Documentation
¶
Index ¶
- func CanOverwrite(path string) (bool, error)
- func CanRead(path string) bool
- func CanStat(path string) bool
- func CatchAndForwardSignals(proc *os.Process) func()
- func CreateEmptyFile(path string, perm os.FileMode) error
- func CurrentUserHomeDir() (string, error)
- func FindExecutable(prog, pathEnv, fsRoot, cwd string) error
- func HomeDirToTilde(path string, homeDir string) string
- func IsDebianBased() bool
- func IsRootOrHomeSubPath(path string) bool
- func IsSubDir(parent, child string) bool
- func IsSubDirOrSame(parent, child string) bool
- func MkdirAll(path string) error
- func TildeToHomeDir(path string, homeDir string) string
- func ValidateRelPath(path string) error
- func ValidateRootOrHomeSubPath(path string) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CanOverwrite ¶ added in v0.1.5
CanOverwrite returns true if the current user can be able to overwrite a file located at path.
func CanRead ¶ added in v0.1.8
CanRead returns true if the current user can read the file or directory at path.
func CatchAndForwardSignals ¶ added in v0.1.5
CatchAndForwardSignals installs handlers for catchable shutdown signals. When such signal is delivered to the parent, it is forwarded to proc; if proc is still alive after 2 seconds it is killed with SIGKILL. Returns a function that should be called when process to which signals are forwarded terminates.
func CreateEmptyFile ¶ added in v0.1.8
CreateEmptyFile creates an empty file with the given permissions. It fails if the file already exists. Takes umask into account, so the actual permissions of the created file can be reduced.
func CurrentUserHomeDir ¶
CurrentUserHomeDir returns the home directory of the current user.
func FindExecutable ¶ added in v0.2.0
FindExecutable searches for an executable named prog. If the prog is relative and contains / (starts with ./, or contains any directory name), the current working directory is searched, otherwise all absolute entries of pathEnv are searched. Relative entries of pathEnv are skipped following gVisor and runc behavior.
Returns nil on success, error otherwise.
All lookups are performed the way a process that has fsRoot as its root directory would perform them: absolute symlinks are resolved relative to fsRoot and ".." components don't escape fsRoot.
pathEnv uses the PATH environment variable format - directory names delimited by ':'.
FindExecutable must be called only after the capabilities are dropped, otherwise CAP_DAC_OVERRIDE makes every file look executable.
The function is intended only for producing 'command not found error' if executable is not accessible within the sandboxed filesystem root. For this error to be consistent between gVisor and native runtime, we call FindExecutable before the sandboxed program is executed. Potential fsRoot escape in this function does not imply fsRoot escape in the actual sandbox. It may result in a command being wrongly identifed as executable, but then such command won't be accessible and will fail to execute with the sandbox activated.
func HomeDirToTilde ¶ added in v0.1.6
HomeDirToTilde replaces the homeDir prefix in path with "~". If path is not equal to or under homeDir, it is returned unchanged.
func IsDebianBased ¶
func IsDebianBased() bool
IsDebianBased returns true if the system is Debian-based by checking for the presence of /etc/debian_version file.
func IsRootOrHomeSubPath ¶
func IsSubDirOrSame ¶
IsSubDirOrSame returns true if child is a sub directory of the parent or if they are the same directory.
func MkdirAll ¶
MkdirAll is a simple wrapper over os.MkdirAll. It always uses permissions 0700 and returns verbose error which can be propagated up without adding an aditional context.
func TildeToHomeDir ¶
TildeToHomeDir replaces tilde in a path with the given homeDir path. Does not handle tildes followed by username (~bob).
func ValidateRelPath ¶
ValidateRelPath validates that path is a relative path and is normalized.
func ValidateRootOrHomeSubPath ¶
ValidateRootOrHomeSubPath validates that a path is a subpath of root or of a ~/, and is normalized.
Types ¶
This section is empty.
Source Files