sandbox

package

v0.3.0 Latest Latest Go to latest Published: Oct 29, 2026 License: Apache-2.0 Imports: 19 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/DavidGodefroid/lockfile

Links

Open Source Insights

Documentation ¶

Rendered for

Overview ¶

Package sandbox runs one plugin binary on one input file under Landlock, seccomp-bpf and rlimits, and turns what it produced into a pluginspec.Outcome.

The console re-executes itself as a trampoline (os.Args[1] == "__sandbox"), which restricts itself and then execs the plugin. The plugin gets: stdin /dev/null, the input as read-only fd 3, stdout read up to 3 bytes, stderr counted and discarded, an environment holding only LOCKFILE_PLUGIN_PROTOCOL=1, cwd /. It may execute nothing but itself, open no path, and create no socket. There is no unsandboxed fallback.

Index ¶

Constants
Variables
func Main()
func Probe() (landlockABI int, seccompOK bool, err error)
type Report
- func Run(ctx context.Context, s Spec) (pluginspec.Outcome, Report, error)
type Spec

Constants ¶

View Source

const (
	DefaultTimeout = 30 * time.Second
	DefaultMemory  = 1 << 30
)

Defaults applied to zero fields of Spec.Limits.

Variables ¶

View Source

var ErrUnsupported = errors.New("sandbox_unavailable")

ErrUnsupported is returned when the kernel or platform cannot sandbox plugins. Its text is the agent code for it.

Functions ¶

func Main ¶

func Main()

Main must be the first call in main() of any binary that uses Run (the console, and test binaries via TestMain). In a normal process it returns at once. In the trampoline it restricts the process and executes the plugin; it never returns.

func Probe ¶

func Probe() (landlockABI int, seccompOK bool, err error)

Probe reports the Landlock ABI and seccomp support of this kernel, for doctor. err is ErrUnsupported when plugins cannot run here.

Types ¶

type Report ¶

type Report struct {
	PID         int
	StderrBytes int64
	ExitCode    int
	Signal      string
	Duration    time.Duration
}

Report describes a run for the audit. It is never shown to the agent.

func Run ¶

func Run(ctx context.Context, s Spec) (pluginspec.Outcome, Report, error)

Run executes s.Binary on s.Input in the sandbox. The returned error is a console-side failure (the sandbox could not be set up, or ctx was cancelled); everything the plugin does, including dying, is in the Outcome.

type Spec ¶

type Spec struct {
	// Binary is the plugin executable, opened (and re-hashed) by the plugin
	// store. The trampoline executes this very file through its fd, so the
	// file that runs is the one that was hashed.
	Binary *os.File
	// Input is the file the plugin answers about. The plugin gets a fresh
	// read-only open of it as fd 3.
	Input  *os.File
	Limits pluginspec.Limits
}

Spec is one plugin run.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL