sbexec 0.4.0

Run untrusted build commands in a least-privilege sandbox on macOS and Linux
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

mod audit;
mod cli;
mod executor;

use std::process::ExitCode;

use clap::Parser;
use tracing_subscriber::EnvFilter;

use crate::cli::{Cli, Commands};

fn main() -> ExitCode {
    #[cfg(target_os = "linux")]
    if let Some(code) = sbe_core::maybe_run_launcher() {
        return code;
    }

    let runtime = match tokio::runtime::Builder::new_multi_thread()
        .enable_all()
        .build()
    {
        Ok(runtime) => runtime,
        Err(error) => {
            eprintln!("sbe: failed to start runtime: {error}");
            return ExitCode::from(125);
        }
    };
    runtime.block_on(async_main())
}

async fn async_main() -> ExitCode {
    let cli = Cli::parse();

    // Determine log level
    let verbose = matches!(&cli.command, Commands::Run(args) if args.verbose);
    let filter = if verbose {
        EnvFilter::new("debug")
    } else {
        EnvFilter::new("warn")
    };

    tracing_subscriber::fmt()
        .with_env_filter(filter)
        .with_target(false)
        .with_writer(std::io::stderr)
        .init();

    match cli.command {
        Commands::Run(args) => executor::execute(&args).await,
        Commands::Inspect(args) => {
            let run_args = args.as_run_args();
            executor::execute(&run_args).await
        }
        Commands::Profiles => match executor::print_profiles() {
            Ok(()) => ExitCode::SUCCESS,
            Err(e) => {
                eprintln!("sbe: {e:#}");
                ExitCode::from(125)
            }
        },
    }
}