Class: Sandbox::LinuxBackend

Inherits:
Object
  • Object
show all
Defined in:
extend/os/linux/sandbox/backend.rb

Direct Known Subclasses

Landlock

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(profile) ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

  • profile (SandboxProfile) 


14
15
16
17
 
# File 'extend/os/linux/sandbox/backend.rb', line 14

def initialize(profile)
  @profile = profile
  @prepared_writable_paths = T.let([], T::Array[::Pathname])
end

Class Method Details

.full_write_isolation? ⇒ Boolean

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:

  • (Boolean) 


10
 
# File 'extend/os/linux/sandbox/backend.rb', line 10

def full_write_isolation? = true

Instance Method Details

#cleanup ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

This method returns an undefined value.



20
21
22
23
24
25
26
27
 
# File 'extend/os/linux/sandbox/backend.rb', line 20

def cleanup
  @prepared_writable_paths.reverse_each do |path|
    path.rmdir if path.directory?
  rescue Errno::ENOENT, Errno::ENOTEMPTY
    nil
  end
  @prepared_writable_paths.clear
end

#writable_paths ⇒ Hash{String => Symbol}

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
 
# File 'extend/os/linux/sandbox/backend.rb', line 37

def writable_paths
  profile.rules.each_with_object({}) do |rule, paths|
    next if !rule.allow || !rule.operation.start_with?("file-write")
    next unless (filter = rule.filter)

    case filter.type
    when :literal, :subpath
      paths[filter.path] ||= filter.type
    when :regex
      raise ArgumentError, "Linux sandbox does not support regex path filters: #{filter.path}"
    else
      raise ArgumentError, "Invalid path filter type: #{filter.type}"
    end
  end
end