wardstone 0.1.0

Sandboxing system for secure tool execution (Seatbelt/Landlock) - magical containment
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93

//! # Wardstone
//!
//! Sandboxing system for secure tool execution - magical containment.
//!
//! Provides platform-specific sandboxing:
//! - **macOS**: Seatbelt (sandbox-exec) with .sbpl policies
//! - **Linux**: Landlock + seccomp
//! - **Windows**: Windows Sandbox (future)
//!
//! ## Usage
//!
//! ```rust,ignore
//! use wardstone::{Sandbox, SandboxPolicy};
//!
//! let policy = SandboxPolicy::new()
//!     .allow_read("/usr")
//!     .allow_write("./")
//!     .deny_network();
//!
//! let sandbox = Sandbox::new(policy)?;
//! let wrapped_cmd = sandbox.wrap_command(cmd);
//! ```

pub mod policy;
pub mod error;

#[cfg(target_os = "macos")]
pub mod seatbelt;

#[cfg(target_os = "linux")]
pub mod landlock;

#[cfg(windows)]
pub mod windows;

pub use policy::{SandboxPolicy, NetworkPolicy, PathPermission};
pub use error::SandboxError;

use std::process::Command;

/// Platform-specific sandbox implementation
pub trait Sandbox: Send + Sync {
    /// Wrap a command with sandbox restrictions
    fn wrap_command(&self, cmd: Command) -> Result<Command, SandboxError>;
    
    /// Check if sandbox is available on this platform
    fn is_available() -> bool where Self: Sized;
    
    /// Get the sandbox type name
    fn sandbox_type(&self) -> &'static str;
}

/// Create the appropriate sandbox for the current platform
pub fn create_sandbox(policy: SandboxPolicy) -> Result<Box<dyn Sandbox>, SandboxError> {
    #[cfg(target_os = "macos")]
    {
        Ok(Box::new(seatbelt::SeatbeltSandbox::new(policy)?))
    }
    
    #[cfg(target_os = "linux")]
    {
        Ok(Box::new(landlock::LandlockSandbox::new(policy)?))
    }
    
    #[cfg(windows)]
    {
        // Windows sandbox not yet implemented
        Err(SandboxError::NotAvailable("Windows sandbox not implemented".into()))
    }
    
    #[cfg(not(any(target_os = "macos", target_os = "linux", windows)))]
    {
        Err(SandboxError::NotAvailable("No sandbox available for this platform".into()))
    }
}

/// Check if sandboxing is available on this platform
pub fn is_sandbox_available() -> bool {
    #[cfg(target_os = "macos")]
    {
        seatbelt::SeatbeltSandbox::is_available()
    }
    
    #[cfg(target_os = "linux")]
    {
        landlock::LandlockSandbox::is_available()
    }
    
    #[cfg(not(any(target_os = "macos", target_os = "linux")))]
    {
        false
    }
}