diff --git a/flake.nix b/flake.nix index e155139..18ebf0e 100644 --- a/flake.nix +++ b/flake.nix @@ -10,70 +10,55 @@ let systems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ]; foreachSystem = nixpkgs.lib.genAttrs systems; - - buildTools = pkgs: with pkgs; [ - pkg-config # hooks pc files into environment variable for futher usage - ]; - developmentTools = pkgs: with pkgs; [ - cargo-expand - ]; - libraries = pkgs: with pkgs; [ - libseccomp - ]; - - buildRustPlatform = pkgs: with fenix.packages."${pkgs.stdenv.system}"; let toolchain = combine [ complete.toolchain targets."x86_64-unknown-linux-musl".latest.rust-std ]; in pkgs.makeRustPlatform { - cargo = toolchain; - rustc = toolchain; - }; - - buildWithPackages = pkgs: pkgsStatic: features: (buildRustPlatform pkgsStatic).buildRustPackage rec { - pname = "x2t-sandbox"; - version = "1.0.0"; - - nativeBuildInputs = buildTools pkgs; - buildInputs = libraries pkgsStatic; - - buildFeatures = features; - - src = ./.; - - cargoLock = { - lockFile = ./Cargo.lock; - }; - - meta = with nixpkgs.lib; { - description = "seccomp sandbox with rules defined at build stage"; - homepage = "https://gitea.jianguoyun.net.cn/guochao/x2t-sandbox"; - license = licenses.unlicense; - maintainers = [ ]; - }; - }; in rec { packages = foreachSystem (system: let pkgs = import nixpkgs { inherit system; }; + rustPlatform = pkgs.makeRustPlatform { + cargo = fenix.packages."${pkgs.stdenv.system}".complete.toolchain; + rustc = fenix.packages."${pkgs.stdenv.system}".complete.toolchain; + }; + buildTools = with pkgs; [ pkg-config ]; + libraries = with pkgs; [ libseccomp ]; in rec { - x2t-sandbox-static = buildWithPackages pkgs pkgs.pkgsStatic []; - x2t-sandbox-static-tracing-mode = buildWithPackages pkgs pkgs.pkgsStatic ["tracing-mode"]; + x2t-sandbox = rustPlatform.buildRustPackage rec { + pname = "x2t-sandbox"; + version = "1.0.0"; - x2t-sandbox = buildWithPackages pkgs pkgs []; + nativeBuildInputs = buildTools; + buildInputs = libraries; - default = x2t-sandbox-static; + src = ./.; + + cargoLock = { + lockFile = ./Cargo.lock; + }; + + + meta = with nixpkgs.lib; { + description = "seccomp sandbox with rules defined at build stage"; + homepage = "https://gitea.jianguoyun.net.cn/guochao/x2t-sandbox"; + license = licenses.unlicense; + maintainers = [ ]; + }; + }; + + default = x2t-sandbox; }); devShells = foreachSystem (system: let pkgs = import nixpkgs { inherit system; }; + developmentTools = with pkgs; [ + cargo-expand + ]; in with pkgs; rec { default = packages."${system}".default.overrideAttrs (prevAttrs: { - nativeBuildInputs = prevAttrs.nativeBuildInputs ++ (with fenix.packages."${system}".combine; with fenix.packages."${system}"; with pkgs; [ - complete.rust-analyzer - complete.rust-src - ]) ++ (developmentTools pkgs); + nativeBuildInputs = prevAttrs.nativeBuildInputs ++ (with fenix.packages."${system}".complete; [ rust-analyzer rust-src ]) ++ developmentTools; }); }); }; -} +} \ No newline at end of file diff --git a/src/main.rs b/src/main.rs index 6f6eb57..fe00eb0 100644 --- a/src/main.rs +++ b/src/main.rs @@ -1,28 +1,36 @@ +#[cfg(feature = "tracing-mode")] use nix::{ - libc::{c_long, EPERM, ORIG_RAX}, - sys::stat::Mode, + libc::{c_long, ORIG_RAX}, unistd::{getpid, getppid, Pid}, }; -use std::io::Write; -use std::{ - ffi::{c_void, CString}, - mem::size_of, -}; +#[cfg(feature = "tracing-mode")] +use std::{ffi::c_void, io::Write, mem::size_of}; + +use nix::{libc::EPERM, sys::stat::Mode}; +use std::ffi::CString; use clap::*; use libseccomp::*; -#[derive(clap::Parser, Debug)] +#[cfg(not(feature = "tracing-mode"))] +#[derive(Parser, Debug)] struct Args { - #[cfg(feature = "tracing-mode")] - #[clap(short, long)] - log_failed_to: Option, - #[clap(required = true)] command: Vec, } + +#[cfg(feature = "tracing-mode")] +#[derive(Parser, Debug)] +struct Args { + #[clap(required = true)] + command: Vec, + + #[clap(short, long)] + log_failed_to: Option, +} + fn main() -> anyhow::Result<()> { env_logger::init(); @@ -33,7 +41,10 @@ fn main() -> anyhow::Result<()> { #[cfg(feature = "tracing-mode")] let tracing = args.log_failed_to != None; + #[cfg(feature = "tracing-mode")] let mut default_action = ScmpAction::Errno(EPERM); + #[cfg(not(feature = "tracing-mode"))] + let default_action = ScmpAction::Errno(EPERM); #[cfg(feature = "tracing-mode")] if let Some(log_fail_to) = args.log_failed_to {