1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
use std::path::PathBuf;
const RUSTC_WRAPPER_ENV_KEYS: [&str; 4] = [
"RUSTC_WRAPPER",
"CARGO_BUILD_RUSTC_WRAPPER",
"RUSTC_WORKSPACE_WRAPPER",
"CARGO_BUILD_RUSTC_WORKSPACE_WRAPPER",
];
/// Exact bytes supplied to a child process.
///
/// `Null` means no input was requested, while `Bytes(Vec::new())` preserves
/// the distinct request to open and immediately close an empty input stream.
#[derive(Clone, Debug, Default, PartialEq, Eq)]
pub enum ProcessStdin {
#[default]
Null,
Bytes(Vec<u8>),
}
/// Process launch settings normalized before platform-specific dispatch.
#[derive(Clone, Debug, Default)]
pub struct ProcessCommandConfig {
pub cwd: Option<PathBuf>,
pub env: Vec<(String, String)>,
/// Environment keys removed after the inherited/session environment and
/// caller overlays have been composed.
pub env_remove: Vec<String>,
pub stdin: ProcessStdin,
/// When `true`, the child starts from an EMPTY environment and receives only
/// the pairs in [`ProcessCommandConfig::env`]. The active session environment
/// has already composed the policy snapshot and grants into this list.
pub closed_env: bool,
}
/// Disable Cargo `rustc` and workspace wrappers for a spawn governed by an active sandbox.
///
/// A wrapper such as `sccache` is a shared per-user daemon. If a sandboxed
/// Cargo invocation starts it, the daemon inherits that confinement and can
/// poison later builds outside the workspace. Empty wrapper values override
/// Cargo configuration while leaving unsandboxed builds and caches unchanged.
pub fn apply_active_rustc_wrapper_policy(
env: &mut Vec<(String, String)>,
env_remove: &mut Vec<String>,
) {
if super::active_sandbox_policy().is_some() {
neutralize_rustc_wrapper(env, env_remove);
}
}
pub(super) fn neutralize_rustc_wrapper(
env: &mut Vec<(String, String)>,
env_remove: &mut Vec<String>,
) {
for key in RUSTC_WRAPPER_ENV_KEYS {
env.retain(|(existing, _)| !existing.eq_ignore_ascii_case(key));
env_remove.retain(|removed| !removed.eq_ignore_ascii_case(key));
env.push((key.to_string(), String::new()));
}
}