sbe-core 0.4.0

Core library for sbe — cross-platform sandbox executor for supply chain defense
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108

//! Linux sandbox backend — Landlock LSM + seccomp-bpf.
//!
//! Layout mirrors the spec (§7):
//! - [`probe`]   — kernel version + Landlock ABI detection.
//! - [`policy`]  — deterministic YAML rendering for `--dry-run` / inspect.
//! - [`landlock`] — `SandboxProfile` → Landlock [`Ruleset`] with pre-opened FDs.
//! - [`seccomp`] — `SandboxProfile` → seccomp `BpfProgram` bytes.
//! - [`exec`]    — single-threaded launcher and target exec lifecycle.
//!
//! [`Ruleset`]: ::landlock::Ruleset

mod exec;
mod landlock;
pub mod policy;
mod probe;
mod seccomp;

use std::{collections::HashMap, process::ExitStatus};

pub use exec::maybe_run_launcher;
pub use probe::ProbeResult;

use crate::{
    error::CoreError,
    profile::SandboxProfile,
    sandbox::{BackendInfo, BackendOptions, SandboxBackend},
};

/// Linux backend wrapping Landlock + seccomp-bpf.
#[derive(Debug)]
pub struct LinuxSandbox {
    info: BackendInfo,
    options: BackendOptions,
    probe: ProbeResult,
}

impl LinuxSandbox {
    /// Probe the kernel and construct the backend. Returns
    /// [`CoreError::BackendUnavailable`] on kernels older than 5.13.
    pub fn new() -> Result<Self, CoreError> {
        Self::new_with_options(BackendOptions::default())
    }

    /// Constructor with capability-specific runtime options.
    pub fn new_with_options(options: BackendOptions) -> Result<Self, CoreError> {
        let probe = probe::run()?;
        let features = probe.features();
        let info = BackendInfo {
            name: "landlock+seccomp",
            kernel: probe.kernel.clone(),
            features,
        };
        Ok(Self {
            info,
            options,
            probe,
        })
    }

    /// Borrow the live probe — used by `render_policy` and `exec`.
    pub fn probe(&self) -> &ProbeResult {
        &self.probe
    }
}

impl SandboxBackend for LinuxSandbox {
    fn name(&self) -> &'static str {
        self.info.name
    }

    fn info(&self) -> &BackendInfo {
        &self.info
    }

    fn render_policy(
        &self,
        profile: &SandboxProfile,
        proxy_port: Option<u16>,
    ) -> Result<String, CoreError> {
        Ok(policy::render(
            profile,
            proxy_port,
            &self.probe,
            self.options,
        ))
    }

    fn run(
        &self,
        profile: &SandboxProfile,
        proxy_port: Option<u16>,
        command: &[String],
        extra_env: &HashMap<String, String>,
        pid_tx: Option<tokio::sync::oneshot::Sender<u32>>,
    ) -> impl std::future::Future<Output = Result<ExitStatus, CoreError>> + Send {
        let probe = self.probe.clone();
        let options = self.options;
        let profile = profile.clone();
        let command = command.to_vec();
        let extra_env = extra_env.clone();
        async move {
            exec::run_sandboxed(
                &profile, proxy_port, &command, &extra_env, &probe, options, pid_tx,
            )
            .await
        }
    }
}