colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

sanebox: tidy up the quoting in a few more edge-cases

Browse Source
This commit is contained in:
Colin
2024-05-18 00:00:03 +00:00
parent 795786f46b
commit 7bb7a24b22
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
pkgs/additional/sanebox/sanebox
View File

@@ -298,7 +298,7 @@ readlinkOnce() {
local path=$2 local path=$2
local linkTarget= local linkTarget=
if [ -v linkCache[$path] ]; then if [ -v linkCache[$path] ]; then
linkTarget=${linkCache["$path"]} linkTarget=${linkCache[$path]}
elif [ -L "$path" ]; then elif [ -L "$path" ]; then
# path is a link, but not in the cache # path is a link, but not in the cache
linkTarget=$(readlink "$path") linkTarget=$(readlink "$path")
@@ -338,7 +338,7 @@ derefOnce() {
# make absolute # make absolute
if [ -n "$target" ]; then if [ -n "$target" ]; then
if [ "${target:0:1}" != "/" ]; then if [ "${target:0:1}" != / ]; then
# `walked` is a relative link. # `walked` is a relative link.
# then, the link is relative to the parent directory of `walked` # then, the link is relative to the parent directory of `walked`
target=$walked/../$target target=$walked/../$target
@@ -705,7 +705,7 @@ landlockSetup() {
# typical failure mode: # typical failure mode:
# - /tmp: application can't perform its task # - /tmp: application can't perform its task
# - /dev/{null,random,urandom,zero}: application warns but works around it # - /dev/{null,random,urandom,zero}: application warns but works around it
paths+=(\ paths+=(
/dev/null /dev/null
/dev/random /dev/random
/dev/urandom /dev/urandom
@@ -887,7 +887,7 @@ removeSubpaths() {
for path in "${paths[@]}"; do for path in "${paths[@]}"; do
local isSubpath= local isSubpath=
for other in "${paths[@]}"; do for other in "${paths[@]}"; do
if [[ "$path" =~ ^$other/.* ]] || [ "$other" = "/" ] && [ "$path" != "/" ]; then if [[ "$path" =~ ^"$other"/ ]] || ( [ "$other" = / ] && [ "$path" != / ] ); then
# N.B.: $path lacks a trailing slash, so this never matches self. # N.B.: $path lacks a trailing slash, so this never matches self.
# UNLESS $path or $other is exactly `/`, which we special-case. # UNLESS $path or $other is exactly `/`, which we special-case.
isSubpath=1 isSubpath=1