mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
* feat: Sandbox implementation with seatbelt * refactor: Remove concept of PM_CACHE * fix: Misc fixes * refactor: Sandbox for separation of boundaries * fix: Apply API * fix: Add support for sandbox cleanup * test: Add variable interpolation test * fix: Misc cleanup fixes * chore: Cleanup sandbox registry * chore: Cleanup sandbox policy * chore: Cleanup sandbox * fix: Misc cleanup fixes * fix: Remove violation mode * fix: Update config template * chore: Go mod cleanup * fix: Handle the case when package manager policy is explicitly disabled * fix: Sandbox executor * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com> * test: Remove unused var * test: Add test for seatbelt sandbox driver * fix: Sandbox profile loader from file should use path for caching * test: Add policy test * feat: Add support for config templates * fix: Seatbelt translator handle glob * fix: Merge conflicts * fix: Fix sandbox policy generator for MacOS min permissions * fix: Sandbox path handling bugs * fix: Deny read to dangerous directories * fix: Deny read to dangerous directories * add sandbox e2e (#112) * fix: Sandbox E2E test * fix: Code review fixes * fix: Code review fixes * doc: Add sandbox debugging guide * doc: Update sandbox doc * docs: Add sandbox usage doc * fix: Use better error for sandbox without policy * fix: Add sandbox for npx * fix: Enable PTY for npm --------- Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com>
48 lines
1.4 KiB
Go
48 lines
1.4 KiB
Go
package util
|
|
|
|
import (
|
|
"os"
|
|
"regexp"
|
|
"strings"
|
|
)
|
|
|
|
var tmpdirPatternRegex = regexp.MustCompile(`^/(private/)?var/folders/[^/]{2}/[^/]+/T/?$`)
|
|
|
|
// GetTmpdirParent returns the parent directory of TMPDIR if it matches the macOS pattern.
|
|
// On macOS, TMPDIR is typically /var/folders/XX/YYY/T/ where XX and YYY are random.
|
|
//
|
|
// Returns both /var/ and /private/var/ versions since /var is a symlink to /private/var.
|
|
// This is needed because package managers may reference either path.
|
|
//
|
|
// Returns empty slice if TMPDIR doesn't match the expected macOS pattern.
|
|
func GetTmpdirParent() []string {
|
|
tmpdir := os.Getenv("TMPDIR")
|
|
if tmpdir == "" {
|
|
return []string{}
|
|
}
|
|
|
|
// macOS TMPDIR pattern: /var/folders/XX/YYY/T/ or /private/var/folders/XX/YYY/T/
|
|
// where XX is 2 chars and YYY is random string
|
|
pattern := tmpdirPatternRegex
|
|
if !pattern.MatchString(tmpdir) {
|
|
return []string{}
|
|
}
|
|
|
|
// Remove trailing /T or /T/
|
|
parent := strings.TrimSuffix(tmpdir, "/")
|
|
parent = strings.TrimSuffix(parent, "/T")
|
|
|
|
// Return both /var/ and /private/var/ versions
|
|
if strings.HasPrefix(parent, "/private/var/") {
|
|
// Already has /private prefix
|
|
withoutPrivate := strings.Replace(parent, "/private", "", 1)
|
|
return []string{parent, withoutPrivate}
|
|
} else if strings.HasPrefix(parent, "/var/") {
|
|
// Missing /private prefix
|
|
withPrivate := "/private" + parent
|
|
return []string{parent, withPrivate}
|
|
}
|
|
|
|
return []string{parent}
|
|
}
|