Optionally back /tmp and /var/tmp with stable host directories

src/lib.rs

@@ -4,17 +4,20 @@ pub mod cli;
 pub mod config;
 mod env;
 mod errors;
+mod persistent_tmp;
 mod preflight;
 mod sandbox;
 mod seccomp;
+mod session_key;
 
 pub use errors::SandboxError;
 
 use std::ffi::OsString;
 use std::fs;
-use std::os::unix::process::CommandExt;
 use std::path::PathBuf;
 
+use crate::sandbox::Bwrap;
+
 pub enum SandboxMode {
     Blacklist,
     Whitelist,
@@ -57,6 +60,7 @@ pub struct SandboxConfig {
     pub command_args: Vec<OsString>,
     pub chdir: PathBuf,
     pub dry_run: bool,
+    pub persistent_tmp_key: Option<String>,
 }
 
 pub fn require_home() -> Result<String, SandboxError> {
@@ -87,19 +91,12 @@ fn resolve_run_user_from_proc() -> Option<String> {
 pub fn run(config: SandboxConfig) -> Result<(), SandboxError> {
     preflight::check(&config)?;
 
-    let mut cmd = sandbox::build_command(&config)?;
+    let bwrap = Bwrap::build(&config)?;
 
     if config.dry_run {
-        println!("{}", shell_quote_command(&cmd));
+        println!("{}", bwrap.shell_quoted());
         return Ok(());
     }
 
-    Err(SandboxError::Io(cmd.exec()))
-}
-
-fn shell_quote_command(cmd: &std::process::Command) -> String {
-    let prog = cmd.get_program().to_string_lossy();
-    let args = cmd.get_args().map(|a| a.to_string_lossy());
-    let all: Vec<_> = std::iter::once(prog).chain(args).collect();
-    shlex::try_join(all.iter().map(|s| s.as_ref())).unwrap()
+    Err(SandboxError::Io(bwrap.exec()))
 }