alice.pds.demo.boltless.dev
This repository has no description
1.5 kB
50 lines
1package sandbox
2
3import (
4 "fmt"
5 "os"
6 "os/exec"
7)
8
9// Backend wraps git subprocesses in a filesystem sandbox.
10type Backend interface {
11 Wrap(repoPath string, cmd *exec.Cmd) (*exec.Cmd, error)
12 WrapMulti(paths []string, cmd *exec.Cmd) (*exec.Cmd, error)
13 Name() string
14}
15
16// NoopBackend passes commands through unchanged.
17type NoopBackend struct{}
18
19func (n *NoopBackend) Wrap(repoPath string, cmd *exec.Cmd) (*exec.Cmd, error) {
20 cmd.Env = append(cmd.Env, fmt.Sprintf("HOME=%s", os.Getenv("HOME")))
21 cmd.Dir = repoPath
22 return cmd, nil
23}
24
25func (n *NoopBackend) WrapMulti(paths []string, cmd *exec.Cmd) (*exec.Cmd, error) {
26 if len(paths) > 0 {
27 cmd.Dir = paths[0]
28 }
29 return cmd, nil
30}
31
32func (n *NoopBackend) Name() string { return "noop" }
33
34// LookupUID resolves a repo path to its owner virtual UID. Used by the sandbox
35// to drop privileges before running git. Returning 0 (or any error) means
36// don't drop, i.e. the subprocess runs as the calling user.
37type LookupUID func(repoPath string) (uid uint32, gid uint32, err error)
38
39// New returns the best available sandboxing backend. If landlock is not
40// available, the warning string is non-empty and the backend falls back
41// to NoopBackend. lookup is optional; nil means subprocesses keep the
42// caller's UID/GID.
43func New(lookup LookupUID) (Backend, string) {
44 return platformNew(lookup)
45}
46
47// Probe returns a human-readable description of sandbox capability on this host.
48func Probe() string {
49 return platformProbe()
50}