feat(cfg): Hyper.Cfg.Jails facade (cgroup, uid_gid_range)

Author: markovejnovic

lib/hyper/cfg/jails.ex

@@ -0,0 +1,28 @@
+defmodule Hyper.Cfg.Jails do
+  @moduledoc """
+  VM confinement settings from the `[jails]` table — `config.toml`-only because
+  the setuid helper enforces the same `uid_gid_range` it reads from this file.
+  """
+
+  import Hyper.Cfg, only: [get_cfg: 1]
+
+  @default_range {900_000, 999_999}
+
+  @doc "Parent cgroup for every VM cgroup. `[jails] cgroup`, default `\"hyper\"`."
+  @spec cgroup :: String.t()
+  def cgroup, do: get_cfg(toml: "jails.cgroup", default: "hyper")
+
+  @doc "UID/GID allocation band each VM jail draws from. `[jails] uid_gid_range`."
+  @spec uid_gid_range :: {integer(), integer()}
+  def uid_gid_range do
+    case Hyper.Cfg.Toml.fetch("jails.uid_gid_range") do
+      {:ok, v} -> range_from(v)
+      :error -> @default_range
+    end
+  end
+
+  @doc false
+  @spec range_from(term()) :: {integer(), integer()}
+  def range_from([min, max]) when is_integer(min) and is_integer(max), do: {min, max}
+  def range_from(_), do: @default_range
+end

lib/hyper/node/fire_vmm/jailer.ex

@@ -36,8 +36,6 @@ defmodule Hyper.Node.FireVMM.Jailer do
     first failure.
     """
 
-    alias Hyper.Config
-
     @doc "Run every pre-requisite check, halting at the first failure."
     @spec run() :: :ok | {:error, term()}
     def run do
@@ -63,7 +61,7 @@ defmodule Hyper.Node.FireVMM.Jailer do
     end
 
     defp parent_cgroup_present do
-      if Sys.Linux.Cgroup.V2.named_exists?(Config.parent_cgroup()),
+      if Sys.Linux.Cgroup.V2.named_exists?(Hyper.Cfg.Jails.cgroup()),
         do: :ok,
         else: {:error, :missing_parent_cgroup}
     end
@@ -108,7 +106,7 @@ defmodule Hyper.Node.FireVMM.Jailer do
         "--cgroup-version",
         "2",
         "--parent-cgroup",
-        Hyper.Config.parent_cgroup()
+        Hyper.Cfg.Jails.cgroup()
       ] ++
         cgroup_flags(opts.type) ++
         ["--", "--api-sock", "/" <> @jail_socket]
@@ -145,7 +143,7 @@ defmodule Hyper.Node.FireVMM.Jailer do
   """
   @spec cgroup_dir(Hyper.Vm.id()) :: Path.t()
   def cgroup_dir(id) do
-    Path.join(["/sys/fs/cgroup", Hyper.Config.parent_cgroup(), exec_name(), id])
+    Path.join(["/sys/fs/cgroup", Hyper.Cfg.Jails.cgroup(), exec_name(), id])
   end
 
   @doc """

lib/hyper/node/users.ex

@@ -77,7 +77,7 @@ defmodule Hyper.Node.Users do
   def test_system do
     alias Sys.Linux.Subid
 
-    {min, max} = Hyper.Config.uid_gid_range()
+    {min, max} = Hyper.Cfg.Jails.uid_gid_range()
 
     cond do
       passwd_conflicts(min, max) != [] ->
@@ -99,7 +99,7 @@ defmodule Hyper.Node.Users do
 
   @impl true
   def init(_opts) do
-    {min, max} = Hyper.Config.uid_gid_range()
+    {min, max} = Hyper.Cfg.Jails.uid_gid_range()
     {:ok, %State{max: max, next: min}}
   end
 

test/hyper/cfg/jails_test.exs

@@ -0,0 +1,29 @@
+defmodule Hyper.Cfg.JailsTest do
+  use ExUnit.Case, async: false
+
+  alias Hyper.Cfg.Jails
+  alias Hyper.Cfg.Toml
+
+  setup do
+    Toml.put_cache(%{})
+    on_exit(fn -> Toml.reload() end)
+    :ok
+  end
+
+  test "defaults match the helper's compiled-in defaults" do
+    assert Jails.cgroup() == "hyper"
+    assert Jails.uid_gid_range() == {900_000, 999_999}
+  end
+
+  test "reads the [jails] table when present" do
+    Toml.put_cache(%{"jails" => %{"cgroup" => "fleet", "uid_gid_range" => [800_000, 899_999]}})
+    assert Jails.cgroup() == "fleet"
+    assert Jails.uid_gid_range() == {800_000, 899_999}
+  end
+
+  test "uid_gid_range parses a TOML [min, max] array into a tuple" do
+    assert Jails.range_from([800_000, 899_999]) == {800_000, 899_999}
+    assert Jails.range_from(nil) == {900_000, 999_999}
+    assert Jails.range_from("garbage") == {900_000, 999_999}
+  end
+end