dia 1.5 → 2.0.0
Sign up to get free protection for your applications and to get access to all the features.
- data/{LICENSE → COPYING} +0 -0
- data/README.mkd +67 -0
- data/dia.gemspec +49 -0
- data/lib/dia.rb +11 -8
- data/lib/dia/application.rb +49 -0
- data/lib/dia/exception_struct.rb +7 -0
- data/lib/dia/exceptions.rb +5 -0
- data/lib/dia/functions.rb +8 -0
- data/lib/dia/profiles.rb +2 -6
- data/lib/dia/ruby_block.rb +319 -0
- data/lib/dia/shared_features.rb +91 -0
- data/test/setup.rb +5 -4
- data/test/suite/lib/dia/exception_struct.rb +40 -0
- data/test/suite/lib/dia/ruby_block.rb +561 -0
- data/test/suite/lib/dia/shared_features.rb +236 -0
- metadata +31 -42
- data/.yardopts +0 -4
- data/HACKING.md +0 -13
- data/NEWS.md +0 -61
- data/README.md +0 -170
- data/TODO.md +0 -8
- data/lib/dia/commonapi.rb +0 -7
- data/lib/dia/sandbox.rb +0 -208
- data/test/suite/check_if_sandbox_is_alive_test.rb +0 -29
- data/test/suite/exception()_test.rb +0 -55
- data/test/suite/exception_raised?_test.rb +0 -22
- data/test/suite/exceptions_test.rb +0 -12
- data/test/suite/exit_status_test.rb +0 -16
- data/test/suite/passing_parameters_to_constructer_test.rb +0 -34
- data/test/suite/run_block_in_sandbox_test.rb +0 -132
- data/test/suite/terminate_sandbox_test.rb +0 -29
|
@@ -0,0 +1,236 @@
|
|
|
1
|
+
suite('Dia::SharedFeatures') do
|
|
2
|
+
|
|
3
|
+
suite('RubyBlock') do
|
|
4
|
+
|
|
5
|
+
suite('#exit_status') do
|
|
6
|
+
|
|
7
|
+
setup do
|
|
8
|
+
@result = nil
|
|
9
|
+
end
|
|
10
|
+
|
|
11
|
+
exercise('#run is called, exits process with status of 10. ') do
|
|
12
|
+
sandbox = Dia::RubyBlock.new(Dia::Profiles::NO_INTERNET) { exit(10) }
|
|
13
|
+
sandbox.run
|
|
14
|
+
@result = sandbox.exit_status
|
|
15
|
+
end
|
|
16
|
+
|
|
17
|
+
verify('#exit_status returns 10') do
|
|
18
|
+
@result == 10
|
|
19
|
+
end
|
|
20
|
+
|
|
21
|
+
exercise('Neither #run or #run_nonblock has been called. ') do
|
|
22
|
+
sandbox = Dia::RubyBlock.new(Dia::Profiles::NO_INTERNET) { }
|
|
23
|
+
@result = sandbox.exit_status
|
|
24
|
+
end
|
|
25
|
+
|
|
26
|
+
verify('#exit_status returns nil') do
|
|
27
|
+
@result == nil
|
|
28
|
+
end
|
|
29
|
+
|
|
30
|
+
end
|
|
31
|
+
|
|
32
|
+
suite('#terminate') do
|
|
33
|
+
|
|
34
|
+
setup do
|
|
35
|
+
@result = nil
|
|
36
|
+
@sandbox = Dia::RubyBlock.new(Dia::Profiles::NO_OS_SERVICES) { $stdin.gets }
|
|
37
|
+
end
|
|
38
|
+
|
|
39
|
+
exercise('#run_nonblock is called, blocking IO performed, #terminate sent to process. ') do
|
|
40
|
+
@sandbox.run_nonblock
|
|
41
|
+
@result = @sandbox.terminate
|
|
42
|
+
end
|
|
43
|
+
|
|
44
|
+
verify('#terminate returns 1.') do
|
|
45
|
+
@result == 1
|
|
46
|
+
end
|
|
47
|
+
|
|
48
|
+
exercise('#run_nonblock is called, blocking IO performed, #terminate sent to process. ') do
|
|
49
|
+
@sandbox.run_nonblock
|
|
50
|
+
@sandbox.terminate
|
|
51
|
+
@result = @sandbox.exit_status
|
|
52
|
+
end
|
|
53
|
+
|
|
54
|
+
verify('#exit_status returns nil, or a Process PID(PID) as a Fixnum.') do
|
|
55
|
+
@result == nil || @result.class == Fixnum
|
|
56
|
+
end
|
|
57
|
+
|
|
58
|
+
exercise('#run_nonblock is called, blocking IO is performed, #terminate sent to process') do
|
|
59
|
+
@sandbox.run_nonblock
|
|
60
|
+
@sandbox.terminate
|
|
61
|
+
end
|
|
62
|
+
|
|
63
|
+
verify('#running? verifies the process is dead') do
|
|
64
|
+
@sandbox.running? == false
|
|
65
|
+
end
|
|
66
|
+
|
|
67
|
+
exercise('Neither #run or #run_nonblock has been called. ') do
|
|
68
|
+
sandbox = Dia::RubyBlock.new(Dia::Profiles::NO_INTERNET) { }
|
|
69
|
+
@result = sandbox.terminate
|
|
70
|
+
end
|
|
71
|
+
|
|
72
|
+
verify('#terminate returns nil') do
|
|
73
|
+
@result == nil
|
|
74
|
+
end
|
|
75
|
+
|
|
76
|
+
end
|
|
77
|
+
|
|
78
|
+
suite('#running?') do
|
|
79
|
+
|
|
80
|
+
setup do
|
|
81
|
+
@result = nil
|
|
82
|
+
end
|
|
83
|
+
|
|
84
|
+
exercise('#run_nonblock is called, spawned process sleeps. ') do
|
|
85
|
+
sandbox = Dia::RubyBlock.new(Dia::Profiles::NO_INTERNET) { sleep(10) }
|
|
86
|
+
sandbox.run_nonblock
|
|
87
|
+
@result = sandbox.running?
|
|
88
|
+
sandbox.terminate
|
|
89
|
+
end
|
|
90
|
+
|
|
91
|
+
verify('#running? returns true') do
|
|
92
|
+
@result == true
|
|
93
|
+
end
|
|
94
|
+
|
|
95
|
+
exercise('#run is called, process exits immediately. ') do
|
|
96
|
+
sandbox = Dia::RubyBlock.new(Dia::Profiles::NO_INTERNET) { exit }
|
|
97
|
+
sandbox.run
|
|
98
|
+
@result = sandbox.running?
|
|
99
|
+
end
|
|
100
|
+
|
|
101
|
+
verify('#running? returns false') do
|
|
102
|
+
@result == false
|
|
103
|
+
end
|
|
104
|
+
|
|
105
|
+
exercise('Neither #run or #run_nonblock has been called. ') do
|
|
106
|
+
sandbox = Dia::RubyBlock.new(Dia::Profiles::NO_INTERNET) { }
|
|
107
|
+
@result = sandbox.running?
|
|
108
|
+
end
|
|
109
|
+
|
|
110
|
+
verify('#running? returns nil') do
|
|
111
|
+
@result == nil
|
|
112
|
+
end
|
|
113
|
+
|
|
114
|
+
end
|
|
115
|
+
|
|
116
|
+
end
|
|
117
|
+
|
|
118
|
+
suite('Application') do
|
|
119
|
+
|
|
120
|
+
suite('#running?') do
|
|
121
|
+
|
|
122
|
+
setup do
|
|
123
|
+
@result = nil
|
|
124
|
+
end
|
|
125
|
+
|
|
126
|
+
exercise('#run_nonblock is called, spawned process sleeps. ') do
|
|
127
|
+
sandbox = Dia::Application.new(Dia::Profiles::NO_INTERNET, "sleep 10")
|
|
128
|
+
sandbox.run_nonblock
|
|
129
|
+
@result = sandbox.running?
|
|
130
|
+
sandbox.terminate
|
|
131
|
+
end
|
|
132
|
+
|
|
133
|
+
verify('#running? returns true') do
|
|
134
|
+
@result == true
|
|
135
|
+
end
|
|
136
|
+
|
|
137
|
+
exercise('#run is called, process exits immediately. ') do
|
|
138
|
+
sandbox = Dia::Application.new(Dia::Profiles::NO_INTERNET, "sleep 0")
|
|
139
|
+
sandbox.run
|
|
140
|
+
@result = sandbox.running?
|
|
141
|
+
end
|
|
142
|
+
|
|
143
|
+
verify('#running? returns false') do
|
|
144
|
+
@result == false
|
|
145
|
+
end
|
|
146
|
+
|
|
147
|
+
exercise('Neither #run or #run_nonblock has been called. ') do
|
|
148
|
+
sandbox = Dia::Application.new(Dia::Profiles::NO_INTERNET, "")
|
|
149
|
+
@result = sandbox.running?
|
|
150
|
+
end
|
|
151
|
+
|
|
152
|
+
verify('#running? returns nil') do
|
|
153
|
+
@result == nil
|
|
154
|
+
end
|
|
155
|
+
|
|
156
|
+
end
|
|
157
|
+
|
|
158
|
+
suite('#terminate') do
|
|
159
|
+
|
|
160
|
+
setup do
|
|
161
|
+
@result = nil
|
|
162
|
+
@sandbox = Dia::Application.new(Dia::Profiles::NO_INTERNET, "sleep 10000")
|
|
163
|
+
end
|
|
164
|
+
|
|
165
|
+
exercise('#run_nonblock is called, blocking operation performed, ' \
|
|
166
|
+
'#terminate sent to process. ') do
|
|
167
|
+
@sandbox.run_nonblock
|
|
168
|
+
@result = @sandbox.terminate
|
|
169
|
+
end
|
|
170
|
+
|
|
171
|
+
verify('#terminate returns 1.') do
|
|
172
|
+
@result == 1
|
|
173
|
+
end
|
|
174
|
+
|
|
175
|
+
exercise('#run_nonblock is called, blocking operation performed, ' \
|
|
176
|
+
'#terminate sent to process. ') do
|
|
177
|
+
@sandbox.run_nonblock
|
|
178
|
+
@sandbox.terminate
|
|
179
|
+
@result = @sandbox.exit_status
|
|
180
|
+
end
|
|
181
|
+
|
|
182
|
+
verify('#exit_status returns nil, or a Process PID(PID) as a Fixnum.') do
|
|
183
|
+
@result == nil || @result.class == Fixnum
|
|
184
|
+
end
|
|
185
|
+
|
|
186
|
+
exercise('#run_nonblock is called, blocking operation is performed, ' \
|
|
187
|
+
'#terminate sent to process') do
|
|
188
|
+
@sandbox.run_nonblock
|
|
189
|
+
@sandbox.terminate
|
|
190
|
+
end
|
|
191
|
+
|
|
192
|
+
verify('#running? verifies the process is dead') do
|
|
193
|
+
@sandbox.running? == false
|
|
194
|
+
end
|
|
195
|
+
|
|
196
|
+
exercise('Neither #run or #run_nonblock has been called. ') do
|
|
197
|
+
sandbox = Dia::Application.new(Dia::Profiles::NO_INTERNET, "sleep 0")
|
|
198
|
+
@result = sandbox.terminate
|
|
199
|
+
end
|
|
200
|
+
|
|
201
|
+
verify('#terminate returns nil') do
|
|
202
|
+
@result == nil
|
|
203
|
+
end
|
|
204
|
+
|
|
205
|
+
end
|
|
206
|
+
|
|
207
|
+
suite('#exit_status') do
|
|
208
|
+
|
|
209
|
+
setup do
|
|
210
|
+
@result = nil
|
|
211
|
+
end
|
|
212
|
+
|
|
213
|
+
exercise('#run is called, exits process with status of 10. ') do
|
|
214
|
+
sandbox = Dia::Application.new(Dia::Profiles::NO_INTERNET, "ruby -e 'exit 10'")
|
|
215
|
+
sandbox.run
|
|
216
|
+
@result = sandbox.exit_status
|
|
217
|
+
end
|
|
218
|
+
|
|
219
|
+
verify('#exit_status returns 10') do
|
|
220
|
+
@result == 10
|
|
221
|
+
end
|
|
222
|
+
|
|
223
|
+
exercise('Neither #run or #run_nonblock has been called. ') do
|
|
224
|
+
sandbox = Dia::Application.new(Dia::Profiles::NO_INTERNET, "")
|
|
225
|
+
@result = sandbox.exit_status
|
|
226
|
+
end
|
|
227
|
+
|
|
228
|
+
verify('#exit_status returns nil') do
|
|
229
|
+
@result == nil
|
|
230
|
+
end
|
|
231
|
+
|
|
232
|
+
end
|
|
233
|
+
|
|
234
|
+
end
|
|
235
|
+
|
|
236
|
+
end
|
metadata
CHANGED
|
@@ -3,9 +3,10 @@ name: dia
|
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
4
|
prerelease: false
|
|
5
5
|
segments:
|
|
6
|
-
-
|
|
7
|
-
-
|
|
8
|
-
|
|
6
|
+
- 2
|
|
7
|
+
- 0
|
|
8
|
+
- 0
|
|
9
|
+
version: 2.0.0
|
|
9
10
|
platform: ruby
|
|
10
11
|
authors:
|
|
11
12
|
- Robert Gleeson
|
|
@@ -13,7 +14,7 @@ autorequire:
|
|
|
13
14
|
bindir: bin
|
|
14
15
|
cert_chain: []
|
|
15
16
|
|
|
16
|
-
date: 2010-
|
|
17
|
+
date: 2010-07-19 00:00:00 +01:00
|
|
17
18
|
default_executable:
|
|
18
19
|
dependencies:
|
|
19
20
|
- !ruby/object:Gem::Dependency
|
|
@@ -30,24 +31,10 @@ dependencies:
|
|
|
30
31
|
version: 0.6.2
|
|
31
32
|
type: :runtime
|
|
32
33
|
version_requirements: *id001
|
|
33
|
-
- !ruby/object:Gem::Dependency
|
|
34
|
-
name: baretest
|
|
35
|
-
prerelease: false
|
|
36
|
-
requirement: &id002 !ruby/object:Gem::Requirement
|
|
37
|
-
requirements:
|
|
38
|
-
- - ">="
|
|
39
|
-
- !ruby/object:Gem::Version
|
|
40
|
-
segments:
|
|
41
|
-
- 0
|
|
42
|
-
- 2
|
|
43
|
-
- 4
|
|
44
|
-
version: 0.2.4
|
|
45
|
-
type: :development
|
|
46
|
-
version_requirements: *id002
|
|
47
34
|
- !ruby/object:Gem::Dependency
|
|
48
35
|
name: yard
|
|
49
36
|
prerelease: false
|
|
50
|
-
requirement: &
|
|
37
|
+
requirement: &id002 !ruby/object:Gem::Requirement
|
|
51
38
|
requirements:
|
|
52
39
|
- - ">="
|
|
53
40
|
- !ruby/object:Gem::Version
|
|
@@ -55,11 +42,13 @@ dependencies:
|
|
|
55
42
|
- 0
|
|
56
43
|
version: "0"
|
|
57
44
|
type: :development
|
|
58
|
-
version_requirements: *
|
|
45
|
+
version_requirements: *id002
|
|
59
46
|
description: |-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
47
|
+
Through the use of technology found on Apple's Leopard and Snow Leopard
|
|
48
|
+
operating systems, Dia can create dynamic and robust sandbox environments
|
|
49
|
+
for applications and for blocks of ruby code.
|
|
50
|
+
The Ruby API was designed to be simple, and a joy to use.
|
|
51
|
+
I hope you feel the same way :-)
|
|
63
52
|
email: rob@flowof.info
|
|
64
53
|
executables: []
|
|
65
54
|
|
|
@@ -68,21 +57,26 @@ extensions: []
|
|
|
68
57
|
extra_rdoc_files: []
|
|
69
58
|
|
|
70
59
|
files:
|
|
71
|
-
-
|
|
72
|
-
-
|
|
73
|
-
-
|
|
74
|
-
-
|
|
75
|
-
- lib/dia/commonapi.rb
|
|
60
|
+
- lib/dia/application.rb
|
|
61
|
+
- lib/dia/exception_struct.rb
|
|
62
|
+
- lib/dia/exceptions.rb
|
|
63
|
+
- lib/dia/functions.rb
|
|
76
64
|
- lib/dia/profiles.rb
|
|
77
|
-
- lib/dia/
|
|
65
|
+
- lib/dia/ruby_block.rb
|
|
66
|
+
- lib/dia/shared_features.rb
|
|
78
67
|
- lib/dia.rb
|
|
79
|
-
- .
|
|
80
|
-
-
|
|
81
|
-
|
|
68
|
+
- test/setup.rb
|
|
69
|
+
- test/suite/lib/dia/exception_struct.rb
|
|
70
|
+
- test/suite/lib/dia/ruby_block.rb
|
|
71
|
+
- test/suite/lib/dia/shared_features.rb
|
|
72
|
+
- COPYING
|
|
73
|
+
- README.mkd
|
|
74
|
+
- dia.gemspec
|
|
75
|
+
has_rdoc: yard
|
|
82
76
|
homepage:
|
|
83
77
|
licenses: []
|
|
84
78
|
|
|
85
|
-
post_install_message: "
|
|
79
|
+
post_install_message: " -------------------------------------------------------------------- \n Dia (2.0.0)\n \n Thanks for installing Dia, 2.0.0! \n\n >=2.0.0 releases include public API changes that are not backward\n compatiable with older releases. Be sure to check the docs!\n \n [Github] http://github.com/robgleeson/dia\n [API Documentation] http://yardoc.org/docs/robgleeson-dia/\n [Mailing List (new)] http://groups.google.com/group/ruby-dia\n -------------------------------------------------------------------- \n"
|
|
86
80
|
rdoc_options: []
|
|
87
81
|
|
|
88
82
|
require_paths:
|
|
@@ -107,14 +101,9 @@ rubyforge_project:
|
|
|
107
101
|
rubygems_version: 1.3.6
|
|
108
102
|
signing_key:
|
|
109
103
|
specification_version: 3
|
|
110
|
-
summary: Dia
|
|
104
|
+
summary: Through the use of technology found on Apple's Leopard and Snow Leopard operating systems, Dia can create dynamic and robust sandbox environments for applications and for blocks of ruby code. The Ruby API was designed to be simple, and a joy to use. I hope you feel the same way :-)
|
|
111
105
|
test_files:
|
|
112
106
|
- test/setup.rb
|
|
113
|
-
- test/suite/
|
|
114
|
-
- test/suite/
|
|
115
|
-
- test/suite/
|
|
116
|
-
- test/suite/exceptions_test.rb
|
|
117
|
-
- test/suite/exit_status_test.rb
|
|
118
|
-
- test/suite/passing_parameters_to_constructer_test.rb
|
|
119
|
-
- test/suite/run_block_in_sandbox_test.rb
|
|
120
|
-
- test/suite/terminate_sandbox_test.rb
|
|
107
|
+
- test/suite/lib/dia/exception_struct.rb
|
|
108
|
+
- test/suite/lib/dia/ruby_block.rb
|
|
109
|
+
- test/suite/lib/dia/shared_features.rb
|
data/.yardopts
DELETED
data/HACKING.md
DELETED
|
@@ -1,13 +0,0 @@
|
|
|
1
|
-
## Coding style
|
|
2
|
-
* Abide by the "80 Column Rule" when it is practical.
|
|
3
|
-
* methods should be identified by parenthesis all the time - foo(), bar(1,2,3).
|
|
4
|
-
|
|
5
|
-
## Git policy
|
|
6
|
-
* "master" should always be in a _working state_.
|
|
7
|
-
* Pre releases should never be merged into "master", but should live in
|
|
8
|
-
experimental instead.
|
|
9
|
-
* The experimental branch is the _one and only_ gateway to being merged into
|
|
10
|
-
master .. and topic branches should branch off from "experimental".
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
data/NEWS.md
DELETED
|
@@ -1,61 +0,0 @@
|
|
|
1
|
-
## NEWS
|
|
2
|
-
|
|
3
|
-
### 1.5
|
|
4
|
-
* Added Dia::Sandbox#exit_status()
|
|
5
|
-
* Added Dia::Sandbox#exception_raised?().
|
|
6
|
-
* Added Dia::Sandbox#exception()
|
|
7
|
-
* Fixed a small bug introduced in 1.5.pre - a typo, only encountered if
|
|
8
|
-
Dia::SandboxException was raised.
|
|
9
|
-
* Dia::Sandbox#running?, Dia::Sandbox#exit_status, and Dia::Sandbox#terminate
|
|
10
|
-
will return nil if you call them before calling Dia::Sandbox#run().
|
|
11
|
-
* Dia::Sandbox#run was not returning the PID of the process running under a
|
|
12
|
-
sandbox like told in the documentation - it is now.
|
|
13
|
-
|
|
14
|
-
### 1.4
|
|
15
|
-
* A typo broke support for launching applications in a sandbox.
|
|
16
|
-
(Bug affects 1.3 and all the 1.4 *pre* releases)
|
|
17
|
-
* Mac OSX 10.5 reported as working! (Bug fix)
|
|
18
|
-
Many thanks to Josh Creek for reporting and helping me debug this bug.
|
|
19
|
-
* Use ffi\_lib() to explicitly load the dynamic library "sandbox", or "System"
|
|
20
|
-
* Depend explicitly on FFI v0.6.2
|
|
21
|
-
* Dia::Sandbox#run accepts a variable amount of arguments that will be passed
|
|
22
|
-
onto the block supplied to the constructer.
|
|
23
|
-
* Added "test/\*\*/*.rb" to the gem specification as test files..
|
|
24
|
-
|
|
25
|
-
### 1.3
|
|
26
|
-
* Added Dia::Sandbox#running? to check if a process running a sandbox is alive
|
|
27
|
-
or not.
|
|
28
|
-
* Dia::Sandbox only exposes its instance variables through getters now.
|
|
29
|
-
No more setters.
|
|
30
|
-
* Dia::Sandbox#app_path is now Dia::Sandbox#app
|
|
31
|
-
* Removed run\_with\_block in favor of passing a block to the constructer.
|
|
32
|
-
Dia::Sandbox#run is used to execute a block or an application now,
|
|
33
|
-
but only one or the other may be supplied to the constructer.
|
|
34
|
-
* Removed Dia::SandBox in favor of Dia::Sandbox.
|
|
35
|
-
* Added "has_rdoc = 'yard'" to the gem spec.
|
|
36
|
-
* Added ".yardopts" to the list of files in the gem spec.
|
|
37
|
-
* SandBoxException becomes SandboxException.
|
|
38
|
-
|
|
39
|
-
### 1.2
|
|
40
|
-
* I've decided to use Dia::Sandbox instead of Dia::SandBox but it won't
|
|
41
|
-
be removed until 1.3 .. (Deprecated for 1.2)
|
|
42
|
-
* I've decided to remove the explicit exit() call in a sandbox spawned with
|
|
43
|
-
run\_with\_block .. (Introduced in 1.1 Final)
|
|
44
|
-
* Added Dia::Sandbox#terminate for terminating a sandbox.
|
|
45
|
-
* Process.detach(*sandbox pid*) is used in the parent process that spawns a
|
|
46
|
-
sandbox to avoid collecting zombies ..
|
|
47
|
-
|
|
48
|
-
### 1.1 (final)
|
|
49
|
-
* Dia::SandBox#run\_with\_block will exit the child process spawned by itself
|
|
50
|
-
incase the user forgets to ..
|
|
51
|
-
* Added some tests for Dia::Sandbox.new#run\_with\_block ..
|
|
52
|
-
We ain't got full coverage but we're getting there.
|
|
53
|
-
* A person reported that ffi 0.6.0 does not work with dia ..
|
|
54
|
-
Supplied an explicit dependency on ffi 0.5.4 until I figure it out.
|
|
55
|
-
* You can run a block of ruby under a sandbox now but I had to change the order
|
|
56
|
-
of arguments in the constructer ..
|
|
57
|
-
First argument is the profile, and (optionally) the second is the application
|
|
58
|
-
path.
|
|
59
|
-
If you're running a block of ruby, you can forget about the second.
|
|
60
|
-
* I documented my methods!
|
|
61
|
-
|
data/README.md
DELETED
|
@@ -1,170 +0,0 @@
|
|
|
1
|
-
## "Dia"
|
|
2
|
-
|
|
3
|
-
"Dia" allows you to sandbox an application or block of ruby on the OSX platform by restricting what access to
|
|
4
|
-
Operating System resources they can have.
|
|
5
|
-
|
|
6
|
-
## How it is done
|
|
7
|
-
It uses the FFI library, and the features exposed by the sandbox header on OSX.
|
|
8
|
-
|
|
9
|
-
## What restrictions can you apply?
|
|
10
|
-
|
|
11
|
-
Restrictions are applied through a "Profile" that is the first argument to `Dia::Sandbox.new`.
|
|
12
|
-
There are five profiles in total that you can choose from out-of-the-box:
|
|
13
|
-
|
|
14
|
-
* No internet access
|
|
15
|
-
Using the profile Dia::Profiles::NO_INTERNET.
|
|
16
|
-
|
|
17
|
-
* No network access of any kind
|
|
18
|
-
Using the profile Dia::Profiles::NO_NETWORKING.
|
|
19
|
-
|
|
20
|
-
* No file system writes
|
|
21
|
-
Using the profile Dia::Profiles::NO_FILESYSTEM_WRITE.
|
|
22
|
-
|
|
23
|
-
* No file system writes, excluding writing to /tmp
|
|
24
|
-
Using the profile Dia::Profiles::NO_FILESYSTEM_WRITE_EXCEPT_TMP.
|
|
25
|
-
|
|
26
|
-
* No OS services at all(No internet, No Networking, No File I/O)
|
|
27
|
-
Using the profile Dia::Profiles::NO_OS_SERVICES.
|
|
28
|
-
|
|
29
|
-
_See Below_ for examples.
|
|
30
|
-
|
|
31
|
-
## Examples
|
|
32
|
-
|
|
33
|
-
**Running FireFox under a sandbox**
|
|
34
|
-
|
|
35
|
-
This example demonstrates how you would sandbox an application, in this example, 'FireFox'.
|
|
36
|
-
If you try this example yourself, you will see that FireFox cannot visit any websites on the internet.
|
|
37
|
-
|
|
38
|
-
require 'rubygems'
|
|
39
|
-
require 'dia'
|
|
40
|
-
|
|
41
|
-
sandbox = Dia::Sandbox.new(Dia::Profiles::NO_INTERNET, "/Applications/Firefox.app/Contents/MacOS/firefox-bin")
|
|
42
|
-
sandbox.run
|
|
43
|
-
puts "Launched #{sandbox.app} with a pid of #{sandbox.pid} using the profile #{sandbox.profile}"
|
|
44
|
-
|
|
45
|
-
**Running Ruby under a sandbox**
|
|
46
|
-
|
|
47
|
-
This example demonstrates how you would sandbox a block of ruby code.
|
|
48
|
-
In this example, the block of ruby code tries to access the internet but the profile(Dia::Profiles::NO_INTERNET) doesn't
|
|
49
|
-
allow this block of ruby to contact the internet and an exception is raised(in a child process - your app will continute to
|
|
50
|
-
execute normally).
|
|
51
|
-
|
|
52
|
-
require 'rubygems'
|
|
53
|
-
require 'dia'
|
|
54
|
-
require 'net/http'
|
|
55
|
-
require 'open-uri'
|
|
56
|
-
|
|
57
|
-
sandbox = Dia::Sandbox.new(Dia::Profiles::NO_INTERNET) do
|
|
58
|
-
open(URI.parse('http://www.google.com')).read
|
|
59
|
-
end
|
|
60
|
-
sandbox.run
|
|
61
|
-
|
|
62
|
-
**Terminating a sandbox**
|
|
63
|
-
|
|
64
|
-
Sometimes we might want to stop a sandbox from running any longer. `Dia::Sandbox#terminate` is provided to
|
|
65
|
-
terminate a sandbox - in this example, FireFox is running under a sandboxed environment and terminated after
|
|
66
|
-
running for 5 seconds.
|
|
67
|
-
|
|
68
|
-
require 'rubygems'
|
|
69
|
-
require 'dia'
|
|
70
|
-
sandbox = Dia::Sandbox.new(Dia::Profiles::NO_INTERNET, "/Applications/Firefox.app/Contents/MacOS/firefox-bin")
|
|
71
|
-
sandbox.run
|
|
72
|
-
sleep(5)
|
|
73
|
-
sandbox.terminate
|
|
74
|
-
|
|
75
|
-
**Checking if a sandbox is alive**
|
|
76
|
-
|
|
77
|
-
If you need to check if a sandbox you have spawned is still running, you can use the `Dia::Sandbox#running?` method.
|
|
78
|
-
|
|
79
|
-
require 'rubygems'
|
|
80
|
-
require 'dia'
|
|
81
|
-
sandbox = Dia::Sandbox.new(Dia::Profiles::NO_OS_SERVICES) do
|
|
82
|
-
sleep(20)
|
|
83
|
-
end
|
|
84
|
-
|
|
85
|
-
sandbox.run
|
|
86
|
-
puts sandbox.running? # => true
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
**Collecting the exit status of a sandbox**
|
|
90
|
-
|
|
91
|
-
The sandbox environment is run in a child process, and you can collect its
|
|
92
|
-
exit status through the #exit_status() method. This method is only available
|
|
93
|
-
from 0.5.pre onwards.
|
|
94
|
-
|
|
95
|
-
require 'rubygems'
|
|
96
|
-
require 'dia'
|
|
97
|
-
sandbox = Dia::Sandbox.new(Dia::Profiles::NO_OS_SERVICES) do
|
|
98
|
-
exit(10)
|
|
99
|
-
end
|
|
100
|
-
|
|
101
|
-
sandbox.run()
|
|
102
|
-
sandbox.exit_status() # => 10
|
|
103
|
-
|
|
104
|
-
**Accessing an exception raised in a sandbox**
|
|
105
|
-
|
|
106
|
-
Since 1.5, an exception raised in a sandbox can be accessed from the parent
|
|
107
|
-
process. This only works as long as you don't try to capture the exception
|
|
108
|
-
raised in a block by yourself or if you do, you re-raise the exception after
|
|
109
|
-
capturing it so Dia can forward the exception to the parent process.
|
|
110
|
-
|
|
111
|
-
require 'rubygems'
|
|
112
|
-
require 'dia'
|
|
113
|
-
sandbox = Dia::Sandbox.new(Dia::Profiles::NO_OS_SERVICES) do
|
|
114
|
-
raise()
|
|
115
|
-
end
|
|
116
|
-
|
|
117
|
-
sandbox.run()
|
|
118
|
-
sleep(0.1) # Let the parent receive the exception.
|
|
119
|
-
# Only neccesary for scenarios where an exception is raised
|
|
120
|
-
# rather quickly.
|
|
121
|
-
|
|
122
|
-
puts sandbox.exception().class # prints "RuntimeError"
|
|
123
|
-
|
|
124
|
-
**Checking if an exception has been raised in a sandbox**
|
|
125
|
-
|
|
126
|
-
Since 1.5, Sandbox#exception_raised?() is available for checking if a block of
|
|
127
|
-
ruby code running under a sandbox has raised an exception.
|
|
128
|
-
|
|
129
|
-
require 'rubygems'
|
|
130
|
-
require 'dia'
|
|
131
|
-
|
|
132
|
-
require 'rubygems'
|
|
133
|
-
require 'dia'
|
|
134
|
-
sandbox = Dia::Sandbox.new(Dia::Profiles::NO_OS_SERVICES) do
|
|
135
|
-
raise()
|
|
136
|
-
end
|
|
137
|
-
|
|
138
|
-
sandbox.run()
|
|
139
|
-
sleep(0.1) # Let the parent receive the exception.
|
|
140
|
-
# Only neccesary for scenarios where an exception is raised
|
|
141
|
-
# rather quickly.
|
|
142
|
-
|
|
143
|
-
sandbox.exception_raised?() # => true
|
|
144
|
-
|
|
145
|
-
`#exception()` & `#exception_raised?()` can only be applied to Ruby blocks. For
|
|
146
|
-
the 2.0 release, a redesign is planned that will fix this issue, as well as
|
|
147
|
-
data encapsulation issues(ie: @app shouldn't belong to a class that doesn't make
|
|
148
|
-
use of it, which is the case if you're sandboxing a ruby block).
|
|
149
|
-
|
|
150
|
-
.. Please see the yardoc [documentation](http://yardoc.org/docs/robgleeson-Dia) for more in-depth coverage of these methods,
|
|
151
|
-
in particular the documentation for the `Dia::Sandbox` class.
|
|
152
|
-
|
|
153
|
-
## Install
|
|
154
|
-
|
|
155
|
-
It's available at gemcutter:
|
|
156
|
-
|
|
157
|
-
`gem install dia`
|
|
158
|
-
|
|
159
|
-
## Bugs
|
|
160
|
-
|
|
161
|
-
No known bugs right now. [Found a bug?](http://github.com/robgleeson/dia/issues).
|
|
162
|
-
|
|
163
|
-
## Contact
|
|
164
|
-
|
|
165
|
-
* IRC
|
|
166
|
-
irc.freenode.net/#flowof.info as 'robgleeson'
|
|
167
|
-
|
|
168
|
-
* Mail
|
|
169
|
-
rob [at] flowof.info
|
|
170
|
-
|