernel (it must be in the lsm= list)".into());

        }

        no_new_privs()?;

    })();

    match r {

        Ok(()) => 0,

            }

            no_new_privs()?;

            landlock(&writable)?;

        })();

        unsafe {

            if let Err(e) = confined {

const BPF_K: u16 = 0x00;

const BPF_RET: u16 = 0x06;

/// Install a filter that fails each of `denied` with EPERM and `socket`

/// still checks sockets). Another architecture's calls kill the process.

    const LD: u16 = BPF_LD | BPF_W | BPF_ABS;

    const JEQ: u16 = BPF_JMP | BPF_JEQ | BPF_K;

    const RET: u16 = BPF_RET | BPF_K;

        f.push(op(JEQ, *nr as u32, 0, 1));

        f.push(op(RET, errno(libc::EPERM), 0, 0));

    }

    f.push(op(LD, 16, 0, 0));

    f.push(op(RET, errno(libc::EAFNOSUPPORT), 0, 0));

    f.push(op(RET, libc::SECCOMP_RET_ALLOW, 0, 0));

    let prog = libc::sock_fprog { len: f.len() as u16, filter: f.as_mut_ptr() };

const APPLETS: &[&str] = &[

    "sh", "echo", "cat", "id", "touch", "wget", "tail", "cut", "tr", "true", "false", "ls", "grep", "wc", "mount", "hostname", "head",

];

/// `flow`, in a delegated cgroup scope of its own when systemd's user

    rootfs "cas://blob/{rootfs}"

    memory-limit "256MiB"

}}

job "literal" {{

    sandbox "bb"

    exec "echo" "a; touch /src/pwned && $(id) | `id`"

    assert!(stdout.contains("   flow\n"), "its own host name: {all}");

    assert!(!stdout.contains("   MOUNTED\n") && stdout.contains("   done\n"), "no mounts: {all}");

    assert!(stderr.contains("Address family not supported"), "sockets other than AF_UNIX are refused: {all}");

    assert!(!work.join("w").exists(), "jobs write to their own copy: {all}");

    let procs: u32 = stdout.lines().find_map(|l| l.trim().strip_prefix("procs ")).and_then(|n| n.parse().ok()).expect(&all);

    assert!(procs < 10, "only the sandbox's processes are visible: {all}");

UTS namespaces (no interfaces but loopback), the rootfs image's tree

(unpacked once per hash, read-only) as `/`, the workspace directory at

`/src`, tmpfs at `/tmp`; Landlock limits writes to `/src` and `/tmp`; a

`ptrace`, `mount`, `bpf`, `perf_event_open`, `keyctl` and module calls;

`cpu-limit` and `memory-limit` apply through a cgroup v2 scope when the

runner has a delegated cgroup, and the job fails to start otherwise