sandbox

package

v0.19.13 Latest Latest Go to latest Published: Oct 24, 2026 License: MIT Imports: 6 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/OrdalieTech/orb

Documentation ¶

Rendered for

Overview ¶

Package sandbox limits filesystem effects of child commands.

Coverage is honest but partial by nature: Landlock does not mediate chmod, chown, xattr, utime, or fcntl metadata mutations, and old ABIs miss truncate. Enforcement is fail-closed: when the platform cannot sandbox, the wrapped command refuses to run (exit 126) with an actionable message instead of running unrestricted.

Index ¶

Constants
func SelfRestrict(mode Mode, root string) error
func Wrap(mode Mode, root, shell, command string, env map[string]string) (string, map[string]string)
type Files
type Mode

Constants ¶

View Source

const (
	EnvMode    = "ORB_SANDBOX_MODE"
	EnvRoot    = "ORB_SANDBOX_ROOT"
	EnvCommand = "ORB_SANDBOX_CMD"
	EnvSelf    = "ORB_SANDBOX_SELF"
	EnvShell   = "ORB_SANDBOX_SHELL"
)

Variables ¶

This section is empty.

Functions ¶

func SelfRestrict ¶

func SelfRestrict(mode Mode, root string) error

SelfRestrict installs a Landlock ruleset on the calling OS thread and its children. The caller must hold runtime.LockOSThread and exec immediately after: Landlock and no_new_privs bind to the thread, not the process.

func Wrap ¶

func Wrap(mode Mode, root, shell, command string, env map[string]string) (string, map[string]string)

Wrap replaces command without requoting it through the platform launcher. Both restrictive modes keep /dev and os.TempDir() writable so ordinary shell idioms (2>/dev/null, mktemp) work; workspace-write additionally opens root.

Types ¶

type Files ¶

type Files struct{ WritableRoots []string }

Files delegates tool writes through os.Root so symlink changes cannot escape the writable roots between authorization and the filesystem operation. Reads remain unrestricted, matching the native command sandbox.

func (Files) Access ¶

func (f Files) Access(ctx context.Context, name string) error

func (Files) MkdirAll ¶

func (f Files) MkdirAll(ctx context.Context, name string) error

func (Files) ReadFile ¶

func (f Files) ReadFile(ctx context.Context, name string) ([]byte, error)

func (Files) WriteFile ¶

func (f Files) WriteFile(ctx context.Context, name, content string) error

type Mode ¶

type Mode string

const (
	ModeReadOnly         Mode = "read-only"
	ModeWorkspaceWrite   Mode = "workspace-write"
	ModeDangerFullAccess Mode = "danger-full-access"
)

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL