External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: Apply API

Browse Source
This commit is contained in:
Abhisek Datta
2026-01-08 14:20:47 +05:30
parent b92ba00cfa
commit 9f77cca5e5
5 changed files with 34 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sandbox/executor/apply.go
+25 -17
View File
@@ -26,26 +26,39 @@ import (
//
// If sandbox is not enabled/available, returns a result indicating the caller should run the command.
// Gracefully degrades with warnings if sandbox is unavailable on the platform.
func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string, mode string) (*sandbox.ExecutionResult, error) {
func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string) (*sandbox.ExecutionResult, error) {
cfg := config.Get()
if !cfg.Config.Sandbox.Enabled {
return sandbox.NewExecutionResult(false), nil
}
// Lookup the sandbox policy for the package manager based on config
policyRef, exists := cfg.Config.Sandbox.Policies[pmName]
if !exists || !policyRef.Enabled {
log.Debugf("No sandbox policy enabled for %s", pmName)
return sandbox.NewExecutionResult(false), nil
}
registry := sandbox.NewProfileRegistry()
policy, err := registry.GetProfile(policyRef.Profile)
if err != nil {
return nil, fmt.Errorf("failed to load sandbox policy %s: %w", policyRef.Profile, err)
var policy *sandbox.SandboxPolicy
var err error
// Check for runtime profile override first (--sandbox-profile flag)
if cfg.SandboxProfileOverride != "" {
log.Debugf("Using sandbox profile override: %s", cfg.SandboxProfileOverride)
policy, err = registry.GetProfile(cfg.SandboxProfileOverride)
if err != nil {
return nil, fmt.Errorf("failed to load override sandbox policy %s: %w", cfg.SandboxProfileOverride, err)
}
} else {
// Use configured per-package-manager policy
policyRef, exists := cfg.Config.Sandbox.Policies[pmName]
if !exists || !policyRef.Enabled {
log.Debugf("No sandbox policy enabled for %s", pmName)
return sandbox.NewExecutionResult(false), nil
}
policy, err = registry.GetProfile(policyRef.Profile)
if err != nil {
return nil, fmt.Errorf("failed to load sandbox policy %s: %w", policyRef.Profile, err)
}
}
// Validate that the loaded policy applies to this package manager
if !policy.AppliesToPackageManager(pmName) {
log.Warnf("Sandbox policy %s does not apply to %s", policy.Name, pmName)
return sandbox.NewExecutionResult(false), nil
@@ -64,12 +77,7 @@ func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string, mode string
return sandbox.NewExecutionResult(false), nil
}
logMsg := fmt.Sprintf("Running %s in %s sandbox with policy %s", pmName, sb.Name(), policy.Name)
if mode != "" {
logMsg += fmt.Sprintf(" (%s)", mode)
}
log.Infof("%s", logMsg)
log.Debugf("Running %s in %s sandbox with policy %s", pmName, sb.Name(), policy.Name)
result, err := sb.Execute(ctx, cmd, policy)
if err != nil {