tabox 1.3.6

A sandbox to execute a program in an isolated environment and measure its resource usage
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104

#[cfg(target_os = "linux")]
use crate::result::ExitStatus;

use crate::tests::util::ExecutionResult;
use std::path::Path;
use std::process::{Command, Output};

/// Execute compiled program
fn run_program(args: Vec<&str>) -> Output {
    let exe = Path::new(env!("CARGO_MANIFEST_DIR")).join("target/debug/tabox");
    Command::new(exe)
        .args(args)
        .output()
        .expect("Error spawning process")
}

/// Run a command in bash
#[allow(clippy::vec_init_then_push)]
fn run_shell(command: &str) -> ExecutionResult {
    let stderr_dir = tempfile::TempDir::new().unwrap();
    let stderr_file = stderr_dir.path().join("stderr.txt");

    let mut args = Vec::new();
    args.push("--json");
    args.push("--allow-insecure");
    args.push("--env");
    args.push("PATH");
    args.push("--mount");
    args.push("/usr");
    args.push("/bin");
    args.push("/sbin");
    args.push("/lib");
    args.push("/etc");
    args.push("/var");

    if Path::new("/lib64").exists() {
        args.push("/lib64");
    }

    args.push("--mount-tmpfs");
    args.push("--working-directory");
    args.push("/tmp");
    args.push("--allow-multiprocess");
    args.push("--stderr");
    args.push(stderr_file.to_str().unwrap());
    args.push("--");
    args.push("/bin/bash");
    args.push("-c");
    args.push(command);

    let output = run_program(args);
    assert!(output.status.success());

    let stdout = std::str::from_utf8(&output.stdout).unwrap();
    let stderr = std::fs::read_to_string(&stderr_file).unwrap_or_default();
    let result = std::str::from_utf8(&output.stderr).unwrap();

    eprintln!("stdout = {}", stdout);
    eprintln!("stderr = {}", stderr);
    eprintln!("result = {}", result);

    ExecutionResult {
        stdout: stdout.to_owned(),
        stderr,
        result: serde_json::from_str(result).unwrap(),
    }
}

/// Test running bash
#[test]
fn test_echo() {
    let output = run_shell("exec echo -n Hello, world!");
    assert_eq!(output.stdout, "Hello, world!");
}

/// Test no ping
#[cfg(target_os = "linux")]
#[test]
fn test_ping() {
    let output = run_shell("exec ping 8.8.8.8");
    assert!(!output.result.status.success());
    assert_eq!(output.result.status, ExitStatus::ExitCode(2));
}

/// Test no curl
#[cfg(target_os = "linux")]
#[test]
fn test_curl() {
    let output = run_shell("exec curl 8.8.8.8");
    assert!(!output.result.status.success());
    assert_eq!(output.result.status, ExitStatus::ExitCode(7));
}

/// Test blocking chmod
#[cfg(target_os = "linux")]
#[test]
fn test_chmod() {
    let output = run_shell("touch file; exec chmod 777 file");
    assert!(!output.result.status.success());
    assert_eq!(
        output.result.status.signal_name().unwrap(),
        "Bad system call"
    );
}