Struct Unconfined 

pub struct Unconfined { /* private fields */ }

Runs commands on this machine, with no isolation whatsoever.

Read this before using it

This is not a sandbox. A command run through it has whatever access the BoundGraph process itself has: the whole filesystem, the network, the environment of whatever started it. If the command decides to delete the workspace, it will.

What it actually enforces is three things:

• the working directory is the command’s workspace,
• the process is killed at the timeout,
• the child’s environment is cleared except for the few variables a toolchain cannot start without.

And what it refuses is everything else: any grant beyond reading under the workspace and executing the named program is SandboxError::Unenforceable. It cannot make a net:egress grant true, so it will not accept one.

It exists because the compile and test checkers are useful now and feature 09 is not written yet, and it is named Unconfined so that nobody reads a flow definition containing it and thinks otherwise.

Implementations

impl Unconfined

pub fn new() -> Self

An unconfined runner.

pub fn passing_through(self, name: impl Into<String>) -> Self

Also pass name through to the child.

For a toolchain that needs one — CARGO_HOME, RUSTUP_HOME, VIRTUAL_ENV. Every addition is a way for something the checker was not granted to reach the child, so add them one at a time and knowingly.

Trait Implementations

impl Clone for Unconfined

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Unconfined

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Unconfined

fn default() -> Self

Returns the “default value” for a type.

impl Sandbox for Unconfined

fn run<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, command: &'life1 Command, grant: &'life2 GrantSet, ) -> Pin<Box<dyn Future<Output = Result<Outcome, SandboxError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Run command, confined to grant.