rivox 1.0.0

Universal polyglot build coordination layer for Python, Rust, and Node monorepos
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

use super::SandboxExecutor;
use anyhow::{Context, Result};
use std::fs;
use std::path::Path;
use std::process::{Command, Output};

pub struct MacOsSandbox;

impl SandboxExecutor for MacOsSandbox {
    fn name(&self) -> &'static str {
        "macos-sandbox-exec"
    }

    fn execute(
        &self,
        command: &str,
        args: &[&str],
        work_dir: &Path,
        allow_network: bool,
    ) -> Result<Output> {
        let policy_content = format!(
            "(version 1)\n(allow default)\n(deny file-write* (regex #\"^/(usr|bin|sbin|System)\"))\n{}",
            if allow_network {
                ""
            } else {
                "(deny network*)\n"
            }
        );

        let temp_dir = tempfile::tempdir()?;
        let policy_path = temp_dir.path().join("policy.sb");
        fs::write(&policy_path, policy_content)?;

        let mut sandbox_cmd = Command::new("/usr/bin/sandbox-exec");
        sandbox_cmd
            .arg("-f")
            .arg(&policy_path)
            .arg(command)
            .args(args)
            .current_dir(work_dir);

        let output = sandbox_cmd
            .output()
            .with_context(|| format!("macOS sandbox-exec failed for {}", command))?;

        Ok(output)
    }
}