Class: Sandbox::LinuxBackend

Inherits:
Object
  • Object
show all
Defined in:
extend/os/linux/sandbox/backend.rb

Direct Known Subclasses

Bubblewrap, Landlock

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(profile) ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

  • profile (SandboxProfile) 


14
15
16
17
 
# File 'extend/os/linux/sandbox/backend.rb', line 14

def initialize(profile)
  @profile = profile
  @prepared_writable_paths = T.let([], T::Array[::Pathname])
end

Class Method Details

.full_write_isolation? ⇒ Boolean

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:

  • (Boolean) 


10
 
# File 'extend/os/linux/sandbox/backend.rb', line 10

def full_write_isolation? = true

Instance Method Details

#run(&block) ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

This method returns an undefined value.

Parameters:

  • block (T.proc.void) 


20
21
22
23
24
25
26
27
28
29
 
# File 'extend/os/linux/sandbox/backend.rb', line 20

def run(&block)
  yield
ensure
  @prepared_writable_paths.reverse_each do |path|
    path.rmdir if path.directory?
  rescue Errno::ENOENT, Errno::ENOTEMPTY
    nil
  end
  @prepared_writable_paths.clear
end

#writable_paths ⇒ Hash{String => Symbol}

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
 
# File 'extend/os/linux/sandbox/backend.rb', line 39

def writable_paths
  profile.rules.each_with_object({}) do |rule, paths|
    next if !rule.allow || !rule.operation.start_with?("file-write")
    next unless (filter = rule.filter)

    case filter.type
    when :literal, :subpath
      paths[filter.path] ||= filter.type
    when :regex
      raise ArgumentError, "Linux sandbox does not support regex path filters: #{filter.path}"
    else
      raise ArgumentError, "Invalid path filter type: #{filter.type}"
    end
  end
end