1
Fork 0
hare-playground/backend/src/sandbox.rs

139 lines
3.6 KiB
Rust
Raw Normal View History

2024-05-24 19:58:49 +00:00
use std::fs::File;
use std::io::Write;
use std::os::fd::AsRawFd;
use std::process::Command;
use tempfile::TempDir;
#[rustfmt::skip]
const STATIC_ARGS: &[&str] = &[
"--ro-bind", "/usr", "/usr",
"--dir", "/tmp",
"--dir", "/var",
"--symlink", "../tmp", "var/tmp",
"--proc", "/proc",
"--dev", "/dev",
"--ro-bind", "/etc/resolv.conf", "/etc/resolv.conf",
"--ro-bind", "/nix", "/nix",
"--symlink", "usr/lib", "/lib",
"--symlink", "usr/lib64 /lib64",
"--symlink", "usr/bin", "/bin",
"--symlink", "usr/sbin", "/sbin",
"--chdir", "/app",
"--unshare-all",
"--die-with-parent",
"--clearenv",
];
const HARE_COMMAND: &str = "/nix/store/cnysps4xzry4g26zyz7mmxfjj6wagpa6-hare-0.24.0/bin/hare";
/// Default command timeout in seconds.
const DEFAULT_TIMEOUT: u32 = 10;
fn passwd_files(uid: u32, gid: u32) -> (File, File, Vec<String>) {
let uid = uid.to_string();
let passwd = Command::new("getent")
.args(["passwd", &uid, "65534"])
.output()
.expect("failed to run getent passwd");
let gid = gid.to_string();
let group = Command::new("getent")
.args(["group", &gid, "65534"])
.output()
.expect("failed to run getent passwd");
let mut passwd_file = tempfile::tempfile().unwrap();
passwd_file.write_all(&passwd.stdout).unwrap();
passwd_file.flush().unwrap();
let mut group_file = tempfile::tempfile().unwrap();
group_file.write_all(&group.stdout).unwrap();
group_file.flush().unwrap();
let args = vec![
"--file".to_string(),
passwd_file.as_raw_fd().to_string(),
"/etc/passwd".to_string(),
"--file".to_string(),
group_file.as_raw_fd().to_string(),
"/etc/group".to_string(),
];
(passwd_file, group_file, args)
}
fn home_dir(uid: u32) -> Vec<String> {
let user_dir = format!("/run/user/{uid}");
let home_dir = format!("{user_dir}/home");
vec![
"--dir".to_string(),
user_dir.clone(),
"--setenv".to_string(),
"HOME".to_string(),
home_dir,
"--setenv".to_string(),
"XDG_RUNTIME_DIR".to_string(),
user_dir,
]
}
fn shared_app_dir() -> (TempDir, Vec<String>) {
let tmp_app_dir = tempfile::tempdir().unwrap();
let app_dir_path = tmp_app_dir.path().display().to_string();
(
tmp_app_dir,
vec!["--bind".to_string(), app_dir_path, "/app".to_string()],
)
}
fn command(app_file: &str) -> Vec<String> {
vec![
"/usr/bin/timeout".to_string(),
DEFAULT_TIMEOUT.to_string(),
HARE_COMMAND.to_string(),
"run".to_string(),
app_file.to_string(),
]
}
fn getids() -> (u32, u32) {
unsafe {
(libc::getuid(), libc::getgid())
}
}
pub fn run_code(code: &str) {
let (uid, gid) = getids();
let mut bwrap_cmd = Command::new("bwrap");
bwrap_cmd.args(STATIC_ARGS);
let (app_dir, dir_arg) = shared_app_dir();
bwrap_cmd.args(dir_arg);
let home_args = home_dir(uid);
bwrap_cmd.args(home_args);
let (_passwd, _group, file_args) = passwd_files(uid, gid);
bwrap_cmd.args(file_args);
{
let code_path = app_dir.path().with_file_name("main.ha");
let mut code_file = File::create(code_path).unwrap();
code_file.write_all(code.as_bytes()).unwrap();
}
let cmd_args = command("/app/main.ha");
bwrap_cmd.args(cmd_args);
2024-05-24 20:00:27 +00:00
let output = bwrap_cmd.output().expect("running bwrap failed");
let stdout = String::from_utf8_lossy(&output.stdout);
let stderr = String::from_utf8_lossy(&output.stderr);
println!("stdout:\n{stdout}");
println!("stderr:\n{stderr}");
2024-05-24 19:58:49 +00:00
}