External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: Misc cleanup fixes

Browse Source
This commit is contained in:
Abhisek Datta
2026-01-08 16:17:59 +05:30
parent bb3e001e87
commit eeeed76f07
3 changed files with 42 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sandbox/executor/apply.go
+15 -28
View File
@@ -14,67 +14,55 @@ import (
// ApplySandbox applies sandbox isolation to the command if sandbox mode is enabled.
// This is a helper function used by both guard and proxy flows to avoid code duplication.
//
// Parameters:
// - ctx: Context for the sandbox execution
// - cmd: The exec.Cmd to be sandboxed (will be modified in place)
// - pmName: Package manager name (e.g., "npm", "pip") used to determine the sandbox policy to apply
// - mode: Optional mode description for logging (e.g., "proxy mode", empty for default)
//
// Returns:
// - ExecutionResult: Contains execution state. Callers must check result.ShouldRun() before calling cmd.Run().
// - error: Non-nil if sandbox setup fails
//
// If sandbox is not enabled/available, returns a result indicating the caller should run the command.
// Gracefully degrades with warnings if sandbox is unavailable on the platform.
// This is a security sensitive operation. If sandbox is enabled via. config but not available on the platform,
// it will return an error to avoid running the command without sandbox protection.
func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string) (*sandbox.ExecutionResult, error) {
cfg := config.Get()
if !cfg.Config.Sandbox.Enabled {
return sandbox.NewExecutionResult(false), nil
return sandbox.NewExecutionResult(), nil
}
registry := sandbox.NewProfileRegistry()
var policy *sandbox.SandboxPolicy
var err error
// Check for runtime profile override first (--sandbox-profile flag)
if cfg.SandboxProfileOverride != "" {
log.Debugf("Using sandbox profile override: %s", cfg.SandboxProfileOverride)
policy, err = registry.GetProfile(cfg.SandboxProfileOverride)
if err != nil {
return nil, fmt.Errorf("failed to load override sandbox policy %s: %w", cfg.SandboxProfileOverride, err)
}
} else {
// Use configured per-package-manager policy
log.Debugf("Looking up sandbox policy for %s", pmName)
policyRef, exists := cfg.Config.Sandbox.Policies[pmName]
if !exists || !policyRef.Enabled {
log.Debugf("No sandbox policy enabled for %s", pmName)
return sandbox.NewExecutionResult(false), nil
return nil, fmt.Errorf("no sandbox policy enabled for %s", pmName)
}
log.Debugf("Loading sandbox policy %s", policyRef.Profile)
policy, err = registry.GetProfile(policyRef.Profile)
if err != nil {
return nil, fmt.Errorf("failed to load sandbox policy %s: %w", policyRef.Profile, err)
}
}
// Validate that the loaded policy applies to this package manager
log.Debugf("Loaded sandbox policy %s", policy.Name)
if !policy.AppliesToPackageManager(pmName) {
log.Warnf("Sandbox policy %s does not apply to %s", policy.Name, pmName)
return sandbox.NewExecutionResult(false), nil
return nil, fmt.Errorf("sandbox policy %s does not apply to %s", policy.Name, pmName)
}
// Create platform-specific sandbox
sb, err := platform.NewSandbox()
if err != nil {
log.Warnf("Sandbox not available on this platform: %v", err)
log.Warnf("Continuing without sandbox protection")
return sandbox.NewExecutionResult(false), nil
return nil, fmt.Errorf("sandbox not available on this platform: %v", err)
}
if !sb.IsAvailable() {
log.Warnf("Sandbox %s not available, running without sandbox", sb.Name())
return sandbox.NewExecutionResult(false), nil
return nil, fmt.Errorf("sandbox %s not available, running without sandbox", sb.Name())
}
log.Debugf("Running %s in %s sandbox with policy %s", pmName, sb.Name(), policy.Name)
@@ -84,6 +72,5 @@ func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string) (*sandbox.E
return nil, fmt.Errorf("failed to setup sandbox: %w", err)
}
// Return result with sandbox reference so caller can defer result.Close()
return sandbox.NewExecutionResultWithSandbox(result.WasExecuted(), sb), nil
return result, nil
}