68 lines
1.6 KiB
Go
68 lines
1.6 KiB
Go
//go:build darwin
|
|
|
|
package agentworkspace
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"os/exec"
|
|
"strconv"
|
|
"strings"
|
|
"sync"
|
|
|
|
"iop/packages/go/agenttask"
|
|
)
|
|
|
|
var (
|
|
darwinConfinementOnce sync.Once
|
|
darwinConfinementErr error
|
|
)
|
|
|
|
func platformConfinementRevision() (string, error) {
|
|
darwinConfinementOnce.Do(func() {
|
|
command := exec.Command(
|
|
"/usr/bin/sandbox-exec",
|
|
"-p",
|
|
"(version 1) (allow default)",
|
|
"/usr/bin/true",
|
|
)
|
|
if output, err := command.CombinedOutput(); err != nil {
|
|
darwinConfinementErr = fmt.Errorf(
|
|
"%w: macOS sandbox installation probe failed: %v: %s",
|
|
ErrConfinementUnavailable,
|
|
err,
|
|
boundedText(output),
|
|
)
|
|
}
|
|
})
|
|
if darwinConfinementErr != nil {
|
|
return "", darwinConfinementErr
|
|
}
|
|
return "darwin-sandbox-exec-policy-v1", nil
|
|
}
|
|
|
|
func platformConfinementCommand(
|
|
ctx context.Context,
|
|
binding agenttask.ConfinementBinding,
|
|
policy confinementPolicy,
|
|
name string,
|
|
args []string,
|
|
) (*exec.Cmd, error) {
|
|
if _, err := platformConfinementRevision(); err != nil {
|
|
return nil, err
|
|
}
|
|
var profile strings.Builder
|
|
profile.WriteString("(version 1)\n")
|
|
profile.WriteString("(allow default)\n")
|
|
profile.WriteString("(deny file-write*)\n")
|
|
for _, root := range policy.WritableRoots {
|
|
profile.WriteString("(allow file-write* (subpath ")
|
|
profile.WriteString(strconv.Quote(root))
|
|
profile.WriteString("))\n")
|
|
}
|
|
commandArgs := []string{"-p", profile.String(), "--", name}
|
|
commandArgs = append(commandArgs, args...)
|
|
command := exec.CommandContext(ctx, "/usr/bin/sandbox-exec", commandArgs...)
|
|
command.Dir = binding.WorkingDir
|
|
return command, nil
|
|
}
|