Something went wrong. Try again.
Monorepo for Tangled
Something went wrong. Try again.
1.4 kB · 45 lines
Go
at master
12345678910111213141516171819202122232425262728293031323334353637383940414243444546package sandbox
import "os/exec"
// Backend wraps git subprocesses in a filesystem sandbox.type Backend interface { Wrap(repoPath string, cmd *exec.Cmd) (*exec.Cmd, error) WrapMulti(paths []string, cmd *exec.Cmd) (*exec.Cmd, error) Name() string}
// NoopBackend passes commands through unchanged.type NoopBackend struct{}
func (n *NoopBackend) Wrap(repoPath string, cmd *exec.Cmd) (*exec.Cmd, error) { cmd.Dir = repoPath return cmd, nil}
func (n *NoopBackend) WrapMulti(paths []string, cmd *exec.Cmd) (*exec.Cmd, error) { if len(paths) > 0 { cmd.Dir = paths[0] } return cmd, nil}
func (n *NoopBackend) Name() string { return "noop" }
// LookupUID resolves a repo path to its owner virtual UID. Used by the sandbox// to drop privileges before running git. Returning 0 (or any error) means// don't drop, i.e. the subprocess runs as the calling user.type LookupUID func(repoPath string) (uid uint32, gid uint32, err error)
// New returns the best available sandboxing backend. If landlock is not// available, the warning string is non-empty and the backend falls back// to NoopBackend. lookup is optional; nil means subprocesses keep the// caller's UID/GID.func New(lookup LookupUID) (Backend, string) { return platformNew(lookup)}
// Probe returns a human-readable description of sandbox capability on this host.func Probe() string { return platformProbe()}