exec_sandbox 0.2.0 → 0.2.1

data/Gemfile

@@ -8,10 +8,11 @@ gem 'ffi', '>= 1.0.11'
 # Include everything needed to run rake, tests, features, etc.
 group :development do
   gem 'rdoc', '>= 3.10'
-  gem 'rspec', '>= 2.6.0'
-  gem 'yard', '>= 0.7.2'
+  gem 'rspec', '>= 2.8.0'
+  gem 'yard', '>= 0.7.5'
   gem 'yard-rspec', '>= 0.1'
   gem 'bundler', '>= 1.0.21'
-  gem 'jeweler', '>= 1.6.4'
-  gem 'rcov', '>= 0'
+  gem 'jeweler', '>= 1.8.3'
+  gem 'rcov', '>= 0', :platform => [:mri_18]
+  gem 'simplecov', '>= 0', :platform => [:mri_19]
 end

data/Gemfile.lock

@@ -4,24 +4,30 @@ GEM
     diff-lcs (1.1.3)
     ffi (1.0.11)
     git (1.2.5)
-    jeweler (1.6.4)
+    jeweler (1.8.3)
       bundler (~> 1.0)
       git (>= 1.2.5)
       rake
-    json (1.6.3)
+      rdoc
+    json (1.6.5)
+    multi_json (1.0.4)
     rake (0.9.2.2)
-    rcov (0.9.11)
+    rcov (1.0.0)
     rdoc (3.12)
       json (~> 1.4)
-    rspec (2.7.0)
-      rspec-core (~> 2.7.0)
-      rspec-expectations (~> 2.7.0)
-      rspec-mocks (~> 2.7.0)
-    rspec-core (2.7.1)
-    rspec-expectations (2.7.0)
+    rspec (2.8.0)
+      rspec-core (~> 2.8.0)
+      rspec-expectations (~> 2.8.0)
+      rspec-mocks (~> 2.8.0)
+    rspec-core (2.8.0)
+    rspec-expectations (2.8.0)
       diff-lcs (~> 1.1.2)
-    rspec-mocks (2.7.0)
-    yard (0.7.4)
+    rspec-mocks (2.8.0)
+    simplecov (0.5.4)
+      multi_json (~> 1.0.3)
+      simplecov-html (~> 0.5.3)
+    simplecov-html (0.5.3)
+    yard (0.7.5)
     yard-rspec (0.1)
       yard
 
@@ -31,9 +37,10 @@ PLATFORMS
 DEPENDENCIES
   bundler (>= 1.0.21)
   ffi (>= 1.0.11)
-  jeweler (>= 1.6.4)
+  jeweler (>= 1.8.3)
   rcov
   rdoc (>= 3.10)
-  rspec (>= 2.6.0)
-  yard (>= 0.7.2)
+  rspec (>= 2.8.0)
+  simplecov
+  yard (>= 0.7.5)
   yard-rspec (>= 0.1)

data/VERSION

@@ -1 +1 @@
-0.2.0
+0.2.1

data/exec_sandbox.gemspec

@@ -5,11 +5,11 @@
 
 Gem::Specification.new do |s|
   s.name = "exec_sandbox"
-  s.version = "0.2.0"
+  s.version = "0.2.1"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Victor Costan"]
-  s.date = "2011-12-20"
+  s.date = "2012-02-09"
   s.description = "Temporary users and groups, rlimits"
   s.email = "costan@gmail.com"
   s.extra_rdoc_files = [
@@ -50,7 +50,7 @@ Gem::Specification.new do |s|
   s.homepage = "http://github.com/pwnall/exec_sandbox"
   s.licenses = ["MIT"]
   s.require_paths = ["lib"]
-  s.rubygems_version = "1.8.12"
+  s.rubygems_version = "1.8.15"
   s.summary = "Run foreign binaries using POSIX sandboxing features"
 
   if s.respond_to? :specification_version then
@@ -59,31 +59,34 @@ Gem::Specification.new do |s|
     if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
       s.add_runtime_dependency(%q<ffi>, [">= 1.0.11"])
       s.add_development_dependency(%q<rdoc>, [">= 3.10"])
-      s.add_development_dependency(%q<rspec>, [">= 2.6.0"])
-      s.add_development_dependency(%q<yard>, [">= 0.7.2"])
+      s.add_development_dependency(%q<rspec>, [">= 2.8.0"])
+      s.add_development_dependency(%q<yard>, [">= 0.7.5"])
       s.add_development_dependency(%q<yard-rspec>, [">= 0.1"])
       s.add_development_dependency(%q<bundler>, [">= 1.0.21"])
-      s.add_development_dependency(%q<jeweler>, [">= 1.6.4"])
+      s.add_development_dependency(%q<jeweler>, [">= 1.8.3"])
       s.add_development_dependency(%q<rcov>, [">= 0"])
+      s.add_development_dependency(%q<simplecov>, [">= 0"])
     else
       s.add_dependency(%q<ffi>, [">= 1.0.11"])
       s.add_dependency(%q<rdoc>, [">= 3.10"])
-      s.add_dependency(%q<rspec>, [">= 2.6.0"])
-      s.add_dependency(%q<yard>, [">= 0.7.2"])
+      s.add_dependency(%q<rspec>, [">= 2.8.0"])
+      s.add_dependency(%q<yard>, [">= 0.7.5"])
       s.add_dependency(%q<yard-rspec>, [">= 0.1"])
       s.add_dependency(%q<bundler>, [">= 1.0.21"])
-      s.add_dependency(%q<jeweler>, [">= 1.6.4"])
+      s.add_dependency(%q<jeweler>, [">= 1.8.3"])
       s.add_dependency(%q<rcov>, [">= 0"])
+      s.add_dependency(%q<simplecov>, [">= 0"])
     end
   else
     s.add_dependency(%q<ffi>, [">= 1.0.11"])
     s.add_dependency(%q<rdoc>, [">= 3.10"])
-    s.add_dependency(%q<rspec>, [">= 2.6.0"])
-    s.add_dependency(%q<yard>, [">= 0.7.2"])
+    s.add_dependency(%q<rspec>, [">= 2.8.0"])
+    s.add_dependency(%q<yard>, [">= 0.7.5"])
     s.add_dependency(%q<yard-rspec>, [">= 0.1"])
     s.add_dependency(%q<bundler>, [">= 1.0.21"])
-    s.add_dependency(%q<jeweler>, [">= 1.6.4"])
+    s.add_dependency(%q<jeweler>, [">= 1.8.3"])
     s.add_dependency(%q<rcov>, [">= 0"])
+    s.add_dependency(%q<simplecov>, [">= 0"])
   end
 end
 

data/lib/exec_sandbox/sandbox.rb

@@ -84,7 +84,7 @@ class Sandbox
   # @param [Array, String] command to be run; use an array to pass arguments to
   #                        the command
   # @param [Hash] options stdin / stdout redirection and resource limitations
-  # @option options [Hash] :limits see {Spawn#set_limits}
+  # @option options [Hash] :limits see {Spawn.limit_resources}
   # @option options [String] :in path to a file that is set as the child's stdin
   # @option options [String] :in_data contents to be written to a pipe that is
   #     set as the child's stdin; if neither :in nor :in_data are specified, the
@@ -95,7 +95,7 @@ class Sandbox
   # @option options [Symbol] :err :none closes the child's stderr, :out
   #     redirects the child's stderr to stdout; by default, the child's stderr
   #     is the same as the parent's
-  # @return [Hash] the result of {Wait4#wait4}, plus an :out_data key if no :out
+  # @return [Hash] the result of {Wait4.wait4}, plus an :out_data key if no :out
   #                option is given  
   def run(command, options = {})
     limits = options[:limits] || {}
@@ -172,6 +172,8 @@ end  # module ExecSandbox::Sandbox
   #
   # @param [String] admin the name of a user who will be able to peek into the
   #                       sandbox (optional)
+  # @yieldparam [Sandbox] sandbox a Sandbox instance that will be automatically
+  #                               destroyed after the block returns
   # @return the value returned from the block passed to this method
   def self.use(admin = Etc.getlogin, &block)
     sandbox = ExecSandbox::Sandbox.new admin
@@ -190,7 +192,7 @@ end  # module ExecSandbox::Sandbox
   #
   # @param [String] admin the name of a user who will be able to peek into the
   #                       sandbox (optional)
-  # @return the value returned from the block passed to this method
+  # @return [Sandbox] the newly created sandbox
   def self.open(admin = Etc.getlogin)
     ExecSandbox::Sandbox.new admin
   end

data/lib/exec_sandbox/spawn.rb

@@ -82,8 +82,7 @@ module Spawn
       begin
         Process::Sys.setresgid principal[:gid], principal[:gid], principal[:gid]
       rescue NotImplementedError
-        Process.gid = principal[:gid]
-        Process.egid = principal[:gid]
+        Process::Sys.setgid principal[:gid]
       end
     end
     if principal[:uid]
@@ -96,8 +95,7 @@ module Spawn
       begin
         Process::Sys.setresuid principal[:uid], principal[:uid], principal[:uid]
       rescue NotImplementedError
-        Process.uid = principal[:uid]
-        Process.euid = principal[:uid]
+        Process::Sys.setuid principal[:uid]
       end
     end
   end
@@ -137,8 +135,11 @@ module Spawn
                                                 limits[:open_files]
     end
     if limits[:data]
+      Process.setrlimit Process::RLIMIT_AS, limits[:data], limits[:data]
       Process.setrlimit Process::RLIMIT_DATA, limits[:data], limits[:data]
       Process.setrlimit Process::RLIMIT_STACK, limits[:data], limits[:data]
+      Process.setrlimit Process::RLIMIT_MEMLOCK, limits[:data], limits[:data]
+      Process.setrlimit Process::RLIMIT_RSS, limits[:data], limits[:data]
     end
   end
   

data/spec/exec_sandbox/spawn_spec.rb

@@ -227,11 +227,11 @@ describe ExecSandbox::Spawn do
       File.unlink(@temp_path) if File.exist?(@temp_path)
     end
     
-    describe 'buffer.rb' do
+    describe 'buffer.rb with 512 megs' do
       describe 'without limitations' do
         before do
           pid = ExecSandbox::Spawn.spawn [bin_fixture(:buffer), @temp_path,
-              (100 * 1024 * 1024).to_s], {:err => STDERR}, {}, {}
+              (512 * 1024 * 1024).to_s], {:err => STDERR}, {}, {}
           @status = ExecSandbox::Wait4.wait4 pid
         end
 
@@ -239,15 +239,15 @@ describe ExecSandbox::Spawn do
           @status[:exit_code].should == 0
         end
         
-        it 'should output 100 megs' do
-          File.stat(@temp_path).size.should == 100 * 1024 * 1024
+        it 'should output 512 megs' do
+          File.stat(@temp_path).size.should == 512 * 1024 * 1024
         end
       end
       
-      describe 'with memory limitation' do
+      describe 'with 256mb memory limitation' do
         before do
           pid = ExecSandbox::Spawn.spawn [bin_fixture(:buffer), @temp_path,
-              (100 * 1024 * 1024).to_s], {}, {}, {:data => 64 * 1024 * 1024}
+              (512 * 1024 * 1024).to_s], {}, {}, {:data => 256 * 1024 * 1024}
           @status = ExecSandbox::Wait4.wait4 pid
         end
         
@@ -260,10 +260,11 @@ describe ExecSandbox::Spawn do
         end
       end
       
-      describe 'with output limitation' do
+      describe 'with 256mb output limitation' do
         before do
           pid = ExecSandbox::Spawn.spawn [bin_fixture(:buffer), @temp_path,
-              (100 * 1024 * 1024).to_s], {}, {}, {:file_size => 8 * 1024 * 1024}
+              (512 * 1024 * 1024).to_s], {}, {},
+              {:file_size => 64 * 1024 * 1024}
           @status = ExecSandbox::Wait4.wait4 pid
         end
         
@@ -271,12 +272,56 @@ describe ExecSandbox::Spawn do
           @status[:exit_code].should_not == 0
         end
         
-        it 'should not output more than 16 megs' do
-          File.stat(@temp_path).size.should <= 16 * 1024 * 1024
+        it 'should not output more than 256 megs' do
+          File.stat(@temp_path).size.should <= 256 * 1024 * 1024
         end
       end
     end
     
+    describe 'buffer.rb with 128 megs' do
+      shared_examples_for 'working' do
+        it 'should not crash' do
+          @status[:exit_code].should == 0
+        end
+        
+        it 'should output 128 megs' do
+          File.stat(@temp_path).size.should == 128 * 1024 * 1024
+        end
+      end
+      
+      describe 'without limitations' do
+        before do
+          pid = ExecSandbox::Spawn.spawn [bin_fixture(:buffer), @temp_path,
+              (128 * 1024 * 1024).to_s], {:err => STDERR}, {}, {}
+          @status = ExecSandbox::Wait4.wait4 pid
+        end
+
+        it_behaves_like 'working'
+      end
+      
+      describe 'with 256mb memory limitation' do
+        before do
+          pid = ExecSandbox::Spawn.spawn [bin_fixture(:buffer), @temp_path,
+              (128 * 1024 * 1024).to_s], {}, {}, {:data => 256 * 1024 * 1024}
+          @status = ExecSandbox::Wait4.wait4 pid
+        end
+        
+        it_behaves_like 'working'
+      end
+      
+      describe 'with 256mb output limitation' do
+        before do
+          pid = ExecSandbox::Spawn.spawn [bin_fixture(:buffer), @temp_path,
+              (128 * 1024 * 1024).to_s], {}, {},
+              {:file_size => 256 * 1024 * 1024}
+          @status = ExecSandbox::Wait4.wait4 pid
+        end
+        
+        it_behaves_like 'working'
+      end
+    end
+    
+    
     describe 'fork.rb' do
       describe 'without limitations' do
         before do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: exec_sandbox
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
   prerelease: 
 platform: ruby
 authors:
@@ -9,11 +9,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2011-12-20 00:00:00.000000000Z
+date: 2012-02-09 00:00:00.000000000Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi
-  requirement: &26627980 !ruby/object:Gem::Requirement
+  requirement: &15141280 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -21,10 +21,10 @@ dependencies:
         version: 1.0.11
   type: :runtime
   prerelease: false
-  version_requirements: *26627980
+  version_requirements: *15141280
 - !ruby/object:Gem::Dependency
   name: rdoc
-  requirement: &26627380 !ruby/object:Gem::Requirement
+  requirement: &15140420 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -32,32 +32,32 @@ dependencies:
         version: '3.10'
   type: :development
   prerelease: false
-  version_requirements: *26627380
+  version_requirements: *15140420
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &26626760 !ruby/object:Gem::Requirement
+  requirement: &15139620 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
-        version: 2.6.0
+        version: 2.8.0
   type: :development
   prerelease: false
-  version_requirements: *26626760
+  version_requirements: *15139620
 - !ruby/object:Gem::Dependency
   name: yard
-  requirement: &26626260 !ruby/object:Gem::Requirement
+  requirement: &15138880 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
-        version: 0.7.2
+        version: 0.7.5
   type: :development
   prerelease: false
-  version_requirements: *26626260
+  version_requirements: *15138880
 - !ruby/object:Gem::Dependency
   name: yard-rspec
-  requirement: &26625740 !ruby/object:Gem::Requirement
+  requirement: &15138100 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -65,10 +65,10 @@ dependencies:
         version: '0.1'
   type: :development
   prerelease: false
-  version_requirements: *26625740
+  version_requirements: *15138100
 - !ruby/object:Gem::Dependency
   name: bundler
-  requirement: &26625220 !ruby/object:Gem::Requirement
+  requirement: &15131120 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -76,21 +76,21 @@ dependencies:
         version: 1.0.21
   type: :development
   prerelease: false
-  version_requirements: *26625220
+  version_requirements: *15131120
 - !ruby/object:Gem::Dependency
   name: jeweler
-  requirement: &26624740 !ruby/object:Gem::Requirement
+  requirement: &15130400 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
-        version: 1.6.4
+        version: 1.8.3
   type: :development
   prerelease: false
-  version_requirements: *26624740
+  version_requirements: *15130400
 - !ruby/object:Gem::Dependency
   name: rcov
-  requirement: &26624240 !ruby/object:Gem::Requirement
+  requirement: &15129480 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -98,7 +98,18 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *26624240
+  version_requirements: *15129480
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: &15128580 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: *15128580
 description: Temporary users and groups, rlimits
 email: costan@gmail.com
 executables: []
@@ -151,7 +162,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: -1397950588643828772
+      hash: -4546133862782205398
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements:
@@ -160,7 +171,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 1.8.12
+rubygems_version: 1.8.15
 signing_key: 
 specification_version: 3
 summary: Run foreign binaries using POSIX sandboxing features