Module: OS::Linux::Sandbox::ClassMethods Private

Extended by:
T::Helpers
Defined in:
extend/os/linux/sandbox.rb

This module is part of a private API. This module may only be used in the Homebrew/brew repository. Third parties should avoid using this module if possible, as it may be removed or changed without warning.

Instance Method Summary collapse

Instance Method Details

#available? ⇒ Boolean

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:

  • (Boolean) 


132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
 
# File 'extend/os/linux/sandbox.rb', line 132

def available?
  return false unless Homebrew::EnvConfig.sandbox_linux?
  return false unless (bubblewrap = executable)

  system(
    bubblewrap.to_s,
    "--unshare-user",
    "--unshare-ipc",
    "--unshare-pid",
    "--unshare-uts",
    "--unshare-cgroup-try",
    "--ro-bind", "/", "/",
    "--proc", "/proc",
    "--dev", "/dev",
    "true",
    out: File::NULL,
    err: File::NULL
  ) == true
end

#bubblewrap_candidate_paths ⇒ ::PATH

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



97
98
99
 
# File 'extend/os/linux/sandbox.rb', line 97

def bubblewrap_candidate_paths
  executable_candidate_paths
end

#bubblewrap_executable ⇒ ::Pathname?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



102
103
104
 
# File 'extend/os/linux/sandbox.rb', line 102

def bubblewrap_executable
  executable
end

#bubblewrap_executable! ⇒ ::Pathname

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



107
108
109
 
# File 'extend/os/linux/sandbox.rb', line 107

def bubblewrap_executable!
  bubblewrap_executable || raise("Bubblewrap is required to use the Linux sandbox.")
end

#ensure_sandbox_installed! ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

This method returns an undefined value.



112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
 
# File 'extend/os/linux/sandbox.rb', line 112

def ensure_sandbox_installed!
  return unless Homebrew::EnvConfig.sandbox_linux?
  # Never trigger a real install during `brew tests`.
  return if ENV["HOMEBREW_TESTS"]
  return if ENV["HOMEBREW_INSTALLING_BUBBLEWRAP"]
  return if bubblewrap_executable

  require "tap"
  return unless ::CoreTap.instance.installed?

  require "exceptions"
  require "formula"
  with_env(HOMEBREW_INSTALLING_BUBBLEWRAP: "1") do
    ::Formula["bubblewrap"].ensure_installed!(reason: "Linux sandboxing")
  end
rescue ::FormulaUnavailableError
  nil
end

#executable_candidate_paths ⇒ ::PATH

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



92
93
94
 
# File 'extend/os/linux/sandbox.rb', line 92

def executable_candidate_paths
  PATH.new(system_bubblewrap_paths, super)
end

#executable_name ⇒ String

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



77
78
79
 
# File 'extend/os/linux/sandbox.rb', line 77

def executable_name
  BUBBLEWRAP
end

#executable_usable?(candidate) ⇒ Boolean

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Boolean) 


82
83
84
 
# File 'extend/os/linux/sandbox.rb', line 82

def executable_usable?(candidate)
  !File.stat(candidate).setuid?
end

#system_bubblewrap_paths ⇒ Array<String>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



87
88
89
 
# File 'extend/os/linux/sandbox.rb', line 87

def system_bubblewrap_paths
  SYSTEM_BUBBLEWRAP_PATHS
end

#terminal_ioctl_request ⇒ Integer

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

ioctl request used to attach the sandboxed child to a controlling TTY.

Returns:



154
155
156
 
# File 'extend/os/linux/sandbox.rb', line 154

def terminal_ioctl_request
  TIOCSCTTY
end