Nick Sweeting aa8f132f00 Support secure host block-device attachment on macOS VZ ...

Attach explicitly allowed host disks through a dedicated root-owned helper,
passing validated file descriptors to unprivileged VZ over an authenticated
Unix socket. Scope sudoers grants to the invoking user and exact device paths,
reject unsafe helper paths and socket symlinks, authenticate both peers, and
validate the received device identity.

Retain descriptors per VM while preserving process-lifetime network wrappers
used by krunkit. Lock whole host disks across instances sharing LIMA_HOME,
including raw/block aliases and partitions. Reject duplicate configuration
entries and external VZ drivers at runtime.

Compose network and block-device sudoers fragments through pkg/sudoers, match
complete generated lines, and warn when regeneration removes existing grants.
Keep integration-test grants in temporary fragments and revoke them before
detaching the test RAM disk. Add security, lifecycle, and real-disk regression
coverage and document installation requirements and remaining grant limits.

Signed-off-by: Nick Sweeting <git@sweeting.me>

2026-09-23 10:08:04 -07:00

..

sudoers_test.go

Support secure host block-device attachment on macOS VZ

2026-09-23 10:08:04 -07:00

sudoers.go

Support secure host block-device attachment on macOS VZ

2026-09-23 10:08:04 -07:00