sandlock-oci: shorten supervisor socket path to fit sun_path under CRI

Signed-off-by: Cong Wang <cwang@multikernel.io>

Author: congwang-mk

crates/sandlock-oci/src/lib.rs

@@ -18,4 +18,4 @@ pub mod supervisor;
 
 pub use policy::OciPolicy;
 pub use state::{SandboxState, ExitInfo, Status};
-pub use supervisor::{SupervisorCmd, SupervisorReply, SUPERVISOR_SOCKET};
+pub use supervisor::{SupervisorCmd, SupervisorReply};

crates/sandlock-oci/src/supervisor.rs

@@ -161,9 +161,6 @@ fn exit_info_from_resp(resp: Option<Resp>) -> Option<crate::state::ExitInfo> {
     }
 }
 
-/// Filename of the supervisor control socket inside the sandbox state dir.
-pub const SUPERVISOR_SOCKET: &str = "supervisor.sock";
-
 /// Commands the CLI sends to the Supervisor over the Unix socket.
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 #[serde(tag = "cmd", rename_all = "lowercase")]
@@ -204,11 +201,29 @@ pub enum SupervisorReply {
     Exit { code: Option<i32>, signal: Option<i32> },
 }
 
+/// Deterministic 64-bit FNV-1a hash of `id` as 16 lowercase hex chars.
+///
+/// Keeps the supervisor socket path short enough for `sockaddr_un.sun_path`
+/// (108 bytes incl. NUL) even when the runtime root and container id are long
+/// (containerd passes a 64-char id under /run/containerd/runc/<ns>). Only needs
+/// to be stable within a single binary: bind and connect run the same build.
+fn fnv1a_hex(id: &str) -> String {
+    const OFFSET: u64 = 0xcbf29ce484222325;
+    const PRIME: u64 = 0x0000_0100_0000_01b3;
+    let mut h = OFFSET;
+    for b in id.as_bytes() {
+        h ^= *b as u64;
+        h = h.wrapping_mul(PRIME);
+    }
+    format!("{:016x}", h)
+}
+
 /// Returns the path to the supervisor socket for the given sandbox ID.
+///
+/// Lives directly under the state dir as `<fnv16(id)>.sock` (not under the
+/// per-id state subdir) so the path stays well under the `sun_path` limit.
 pub fn socket_path(id: &str) -> PathBuf {
-    PathBuf::from(crate::state::state_dir())
-        .join(id)
-        .join(SUPERVISOR_SOCKET)
+    PathBuf::from(crate::state::state_dir()).join(format!("{}.sock", fnv1a_hex(id)))
 }
 
 /// Send a command to a running supervisor and return its reply (blocking).
@@ -315,6 +330,13 @@ async fn supervisor_main(
         }
     };
 
+    // Restrict connects to the owner (root, same as the runtime). Best-effort:
+    // the path-length fix is what matters; a chmod failure must not abort create.
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let _ = std::fs::set_permissions(&sock_path, std::fs::Permissions::from_mode(0o700));
+    }
+
     // Set up the control channel. The child end is mapped onto CONTROL_FD inside
     // the confined process; the daemon keeps the other end to drive
     // RunMain/RunExec/Shutdown.
@@ -976,6 +998,13 @@ async fn supervisor_restore_main(
         }
     };
 
+    // Restrict connects to the owner (root, same as the runtime). Best-effort:
+    // the path-length fix is what matters; a chmod failure must not abort restore.
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let _ = std::fs::set_permissions(&sock_path, std::fs::Permissions::from_mode(0o700));
+    }
+
     // Restore: forks the child under the saved policy, injects the checkpoint,
     // and RESUMES it. The child is already running on return — there is no
     // separate start step.
@@ -1026,10 +1055,31 @@ mod tests {
     use super::*;
 
     #[test]
-    fn socket_path_is_under_state_dir() {
+    fn socket_path_uses_short_hashed_name_under_state_dir() {
         let p = socket_path("my-sandbox");
-        assert!(p.to_str().unwrap().contains("my-sandbox"));
-        assert!(p.to_str().unwrap().contains("supervisor.sock"));
+        let s = p.to_str().unwrap();
+        assert!(s.starts_with(&crate::state::state_dir()));
+        assert!(s.ends_with(".sock"));
+        // file name is 16 hex chars + ".sock" = 21 bytes, never the raw id.
+        assert_eq!(p.file_name().unwrap().to_str().unwrap().len(), 21);
+        assert!(!s.contains("my-sandbox"));
+    }
+
+    #[test]
+    fn socket_filename_keeps_path_under_sun_len_for_cri_root() {
+        // containerd's runc-v2 shim passes this root plus a 64-char id.
+        let cri_root = "/run/containerd/runc/k8s.io";
+        let id = "a".repeat(64);
+        let full = format!("{}/{}.sock", cri_root, fnv1a_hex(&id));
+        assert!(full.len() < 108, "socket path too long: {} bytes", full.len());
+    }
+
+    #[test]
+    fn fnv1a_hex_is_deterministic_and_distinct() {
+        assert_eq!(fnv1a_hex("abc"), fnv1a_hex("abc"));
+        assert_ne!(fnv1a_hex("abc"), fnv1a_hex("abd"));
+        assert_eq!(fnv1a_hex("abc").len(), 16);
+        assert!(fnv1a_hex("abc").chars().all(|c| c.is_ascii_hexdigit()));
     }
 
     #[test]