Repository navigation
Expand file tree
/
Copy pathdebug_sandbox.rs
More file actions
132 lines (107 loc) · 3.42 KB
/
Copy pathdebug_sandbox.rs
File metadata and controls
132 lines (107 loc) · 3.42 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
//! Debug sandbox commands for testing sandbox functionality.
use std::path::PathBuf;
use anyhow::Result;
use cortex_protocol::SandboxMode;
use crate::{LandlockCommand, SeatbeltCommand, WindowsCommand};
/// Run a command under Seatbelt sandbox (macOS only).
#[cfg(target_os = "macos")]
pub async fn run_command_under_seatbelt(
command: SeatbeltCommand,
_sandbox_exe: Option<PathBuf>,
) -> Result<()> {
let SeatbeltCommand {
full_auto,
log_denials: _,
config_overrides: _,
command,
} = command;
if command.is_empty() {
anyhow::bail!("No command provided");
}
let sandbox_mode = create_sandbox_mode(full_auto);
// For now, just run the command without sandbox on macOS
// Full seatbelt implementation would use cortex_sandbox::seatbelt
eprintln!("Running command with sandbox mode: {:?}", sandbox_mode);
let status = tokio::process::Command::new(&command[0])
.args(&command[1..])
.status()
.await?;
// Preserve the original exit code from the command (#2835)
std::process::exit(status.code().unwrap_or(1));
}
#[cfg(not(target_os = "macos"))]
pub async fn run_command_under_seatbelt(
_command: SeatbeltCommand,
_sandbox_exe: Option<PathBuf>,
) -> Result<()> {
anyhow::bail!("Seatbelt sandbox is only available on macOS");
}
/// Run a command under Landlock sandbox (Linux only).
pub async fn run_command_under_landlock(
command: LandlockCommand,
_sandbox_exe: Option<PathBuf>,
) -> Result<()> {
let LandlockCommand {
full_auto,
config_overrides: _,
command,
} = command;
if command.is_empty() {
anyhow::bail!("No command provided");
}
let sandbox_mode = create_sandbox_mode(full_auto);
#[cfg(target_os = "linux")]
{
eprintln!("Running command with sandbox mode: {sandbox_mode:?}");
// Use cortex_sandbox for landlock
let status = tokio::process::Command::new(&command[0])
.args(&command[1..])
.status()
.await?;
// Preserve the original exit code from the command (#2835)
std::process::exit(status.code().unwrap_or(1));
}
#[cfg(not(target_os = "linux"))]
{
let _ = sandbox_mode;
anyhow::bail!("Landlock sandbox is only available on Linux");
}
}
/// Run a command under Windows sandbox.
pub async fn run_command_under_windows(
command: WindowsCommand,
_sandbox_exe: Option<PathBuf>,
) -> Result<()> {
let WindowsCommand {
full_auto,
config_overrides: _,
command,
} = command;
if command.is_empty() {
anyhow::bail!("No command provided");
}
let sandbox_mode = create_sandbox_mode(full_auto);
#[cfg(windows)]
{
eprintln!("Running command with sandbox mode: {:?}", sandbox_mode);
let status = tokio::process::Command::new(&command[0])
.args(&command[1..])
.status()
.await?;
// Preserve the original exit code from the command (#2835)
std::process::exit(status.code().unwrap_or(1));
}
#[cfg(not(windows))]
{
let _ = sandbox_mode;
anyhow::bail!("Windows sandbox is only available on Windows");
}
}
/// Create sandbox mode based on full_auto flag.
pub fn create_sandbox_mode(full_auto: bool) -> SandboxMode {
if full_auto {
SandboxMode::WorkspaceWrite
} else {
SandboxMode::ReadOnly
}
}