54 lines
1.4 KiB
Rust
54 lines
1.4 KiB
Rust
use std::os::unix::fs::PermissionsExt;
|
|
use std::path::Path;
|
|
use std::process::Command;
|
|
|
|
use crate::SandboxConfig;
|
|
use crate::errors::SandboxError;
|
|
|
|
const PROC_CHILDREN: &str = "/proc/thread-self/children";
|
|
|
|
pub fn check(config: &SandboxConfig) -> Result<(), SandboxError> {
|
|
check_bwrap()?;
|
|
check_command(config)?;
|
|
check_chdir(config)?;
|
|
check_proc_children(Path::new(PROC_CHILDREN))?;
|
|
Ok(())
|
|
}
|
|
|
|
fn check_chdir(config: &SandboxConfig) -> Result<(), SandboxError> {
|
|
if !config.chdir.is_dir() {
|
|
return Err(SandboxError::ChdirMissing(config.chdir.clone()));
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
fn check_bwrap() -> Result<(), SandboxError> {
|
|
Command::new("bwrap")
|
|
.arg("--version")
|
|
.output()
|
|
.map_err(|_| SandboxError::BwrapNotFound)?;
|
|
Ok(())
|
|
}
|
|
|
|
fn check_command(config: &SandboxConfig) -> Result<(), SandboxError> {
|
|
if !config.command.is_file() {
|
|
return Err(SandboxError::CommandNotFound(config.command.clone()));
|
|
}
|
|
let metadata = std::fs::metadata(&config.command)?;
|
|
if metadata.permissions().mode() & 0o111 == 0 {
|
|
return Err(SandboxError::CommandNotExecutable(config.command.clone()));
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
fn check_proc_children(path: &Path) -> Result<(), SandboxError> {
|
|
if !path.exists() {
|
|
return Err(SandboxError::ProcChildrenMissing);
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
#[cfg(test)]
|
|
#[path = "../tests/unit/preflight.rs"]
|
|
mod tests;
|