Problem

Supply chain attacks became very common thing these days, but we're still running untrusted code on our machines everyday. This crate provides cargo safe subcommand, that runs all commands in a sandboxed environment.

For now it is working on macOS only using Apple's sandboxing mechanism.

How to use it?

Installation

$ cargo install cargo-safe

Using is pretty simple, you can use any cargo command:

$ cargo safe buld
$ cargo safe test
$ cargo safe run

Or any other cargo command.

What is allowed inside sandoxed environment

• reading and writing OS temporary directory
• outbound network activity to ports 80/443
• listing of files (but not their content)
• reading all files listed in PATH env variable (to run system binaries)
• writing to a separate cargo and target directiories in a private sandbox
• writing to /dev/null and some other system files.
• reading from /dev/random, /dev/tty and some other system files

Full list of permissions can be found in sources.