public/seccomp-sandbox
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request 'WS-207807 # fix unused imports' (#1) from guochao/x2t-sandbox:master into master

Browse Source 
Reviewed-on: https://gitea.jianguoyun.net.cn/nutstore-onlyoffice/x2t-sandbox/pulls/1
Reviewed-by: huangqingming <huangqingming@noreply.localhost>
This commit is contained in:
huangqingming 2024-01-19 09:14:19 +08:00
commit a61b6721cd
2 changed files with 55 additions and 59 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
flake.nix
View File

@ -10,30 +10,25 @@
let
systems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
foreachSystem = nixpkgs.lib.genAttrs systems;
buildTools = pkgs: with pkgs; [
pkg-config # hooks pc files into environment variable for futher usage
];
developmentTools = pkgs: with pkgs; [
cargo-expand
];
libraries = pkgs: with pkgs; [
libseccomp
];
buildRustPlatform = pkgs: with fenix.packages."${pkgs.stdenv.system}"; let toolchain = combine [ complete.toolchain targets."x86_64-unknown-linux-musl".latest.rust-std ]; in pkgs.makeRustPlatform {
cargo = toolchain;
rustc = toolchain;
in
rec {
packages = foreachSystem (system:
let
pkgs = import nixpkgs { inherit system; };
rustPlatform = pkgs.makeRustPlatform {
cargo = fenix.packages."${pkgs.stdenv.system}".complete.toolchain;
rustc = fenix.packages."${pkgs.stdenv.system}".complete.toolchain;
};
buildWithPackages = pkgs: pkgsStatic: features: (buildRustPlatform pkgsStatic).buildRustPackage rec {
buildTools = with pkgs; [ pkg-config ];
libraries = with pkgs; [ libseccomp ];
in
rec {
x2t-sandbox = rustPlatform.buildRustPackage rec {
pname = "x2t-sandbox";
version = "1.0.0";
nativeBuildInputs = buildTools pkgs;
buildInputs = libraries pkgsStatic;
buildFeatures = features;
nativeBuildInputs = buildTools;
buildInputs = libraries;
src = ./.;
@ -41,6 +36,7 @@
lockFile = ./Cargo.lock;
};
meta = with nixpkgs.lib; {
description = "seccomp sandbox with rules defined at build stage";
homepage = "https://gitea.jianguoyun.net.cn/guochao/x2t-sandbox";
@ -48,31 +44,20 @@
maintainers = [ ];
};
};
in
rec {
packages = foreachSystem (system:
let
pkgs = import nixpkgs { inherit system; };
in
rec {
x2t-sandbox-static = buildWithPackages pkgs pkgs.pkgsStatic [];
x2t-sandbox-static-tracing-mode = buildWithPackages pkgs pkgs.pkgsStatic ["tracing-mode"];
x2t-sandbox = buildWithPackages pkgs pkgs [];
default = x2t-sandbox-static;
default = x2t-sandbox;
});
devShells = foreachSystem
(system:
let
pkgs = import nixpkgs { inherit system; };
developmentTools = with pkgs; [
cargo-expand
];
in
with pkgs; rec {
default = packages."${system}".default.overrideAttrs (prevAttrs: {
nativeBuildInputs = prevAttrs.nativeBuildInputs ++ (with fenix.packages."${system}".combine; with fenix.packages."${system}"; with pkgs; [
complete.rust-analyzer
complete.rust-src
]) ++ (developmentTools pkgs);
nativeBuildInputs = prevAttrs.nativeBuildInputs ++ (with fenix.packages."${system}".complete; [ rust-analyzer rust-src ]) ++ developmentTools;
});
});
};

35
src/main.rs
View File

@ -1,28 +1,36 @@
#[cfg(feature = "tracing-mode")]
use nix::{
libc::{c_long, EPERM, ORIG_RAX},
sys::stat::Mode,
libc::{c_long, ORIG_RAX},
unistd::{getpid, getppid, Pid},
};
use std::io::Write;
use std::{
ffi::{c_void, CString},
mem::size_of,
};
#[cfg(feature = "tracing-mode")]
use std::{ffi::c_void, io::Write, mem::size_of};
use nix::{libc::EPERM, sys::stat::Mode};
use std::ffi::CString;
use clap::*;
use libseccomp::*;
#[derive(clap::Parser, Debug)]
#[cfg(not(feature = "tracing-mode"))]
#[derive(Parser, Debug)]
struct Args {
#[cfg(feature = "tracing-mode")]
#[clap(short, long)]
log_failed_to: Option<String>,
#[clap(required = true)]
command: Vec<String>,
}
#[cfg(feature = "tracing-mode")]
#[derive(Parser, Debug)]
struct Args {
#[clap(required = true)]
command: Vec<String>,
#[clap(short, long)]
log_failed_to: Option<String>,
}
fn main() -> anyhow::Result<()> {
env_logger::init();
@ -33,7 +41,10 @@ fn main() -> anyhow::Result<()> {
#[cfg(feature = "tracing-mode")]
let tracing = args.log_failed_to != None;
#[cfg(feature = "tracing-mode")]
let mut default_action = ScmpAction::Errno(EPERM);
#[cfg(not(feature = "tracing-mode"))]
let default_action = ScmpAction::Errno(EPERM);
#[cfg(feature = "tracing-mode")]
if let Some(log_fail_to) = args.log_failed_to {