Microsoft LiteBoxを動かしてみる

┌─────────────────────────────────────┐
│  従来のOS                            │
│                                     │
│  ┌───────────┐  ┌───────────┐       │
│  │  App A    │  │  App B    │       │
│  └─────┬─────┘  └─────┬─────┘       │
│        │ syscall      │ syscall     │
│  ══════╪══════════════╪═══════════  │
│  ┌─────┴──────────────┴─────┐       │
│  │       kernel             │       │
│  │  VFS, Net, Sched, MM ... │       │
│  └──────────────────────────┘       │
└─────────────────────────────────────┘

┌─────────────────────────────────────┐
│  Libraly OS                         │
│                                     │
│  ┌──────────────┐ ┌──────────────┐  │
│  │   App A      │ │   App B      │  │
│  │ ┌──────────┐ │ │ ┌──────────┐ │  │
│  │ │LibOS     │ │ │ │LibOS     │ │  │
│  │ │FS,Net,.. │ │ │ │FS,Net,.. │ │  │
│  │ └──────────┘ │ │ └──────────┘ │  │
│  └──────┬───────┘ └──────┬───────┘  │
│  ═══════╪════════════════╪════════  │
│  ┌──────┴────────────────┴──────┐   │
│  │  micro kernel/VMM            │   │
│  │  (H/W抽象化のみ)               │   │
│  └──────────────────────────────┘   │
└─────────────────────────────────────┘

#現在、以下の2種類のShimが存在

- litebox_shim_linux — Linuxシステムコール変換
- litebox_shim_optee — OP-TEEトラステッドアプリケーション呼び出し変換

error[E0425]: cannot find function `write_u8_fallible`
note: found an item that was configured out
   --> litebox/src/mm/exception_table.rs:191:15
190 | #[cfg(target_arch = "x86")]
    |       ------------------- the item is gated behind the `x86` feature

% sudo dnf groupinstall -y "Development Tools"
% sudo dnf install -y git clang clang-devel glibc-static

% curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
% source ~/.cargo/env

# 確認
$ rustc --version
rustc 1.93.0 (254b59607 2026-01-19)  

% git clone https://github.com/microsoft/litebox.git
% cd litebox
% cargo build --release

・
・
・

Finished `release` profile [optimized] target(s) in xxxxxx

% ls target/release/litebox_runner*

target/release/litebox_runner_linux_on_windows_userland
target/release/litebox_runner_linux_userland

% sudo ./litebox_platform_linux_userland/scripts/tun-setup.sh

[i] Script parameters:
      TUN device: tun99
      TUN IPs: 10.0.0.1/24
[i] Creating TUN device
[i] Assigning IP addresses
[i] Bringing up TUN device
[+] Created TUN device

% cargo test --package litebox --lib

# 結果
test result: ok. 90 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out

# テスト用に追加パッケージのインストール
% sudo dnf install -y nodejs iperf3

# テスト実行
% cargo test --package litebox_runner_linux_userland

# 結果
test result: FAILED. 6 passed; 1 failed; 2 ignored; 0 measured; 0 filtered out

# エラー
% ./target/release/litebox_runner_linux_userland /bin/echo "Hello"

# 1. プログラムのsyscallを書き換え
% litebox_syscall_rewriter input_binary output_binary.hooked

# 2. 依存ライブラリを含むtarファイルを作成
% tar -cvf rootfs.tar lib64/ lib/ lib32/ out/

# 3. LiteBox経由で実行
% ./target/release/litebox_runner_linux_userland \
  --unstable \
  --interception-backend rewriter \
  --env "LD_LIBRARY_PATH=/lib64:/lib32:/lib" \
  --env "HOME=/" \
  --initial-files ./rootfs.tar \
  ./program.hooked arg1 arg2

[外部PC/ブラウザ]
    ↓ HTTP GET http://<EC2 Public IP>:3000/
[EC2 ens5: Public IP]
    ↓ iptables DNAT (3000 → 10.0.0.2:3000)
[TUN tun99: 10.0.0.1/24]
    ↓ TUN device (仮想ネットワーク)
[LiteBox Sandbox: 10.0.0.2:3000]
    ↓
[Node.js HTTP Server (sandboxed)]
    ↓ Response
[外部PC] ← "Hello from LiteBox!"

// /tmp/litebox_web/out/server.js
const http = require('http');
const server = http.createServer((req, res) => {
  console.log(`[${new Date().toISOString()}] ${req.method} ${req.url}`);
  res.writeHead(200, {'Content-Type': 'text/html'});
  res.end('<h1>Hello from LiteBox!</h1><p>This Node.js server is running inside a sandboxed environment.</p>');
});
server.listen(3000, '10.0.0.2', () => {
  console.log('Server running at http://10.0.0.2:3000/');
});

# テストで生成されたNode.js環境を再利用
% cd ~/litebox
% WORK_DIR=/tmp/litebox_webserver
% mkdir -p $WORK_DIR
% cd $WORK_DIR

# 既存のNode.js tarを展開
% tar -xf ~/litebox/target/debug/build/litebox_runner_linux_userland-*/out/rootfs_hello_node_rewriter.tar

# server.jsを追加
% cp /path/to/server.js out/

# 新しいtarを作成
% tar --format=ustar -cvf /tmp/webserver.tar lib64 lib lib32 out

# IP転送を有効化
% sudo sysctl -w net.ipv4.ip_forward=1

# iptablesインストール（Amazon Linux 2023）
% sudo dnf install -y iptables-nft

# NAT設定
% sudo iptables -t nat -A PREROUTING -p tcp --dport 3000 -j DNAT --to-destination 10.0.0.2:3000
% sudo iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -j MASQUERADE
% sudo iptables -A FORWARD -i ens5 -o tun99 -p tcp --dport 3000 -j ACCEPT
% sudo iptables -A FORWARD -i tun99 -o ens5 -m state --state RELATED,ESTABLISHED -j ACCEPT

% cd ~/litebox

% ./target/debug/litebox_runner_linux_userland \
  --unstable \
  --interception-backend rewriter \
  --env "LD_LIBRARY_PATH=/lib64:/lib32:/lib" \
  --env "HOME=/" \
  --tun-device-name tun99 \
  --initial-files /tmp/webserver.tar \
  ./target/debug/build/litebox_runner_linux_userland-*/out/node.hooked \
  /out/server.js

# EC2内部から
% curl http://10.0.0.2:3000/
<h1>Hello from LiteBox!</h1><p>This Node.js server is running inside a sandboxed environment.</p>

# 外部から(ブラウザからも可能)
% curl http://<EC2 Public IP>:3000/
<h1>Hello from LiteBox!</h1><p>This Node.js server is running inside a sandboxed environment.</p>

// epoll.rs:184 - 現在のコード
EpollOp::EpollCtlMod => {
    log_unsupported!("epoll_ctl mod");
    Err(Errno::EINVAL)  // エラーを返す
}

// epoll.rs:233 - 実装は存在するが無効化中
#[expect(dead_code, reason = "currently unused, but might want to use soon")]
fn mod_interest(...) { ... }