sandbox

Documentation

Index

• func RunSandboxedChild(args []string) error
• type Profile
• type Sandbox
  • func Detect() Sandbox

Functions

func RunSandboxedChild

func RunSandboxedChild(args []string) error

RunSandboxedChild applies the profile from DSC_SANDBOX_PROFILE_JSON and replaces this process with the command after "--".

Types

type Profile

type Profile struct {
	AllowReadPaths  []string
	AllowWritePaths []string
	AllowNetwork    bool
	AllowExecPaths  []string
}

Profile describes the filesystem and network access a sandboxed command should receive. AllowExecPaths is used by Landlock; other implementations may ignore it.

type Sandbox

type Sandbox interface {
	Name() string
	Available() bool
	Wrap(ctx context.Context, profile Profile, cmd *exec.Cmd) error
	WasDenied(stderr string) bool
}

Sandbox wraps commands with an OS-native sandbox implementation.

func Detect

func Detect() Sandbox

Detect returns the default sandbox for the current OS.