toki
3c48879c44
독립 호스트에서 안전한 작업 실행과 복구를 제공하기 위해 런타임 설정, 정책, 상태 저장소, 워크스페이스 격리 및 AgentTask 오케스트레이션을 확장한다.
66 lines
1.5 KiB
Go
66 lines
1.5 KiB
Go
//go:build darwin
|
|
|
|
package agentworkspace
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"os/exec"
|
|
"strconv"
|
|
"strings"
|
|
"sync"
|
|
|
|
"iop/packages/go/agenttask"
|
|
)
|
|
|
|
var (
|
|
darwinConfinementOnce sync.Once
|
|
darwinConfinementErr error
|
|
)
|
|
|
|
func platformConfinementRevision() (string, error) {
|
|
darwinConfinementOnce.Do(func() {
|
|
command := exec.Command(
|
|
"/usr/bin/sandbox-exec",
|
|
"-p",
|
|
"(version 1) (allow default)",
|
|
"/usr/bin/true",
|
|
)
|
|
if output, err := command.CombinedOutput(); err != nil {
|
|
darwinConfinementErr = fmt.Errorf(
|
|
"%w: macOS sandbox installation probe failed: %v: %s",
|
|
ErrConfinementUnavailable,
|
|
err,
|
|
boundedText(output),
|
|
)
|
|
}
|
|
})
|
|
if darwinConfinementErr != nil {
|
|
return "", darwinConfinementErr
|
|
}
|
|
return "darwin-sandbox-exec-policy-v1", nil
|
|
}
|
|
|
|
func platformConfinementCommand(
|
|
ctx context.Context,
|
|
_ agenttask.ConfinementBinding,
|
|
policy confinementPolicy,
|
|
name string,
|
|
args []string,
|
|
) (*exec.Cmd, error) {
|
|
if _, err := platformConfinementRevision(); err != nil {
|
|
return nil, err
|
|
}
|
|
var profile strings.Builder
|
|
profile.WriteString("(version 1)\n")
|
|
profile.WriteString("(allow default)\n")
|
|
profile.WriteString("(deny file-write*)\n")
|
|
for _, root := range policy.WritableRoots {
|
|
profile.WriteString("(allow file-write* (subpath ")
|
|
profile.WriteString(strconv.Quote(root))
|
|
profile.WriteString("))\n")
|
|
}
|
|
commandArgs := []string{"-p", profile.String(), "--", name}
|
|
commandArgs = append(commandArgs, args...)
|
|
return exec.CommandContext(ctx, "/usr/bin/sandbox-exec", commandArgs...), nil
|
|
}
|