colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

programs: sane-sandbox: implement a cleaner debugshell and test API

Browse Source
This commit is contained in:
Colin 2024-01-23 11:19:52 +00:00
parent 6e9220d2bb
commit 27b56b1a12
2 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
modules/programs/make-sandboxed.nix
View File

@ -109,7 +109,10 @@ let
# ensuring that every binary has in fact been wrapped.
_numExec=0
for b in ${packageWrapped}/bin/*; do
PATH="$PATH:${packageWrapped}/bin:${sane-sandboxed}/bin" "$b" --sane-sandbox-method exit0fortest | grep "exiting 0 for test"
PATH="$PATH:${packageWrapped}/bin:${sane-sandboxed}/bin" \
SANE_SANDBOX_DISABLE=1 \
"$b" --sane-sandbox-replace-cli echo "printing for test" \
| grep "printing for test"
_numExec=$(( $_numExec + 1 ))
done

11
modules/programs/sane-sandboxed
View File

@ -66,6 +66,12 @@ parseArgs() {
SANE_SANDBOX_DEBUG=1
set -x
;;
(--sane-sandbox-replace-cli)
# keep the sandbox flags, but clear any earlier CLI args.
# this lets the user do things like `mpv --sane-sandbox-replace-cli sh` to enter a shell
# with the sandbox that `mpv` would see.
parseArgsExtra=()
;;
(--sane-sandbox-disable)
SANE_SANDBOX_DISABLE=1
;;
@ -160,11 +166,6 @@ cliArgs+=("${parseArgsExtra[@]}")
test -n "$SANE_SANDBOX_DISABLE" && exec "${cliArgs[@]}"
test "$method" = "exit0fortest" && echo "exiting 0 for test" && exit 0
# drop into an interactive shell to e.g. inspect the mount space
test "$method" = "debugshell" && exec sh
### convert generic args into sandbox-specific args
# order matters: for firejail, early args override the later --profile args