Something went wrong. Try again.
Monorepo for Tangled
Something went wrong. Try again.
1.2 kB · 43 lines
Go
1234567891011121314151617181920212223242526272829303132333435363738394041424344package sandboxexec
import ( "context" "fmt" "os"
"github.com/urfave/cli/v3")
// Command returns the hidden sandbox-exec subcommand used by LandlockBackend.//// landlock_restrict_self only restricts the calling OS thread, so it cannot be// called from a goroutine (the Go scheduler may migrate the goroutine across// threads). The workaround is to re-exec the knot binary with this subcommand,// which runs single-threaded before the Go runtime starts its thread pool,// applies the ruleset, then exec's into the target git process.func Command() *cli.Command { return &cli.Command{ Name: "sandbox-exec", Hidden: true, Usage: "apply landlock sandbox and exec into git (internal use only)", Action: Run, Flags: []cli.Flag{ &cli.StringSliceFlag{ Name: "repo-path", Usage: "repository path(s) to allow read/write access to", }, }, }}
func Run(ctx context.Context, cmd *cli.Command) error { repoPaths := cmd.StringSlice("repo-path") gitArgs := cmd.Args().Slice()
if len(gitArgs) == 0 { fmt.Fprintln(os.Stderr, "sandbox-exec: no command specified after --") os.Exit(1) }
return applyAndExec(repoPaths, gitArgs)}