exec_sandbox 0.1.2 → 0.1.3

data/Gemfile

@@ -2,7 +2,7 @@ source :rubygems
 # Add dependencies required to use your gem here.
 # Example:
 #   gem 'activesupport', '>= 2.3.5'
-gem 'ffi', '>= 1.0.9'
+gem 'ffi', '>= 1.0.11'
 
 # Add dependencies to develop your gem here.
 # Include everything needed to run rake, tests, features, etc.

data/Gemfile.lock

@@ -2,26 +2,26 @@ GEM
   remote: http://rubygems.org/
   specs:
     diff-lcs (1.1.3)
-    ffi (1.0.9)
+    ffi (1.0.11)
     git (1.2.5)
     jeweler (1.6.4)
       bundler (~> 1.0)
       git (>= 1.2.5)
       rake
-    json (1.6.1)
-    rake (0.9.2)
+    json (1.6.3)
+    rake (0.9.2.2)
     rcov (0.9.11)
-    rdoc (3.10)
+    rdoc (3.12)
       json (~> 1.4)
-    rspec (2.6.0)
-      rspec-core (~> 2.6.0)
-      rspec-expectations (~> 2.6.0)
-      rspec-mocks (~> 2.6.0)
-    rspec-core (2.6.4)
-    rspec-expectations (2.6.0)
+    rspec (2.7.0)
+      rspec-core (~> 2.7.0)
+      rspec-expectations (~> 2.7.0)
+      rspec-mocks (~> 2.7.0)
+    rspec-core (2.7.1)
+    rspec-expectations (2.7.0)
       diff-lcs (~> 1.1.2)
-    rspec-mocks (2.6.0)
-    yard (0.7.2)
+    rspec-mocks (2.7.0)
+    yard (0.7.4)
     yard-rspec (0.1)
       yard
 
@@ -30,7 +30,7 @@ PLATFORMS
 
 DEPENDENCIES
   bundler (>= 1.0.21)
-  ffi (>= 1.0.9)
+  ffi (>= 1.0.11)
   jeweler (>= 1.6.4)
   rcov
   rdoc (>= 3.10)

data/VERSION

@@ -1 +1 @@
-0.1.2
+0.1.3

data/exec_sandbox.gemspec

@@ -5,11 +5,11 @@
 
 Gem::Specification.new do |s|
   s.name = "exec_sandbox"
-  s.version = "0.1.2"
+  s.version = "0.1.3"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Victor Costan"]
-  s.date = "2011-10-13"
+  s.date = "2011-12-20"
   s.description = "Temporary users and groups, rlimits"
   s.email = "costan@gmail.com"
   s.extra_rdoc_files = [
@@ -56,7 +56,7 @@ Gem::Specification.new do |s|
     s.specification_version = 3
 
     if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
-      s.add_runtime_dependency(%q<ffi>, [">= 1.0.9"])
+      s.add_runtime_dependency(%q<ffi>, [">= 1.0.11"])
       s.add_development_dependency(%q<rdoc>, [">= 3.10"])
       s.add_development_dependency(%q<rspec>, [">= 2.6.0"])
       s.add_development_dependency(%q<yard>, [">= 0.7.2"])
@@ -65,7 +65,7 @@ Gem::Specification.new do |s|
       s.add_development_dependency(%q<jeweler>, [">= 1.6.4"])
       s.add_development_dependency(%q<rcov>, [">= 0"])
     else
-      s.add_dependency(%q<ffi>, [">= 1.0.9"])
+      s.add_dependency(%q<ffi>, [">= 1.0.11"])
       s.add_dependency(%q<rdoc>, [">= 3.10"])
       s.add_dependency(%q<rspec>, [">= 2.6.0"])
       s.add_dependency(%q<yard>, [">= 0.7.2"])
@@ -75,7 +75,7 @@ Gem::Specification.new do |s|
       s.add_dependency(%q<rcov>, [">= 0"])
     end
   else
-    s.add_dependency(%q<ffi>, [">= 1.0.9"])
+    s.add_dependency(%q<ffi>, [">= 1.0.11"])
     s.add_dependency(%q<rdoc>, [">= 3.10"])
     s.add_dependency(%q<rspec>, [">= 2.6.0"])
     s.add_dependency(%q<yard>, [">= 0.7.2"])

data/lib/exec_sandbox/sandbox.rb

@@ -6,6 +6,9 @@ class Sandbox
   # The path to the sandbox's working directory.
   attr_reader :path
   
+  # The un-privileged user that execs sandboxed binaries.
+  attr_reader :user_name
+  
   # Empty sandbox.
   #
   # @param [String] admin the name of a user who will be able to peek into the
@@ -142,6 +145,17 @@ class Sandbox
   def finalize
     close
   end
+
+  # Removes temporary users created by old sandboxes.
+  #
+  # Sandboxes usually clean up after themselves. For the rare circumstances
+  # where that doesn't happen (VM crash, Ctrl+C, SIGKILL), this method finds and
+  # cleans up the temporary users created for sandboxing.
+  #
+  # @return [Array<String>] the names of the deleted users
+  def self.cleanup
+    Users.destroy_temps
+  end
 end  # module ExecSandbox::Sandbox
   
   # Creates a sandbox, yields it, and destroys it.

data/lib/exec_sandbox/users.rb

@@ -8,6 +8,8 @@ module ExecSandbox
 module Users
   # Creates an unprivileged user.
   #
+  # @param [String] prefix used at the beginning of temporary user names to
+  #                        help identify the application that created the users
   # @return [String] the user's name
   def self.temp(prefix = 'xsbx.rb')
     loop do
@@ -81,10 +83,12 @@ module Users
       
     else  # Linux
       if group_id
-        command = ['useradd', '--gid', group_id.to_s,
-                            '--no-create-home', '--no-user-group', user_name]
+        command = ['useradd', '--gid', group_id.to_s, '--no-user-group',
+                   '--no-create-home', '--system',
+                   '--comment', 'exec_sandbox.rb temporary user', user_name]
       else
-        command = ['useradd', '--no-create-home', user_name]
+        command = ['useradd', '--user-group', '--no-create-home', '--system',
+                   '--comment', 'exec_sandbox.rb temporary user', user_name]
       end
       unless Kernel.system(*command)
         raise RuntimeError, "User creation failed at #{command.inspect}!"
@@ -151,6 +155,29 @@ module Users
       end
     end  # RUBY_PLATFORM
   end
+  
+  # Finds users whose names match a String or Regexp pattern.
+  #
+  # @param [String] pattern matched against user names using ===
+  # @return [Array<String>] names of users 
+  def self.named(pattern)
+    users = []
+    Etc.passwd do |user|
+      users << user.name if pattern === user.name
+    end
+    users
+  end
+
+  # Destroys users created by temp.
+  #
+  # @param [String] prefix match the prefix given to temp
+  # @return [Array<String>] names of users that were deleted
+  def self.destroy_temps(prefix = 'xsbx.rb')
+    # Matches the names created by temp.
+    pattern = /^#{prefix}\-[0-9a-f]+\.[0-9a-f]+\.[0-9a-f]+$/
+    # Each returns the collection that it iterates over.
+    self.named(pattern).each { |name| destroy name }
+  end
 end  # module ExecSandbox::Users
   
 end  # namespace ExecSandbox

data/spec/exec_sandbox/sandbox_spec.rb

@@ -154,4 +154,24 @@ describe ExecSandbox::Sandbox do
       end
     end
   end
+  
+  describe '#cleanup' do
+    describe 'in a system with an open sandbox' do
+      before do
+        @all_users = ExecSandbox::Users.named(/.*/).sort
+        
+        @sandbox = ExecSandbox.open
+        @removed = ExecSandbox::Sandbox.cleanup
+      end
+      
+      it 'should not remove the sandbox user' do
+        ExecSandbox::Users.named(/.*/).sort.should == @all_users
+      end
+      
+      it 'should return an array with the sandbox user' do
+        @removed.should == [@sandbox.user_name]
+      end
+    end
+    
+  end
 end

data/spec/exec_sandbox/users_spec.rb

@@ -3,6 +3,7 @@ require File.expand_path(File.dirname(__FILE__) + '/../spec_helper')
 describe ExecSandbox::Users do
   let(:test_user) { 'exec_sandbox_rspec' }
   let(:test_group) { Etc.getgrgid(Etc.getpwnam(Etc.getlogin).gid).name }
+  let(:current_user) { Etc.getlogin }
   
   describe '#temp' do
     before { @user_name = ExecSandbox::Users.temp 'exsbx.rspec' }
@@ -122,4 +123,76 @@ describe ExecSandbox::Users do
       end
     end
   end
+  
+  describe '#named' do
+    describe 'with non-matching RegExp' do
+      it 'should not return any user' do
+        ExecSandbox::Users.named(/exec_sandbox_rspec/).should be_empty
+      end
+    end
+    
+    describe 'with non-matching String' do
+      it 'should not return any user' do
+        ExecSandbox::Users.named(/exec_sandbox_rspec/).should be_empty
+      end
+    end
+    
+    describe 'with the name of the current user' do
+      it 'should return the current user' do
+        ExecSandbox::Users.named(current_user).should == [current_user]
+      end
+    end
+    
+    describe 'with RegExp matching one user' do
+      before do
+        ExecSandbox::Users.create test_user, test_group
+      end      
+      after do
+        ExecSandbox::Users.destroy test_user
+      end
+      it 'should return that one user' do
+        ExecSandbox::Users.named(/exec.sandbox.rspe/).should ==
+            ['exec_sandbox_rspec']
+      end
+    end
+  end
+  
+  describe '#destroy_temps' do
+    let(:temp_prefix) { 'exsbx.rspec' }    
+
+    before do
+      @all_users = ExecSandbox::Users.named(/.*/).sort
+    end
+    
+    describe 'in a system with no temps' do
+      before do
+        @removed = ExecSandbox::Users.destroy_temps temp_prefix
+      end
+      
+      it 'should not remove any users' do
+        ExecSandbox::Users.named(/.*/).sort.should == @all_users
+      end
+      
+      it 'should return an empty array' do
+        @removed.should be_empty
+      end
+    end
+    
+    describe 'in a system with two temps' do
+      before do
+        @temp1 = ExecSandbox::Users.temp temp_prefix
+        @temp2 = ExecSandbox::Users.temp temp_prefix
+        
+        @removed = ExecSandbox::Users.destroy_temps temp_prefix
+      end
+
+      it 'should only remove the two temps' do
+        ExecSandbox::Users.named(/.*/).sort.should == @all_users
+      end
+            
+      it 'should return the two temps' do
+        @removed.sort.should == [@temp1, @temp2].sort
+      end
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: exec_sandbox
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.3
   prerelease: 
 platform: ruby
 authors:
@@ -9,22 +9,22 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2011-10-13 00:00:00.000000000Z
+date: 2011-12-20 00:00:00.000000000Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi
-  requirement: &24549880 !ruby/object:Gem::Requirement
+  requirement: &15824600 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
-        version: 1.0.9
+        version: 1.0.11
   type: :runtime
   prerelease: false
-  version_requirements: *24549880
+  version_requirements: *15824600
 - !ruby/object:Gem::Dependency
   name: rdoc
-  requirement: &24549360 !ruby/object:Gem::Requirement
+  requirement: &15824120 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -32,10 +32,10 @@ dependencies:
         version: '3.10'
   type: :development
   prerelease: false
-  version_requirements: *24549360
+  version_requirements: *15824120
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &24548820 !ruby/object:Gem::Requirement
+  requirement: &15823640 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -43,10 +43,10 @@ dependencies:
         version: 2.6.0
   type: :development
   prerelease: false
-  version_requirements: *24548820
+  version_requirements: *15823640
 - !ruby/object:Gem::Dependency
   name: yard
-  requirement: &24548320 !ruby/object:Gem::Requirement
+  requirement: &15823160 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -54,10 +54,10 @@ dependencies:
         version: 0.7.2
   type: :development
   prerelease: false
-  version_requirements: *24548320
+  version_requirements: *15823160
 - !ruby/object:Gem::Dependency
   name: yard-rspec
-  requirement: &24547800 !ruby/object:Gem::Requirement
+  requirement: &15822680 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -65,10 +65,10 @@ dependencies:
         version: '0.1'
   type: :development
   prerelease: false
-  version_requirements: *24547800
+  version_requirements: *15822680
 - !ruby/object:Gem::Dependency
   name: bundler
-  requirement: &24547220 !ruby/object:Gem::Requirement
+  requirement: &15822200 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -76,10 +76,10 @@ dependencies:
         version: 1.0.21
   type: :development
   prerelease: false
-  version_requirements: *24547220
+  version_requirements: *15822200
 - !ruby/object:Gem::Dependency
   name: jeweler
-  requirement: &24546700 !ruby/object:Gem::Requirement
+  requirement: &15821720 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -87,10 +87,10 @@ dependencies:
         version: 1.6.4
   type: :development
   prerelease: false
-  version_requirements: *24546700
+  version_requirements: *15821720
 - !ruby/object:Gem::Dependency
   name: rcov
-  requirement: &24546160 !ruby/object:Gem::Requirement
+  requirement: &15821240 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -98,7 +98,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *24546160
+  version_requirements: *15821240
 description: Temporary users and groups, rlimits
 email: costan@gmail.com
 executables: []
@@ -150,7 +150,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: -4313873554503945480
+      hash: -3240483873242314683
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements: