83 lines
2.5 KiB
Rust
83 lines
2.5 KiB
Rust
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
use crate::error::MolotovError;
|
|
use std::path::{Path, PathBuf};
|
|
use std::process::Command;
|
|
|
|
#[derive(Debug, Clone)]
|
|
pub struct SandboxConfig {
|
|
pub instance_id: String,
|
|
pub data_dir: PathBuf,
|
|
pub config_dir: PathBuf,
|
|
pub nice_priority: i32,
|
|
}
|
|
|
|
pub struct SandboxRunner {
|
|
config: SandboxConfig,
|
|
}
|
|
|
|
impl SandboxRunner {
|
|
pub fn new(config: SandboxConfig) -> Self {
|
|
Self { config }
|
|
}
|
|
|
|
pub fn build_bwrap_args(&self, executable_path: &Path) -> Vec<String> {
|
|
let mut args = vec![
|
|
"--unshare-pid".to_string(),
|
|
"--unshare-ipc".to_string(),
|
|
"--ro-bind".to_string(),
|
|
"/usr".to_string(),
|
|
"/usr".to_string(),
|
|
"--ro-bind".to_string(),
|
|
"/lib".to_string(),
|
|
"/lib".to_string(),
|
|
"--ro-bind".to_string(),
|
|
"/lib64".to_string(),
|
|
"/lib64".to_string(),
|
|
"--dev".to_string(),
|
|
"/dev".to_string(),
|
|
"--proc".to_string(),
|
|
"/proc".to_string(),
|
|
"--tmpfs".to_string(),
|
|
"/tmp".to_string(),
|
|
];
|
|
|
|
// Isolated XDG_DATA_HOME
|
|
args.push("--bind".to_string());
|
|
args.push(self.config.data_dir.to_string_lossy().to_string());
|
|
args.push(self.config.data_dir.to_string_lossy().to_string());
|
|
|
|
// Isolated XDG_CONFIG_HOME
|
|
args.push("--bind".to_string());
|
|
args.push(self.config.config_dir.to_string_lossy().to_string());
|
|
args.push(self.config.config_dir.to_string_lossy().to_string());
|
|
|
|
args.push("--".to_string());
|
|
args.push(executable_path.to_string_lossy().to_string());
|
|
|
|
args
|
|
}
|
|
|
|
pub fn check_bwrap_installed() -> Result<(), MolotovError> {
|
|
match Command::new("bwrap").arg("--version").output() {
|
|
Ok(output) if output.status.success() => Ok(()),
|
|
_ => Err(MolotovError::Sandbox(
|
|
"bubblewrap ('bwrap') is not installed. Please install it via your system package manager."
|
|
.to_string(),
|
|
)),
|
|
}
|
|
}
|
|
|
|
pub fn spawn_command(&self, executable_path: &Path) -> Result<Command, MolotovError> {
|
|
Self::check_bwrap_installed()?;
|
|
|
|
let args = self.build_bwrap_args(executable_path);
|
|
let mut cmd = Command::new("bwrap");
|
|
cmd.args(args);
|
|
|
|
// Configure environment variables for the child instance
|
|
cmd.env("XDG_DATA_HOME", &self.config.data_dir);
|
|
cmd.env("XDG_CONFIG_HOME", &self.config.config_dir);
|
|
|
|
Ok(cmd)
|
|
}
|
|
}
|