kobako 0.28.0 → 0.29.0

data/ext/kobako/src/runtime/filesystem/grants.rs

@@ -0,0 +1,91 @@
+//! A Sandbox's Mounts as contract Grants: refused at `mount` time and
+//! built afresh for every invocation by the same rules, each mount's
+//! block standing in for its access.
+
+use std::sync::Arc;
+
+use magnus::value::{Opaque, ReprValue};
+use magnus::{prelude::*, Error as MagnusError, RArray, RString, Ruby, Value};
+
+use kobako_runtime::filesystem::Access;
+use kobako_runtime::grant::Grant;
+use kobako_runtime::mount::{Mount, Policy};
+
+use super::{to_access, to_filesystem};
+use crate::runtime::pinned_value::PinnedValue;
+use crate::runtime::{escape, gvl};
+
+/// Refuse a Mount at `mount` time by the same rules an invocation builds
+/// it with, so a mistake raises where it was made.
+pub(in crate::runtime) fn validate_mount(
+    at: Value,
+    access: Value,
+    filesystem: Value,
+) -> Result<(), MagnusError> {
+    to_mount(at, access, filesystem).map(drop)
+}
+
+/// The Mount a Sandbox's `[at, access, filesystem]` stands for: one owner
+/// of the path, access, and Filesystem rules.
+fn to_mount(at: Value, access: Value, filesystem: Value) -> Result<Mount, MagnusError> {
+    let ruby = Ruby::get().expect("Ruby thread");
+    let at = RString::try_convert(at)?.to_string()?;
+    let access = to_access(access)?;
+    Mount::new(at, to_filesystem(filesystem)?, access)
+        .map_err(|err| MagnusError::new(ruby.exception_arg_error(), err.to_string()))
+}
+
+/// A mount's block, asked in its access's place. A block raising a
+/// StandardError refuses, so the guest's open fails and its script goes
+/// on; anything else it raises is held for the host.
+struct RubyPolicy {
+    block: Opaque<Value>,
+}
+
+impl Policy for RubyPolicy {
+    fn allows(&self, path: &str, access: Access) -> bool {
+        gvl::reenter(|| {
+            let ruby = Ruby::get().expect("Ruby handle unavailable in a mount's block");
+            let block: Value = ruby.get_inner(self.block);
+            let access = ruby.to_symbol(match access {
+                Access::Read => "read",
+                Access::ReadWrite => "read_write",
+            });
+            block
+                .funcall::<_, _, Value>("call", (ruby.str_new(path), access))
+                .map(|answer| answer.to_bool())
+                .unwrap_or_else(|error| {
+                    let _ = escape::hold(&ruby, error);
+                    false
+                })
+        })
+    }
+}
+
+/// The Grants one invocation carries, from the Sandbox's Mounts as
+/// `[at, access, filesystem, block]` entries, beside the pins keeping
+/// each Mount's filesystem and block in place while the guest may reach
+/// them; the caller holds both until the invocation returns.
+pub(in crate::runtime) fn to_grants(
+    ruby: &Ruby,
+    mounts: RArray,
+) -> Result<(Vec<Grant>, Vec<PinnedValue>), MagnusError> {
+    let mut grants = Vec::with_capacity(mounts.len());
+    let mut pins = Vec::with_capacity(mounts.len() * 2);
+    for index in 0..mounts.len() as isize {
+        let entry: RArray = mounts.entry(index)?;
+        let filesystem: Value = entry.entry(2)?;
+        pins.push(PinnedValue::new(ruby, filesystem));
+        let mount = to_mount(entry.entry(0)?, entry.entry(1)?, filesystem)?;
+        let block: Value = entry.entry(3)?;
+        grants.push(Grant::Mount(if block.is_nil() {
+            mount
+        } else {
+            pins.push(PinnedValue::new(ruby, block));
+            mount.with_policy(Arc::new(RubyPolicy {
+                block: Opaque::from(block),
+            }))
+        }));
+    }
+    Ok((grants, pins))
+}

data/ext/kobako/src/runtime/filesystem/ruby.rs

@@ -0,0 +1,400 @@
+//! A Filesystem a Host App writes in Ruby: any object answering `open`
+//! and `stat`, asked through `gvl::reenter` on every call the guest makes.
+//!
+//! Its methods take the names and shapes of Ruby's own `File`, `Dir`, and
+//! `IO`, so a Host App can hand an open call on to a real `::File`. A
+//! change method the object lacks answers as read-only; any other method
+//! it lacks answers as unsupported. A file's `EOFError` from `pread` is
+//! its end, an `Errno` the guest has a class for reaches the guest as
+//! that code, and any other `StandardError` reaches the guest as `EIO`.
+
+use magnus::value::{Opaque, ReprValue};
+use magnus::{kwargs, prelude::*, Error as MagnusError, RClass, RModule, RString, Ruby, Value};
+
+use std::sync::Arc;
+
+use kobako_runtime::filesystem::{
+    DirEntry, File, FileType, Filesystem, FilesystemError, Hold, Metadata, OpenOptions, Rename,
+};
+
+use crate::runtime::pinned_value::PinnedValue;
+use crate::runtime::{escape, gvl};
+
+/// The Ruby object behind a Mount or a Layer. Whatever holds it on the
+/// Ruby side keeps it alive and in place: the invocation pinning its
+/// Mounts, or the Overlay marking its Layers.
+pub(crate) struct RubyFilesystem {
+    object: Opaque<Value>,
+    /// The device a stat without a `dev` names, the object's own.
+    dev: u64,
+}
+
+impl RubyFilesystem {
+    /// The object as a Filesystem, when it answers `open` and `stat`.
+    pub(crate) fn from_value(value: Value) -> Option<Self> {
+        let answers = |name| value.respond_to(name, false).unwrap_or(false);
+        (answers("open") && answers("stat")).then(|| Self {
+            object: Opaque::from(value),
+            dev: Metadata::unique_device(),
+        })
+    }
+}
+
+/// Ask `object` its `name` method with the GVL held, `answer` making the
+/// call and reading what it returns before Ruby runs anything else. An
+/// object lacking the method fails as `missing`.
+fn ask<T>(
+    object: Opaque<Value>,
+    name: &str,
+    missing: FilesystemError,
+    answer: impl FnOnce(&Ruby, Value) -> Result<T, MagnusError>,
+) -> Result<T, FilesystemError> {
+    ask_or(object, name, Err(missing), answer)
+}
+
+/// As `ask`, an object lacking the method answering `missing`.
+fn ask_or<T>(
+    object: Opaque<Value>,
+    name: &str,
+    missing: Result<T, FilesystemError>,
+    answer: impl FnOnce(&Ruby, Value) -> Result<T, MagnusError>,
+) -> Result<T, FilesystemError> {
+    gvl::reenter(|| {
+        let ruby = Ruby::get().expect("Ruby handle unavailable in a Filesystem call");
+        let object: Value = ruby.get_inner(object);
+        if !object.respond_to(name, false).unwrap_or(false) {
+            return missing;
+        }
+        answer(&ruby, object).map_err(|err| match escape::hold(&ruby, err) {
+            Err(err) => to_error(err),
+            // The invocation ends before the guest reads this.
+            Ok(()) => FilesystemError::Other(String::new()),
+        })
+    })
+}
+
+/// Ask `object` a change, answering nothing more than whether it was made.
+fn change(
+    object: Opaque<Value>,
+    name: &str,
+    args: impl magnus::ArgList,
+    missing: FilesystemError,
+) -> Result<(), FilesystemError> {
+    ask(object, name, missing, |_, object| {
+        object.funcall::<_, _, Value>(name, args).map(drop)
+    })
+}
+
+/// Ask `object` a change it may lack, an object lacking `name` having
+/// nothing of its own to change, while one that answers and refuses still
+/// fails, whatever `Errno` it raises.
+fn change_if_answered(object: Opaque<Value>, name: &str) -> Result<(), FilesystemError> {
+    ask_or(object, name, Ok(()), |_, object| {
+        object.funcall::<_, _, Value>(name, ()).map(drop)
+    })
+}
+
+/// The FilesystemError the nearest `Errno` class of `err` stands for, by
+/// its POSIX name; anything else is `Other`, which reaches the guest as
+/// `EIO`.
+fn to_error(err: MagnusError) -> FilesystemError {
+    let named = err.value().and_then(|exception| {
+        exception
+            .class()
+            .ancestors()
+            .into_iter()
+            .find_map(|module| {
+                let name: Option<String> = module.funcall("name", ()).ok()?;
+                FilesystemError::from_posix_name(name?.strip_prefix("Errno::")?)
+            })
+    });
+    named.unwrap_or_else(|| FilesystemError::Other(err.to_string()))
+}
+
+/// `File::Constants` flags for `options`, read from Ruby since their
+/// values differ by platform.
+fn to_flags(ruby: &Ruby, options: &OpenOptions) -> Result<i64, MagnusError> {
+    let constants: RModule = ruby
+        .class_object()
+        .const_get::<_, RClass>("File")?
+        .const_get("Constants")?;
+    let flag = |name| constants.const_get::<_, i64>(name);
+    let mut flags = match (options.read, options.write || options.truncate) {
+        (_, false) => flag("RDONLY")?,
+        (false, true) => flag("WRONLY")?,
+        (true, true) => flag("RDWR")?,
+    };
+    if options.create || options.create_new {
+        flags |= flag("CREAT")?;
+    }
+    if options.create_new {
+        flags |= flag("EXCL")?;
+    }
+    if options.truncate {
+        flags |= flag("TRUNC")?;
+    }
+    if options.nofollow {
+        flags |= flag("NOFOLLOW")?;
+    }
+    Ok(flags)
+}
+
+fn join(dir: &str, name: &str) -> String {
+    if dir.is_empty() {
+        name.to_string()
+    } else {
+        format!("{dir}/{name}")
+    }
+}
+
+impl Filesystem for RubyFilesystem {
+    fn open(&self, path: &str, options: &OpenOptions) -> Result<Box<dyn File>, FilesystemError> {
+        ask(
+            self.object,
+            "open",
+            FilesystemError::Unsupported,
+            |ruby, fs| {
+                let file: Value = fs.funcall("open", (path, to_flags(ruby, options)?))?;
+                Ok(Box::new(RubyFile::pin(ruby, file)) as Box<dyn File>)
+            },
+        )
+    }
+
+    fn metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
+        let own_dev = self.dev;
+        ask(
+            self.object,
+            "stat",
+            FilesystemError::Unsupported,
+            |_, fs| {
+                let stat: Value = fs.funcall("stat", (path,))?;
+                let metadata = if stat.funcall::<_, _, bool>("directory?", ())? {
+                    Metadata::new(FileType::Directory, 0)
+                } else {
+                    Metadata::new(FileType::File, stat.funcall("size", ())?)
+                };
+                // A stat names its identity as `File::Stat` does; without a
+                // `dev` the Filesystem stands for a device of its own, so it
+                // shares an identity with no other Filesystem.
+                let dev = if stat.respond_to("dev", false)? {
+                    stat.funcall("dev", ())?
+                } else {
+                    own_dev
+                };
+                Ok(metadata.with_identity(dev, stat.funcall("ino", ())?))
+            },
+        )
+    }
+
+    /// A Ruby object answers `stat` alone, so it holds no links.
+    fn symlink_metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
+        self.metadata(path)
+    }
+
+    /// A Ruby object matches names exactly, as its contract asks.
+    fn stored_path(&self, path: &str) -> Result<String, FilesystemError> {
+        Ok(path.to_string())
+    }
+
+    /// A Ruby object holds no links to follow.
+    fn canonicalize_beneath(&self, _base: &str, path: &str) -> Result<String, FilesystemError> {
+        Ok(path.to_string())
+    }
+
+    /// A Ruby object holds no links a Policy needs kept from being followed.
+    fn for_policy(&self) -> Option<Arc<dyn Filesystem>> {
+        None
+    }
+
+    /// A Ruby object keeps an `ino` its own while open, as its contract
+    /// asks, so nothing is held.
+    fn hold_directory(&self, _path: &str) -> Result<Option<Hold>, FilesystemError> {
+        Ok(None)
+    }
+
+    fn read_dir(&self, path: &str) -> Result<Vec<DirEntry>, FilesystemError> {
+        let names: Vec<String> = ask(
+            self.object,
+            "children",
+            FilesystemError::Unsupported,
+            |_, fs| fs.funcall("children", (path,)),
+        )?;
+        names
+            .into_iter()
+            .map(|name| {
+                let file_type = self.metadata(&join(path, &name))?.file_type;
+                Ok(DirEntry::new(name, file_type))
+            })
+            .collect()
+    }
+
+    fn create_dir(&self, path: &str) -> Result<(), FilesystemError> {
+        change(
+            self.object,
+            "mkdir",
+            (path,),
+            FilesystemError::ReadOnlyFilesystem,
+        )
+    }
+
+    fn remove_dir(&self, path: &str) -> Result<(), FilesystemError> {
+        change(
+            self.object,
+            "rmdir",
+            (path,),
+            FilesystemError::ReadOnlyFilesystem,
+        )
+    }
+
+    fn remove_file(&self, path: &str) -> Result<(), FilesystemError> {
+        change(
+            self.object,
+            "unlink",
+            (path,),
+            FilesystemError::ReadOnlyFilesystem,
+        )
+    }
+
+    /// `rename(from, to, directory:)`: `true` moves only a directory,
+    /// `false` only a file, `nil` either. What stands at `from` meanwhile
+    /// is the object's to keep still.
+    fn rename(&self, from: &str, to: &str, rename: Rename) -> Result<(), FilesystemError> {
+        // A move the keyword cannot tell the object is refused rather than
+        // widened into one of either kind.
+        let directory = match rename {
+            Rename::Any => None,
+            Rename::File => Some(false),
+            Rename::Directory => Some(true),
+            _ => return Err(FilesystemError::Unsupported),
+        };
+        change(
+            self.object,
+            "rename",
+            (from, to, kwargs!("directory" => directory)),
+            FilesystemError::ReadOnlyFilesystem,
+        )
+    }
+
+    /// Every Invocation shares the Ruby object.
+    fn for_invocation(&self) -> Option<Arc<dyn Filesystem>> {
+        None
+    }
+}
+
+/// One file the Ruby object opened, which only the guest's descriptor
+/// refers to.
+struct RubyFile {
+    file: PinnedValue,
+    closed: bool,
+}
+
+impl RubyFile {
+    fn pin(ruby: &Ruby, file: Value) -> Self {
+        Self {
+            file: PinnedValue::new(ruby, file),
+            closed: false,
+        }
+    }
+
+    /// Ask the file to close, a file lacking `close` having nothing to
+    /// release.
+    fn release(&mut self) -> Result<(), FilesystemError> {
+        self.closed = true;
+        change_if_answered(self.file.get(), "close")
+    }
+}
+
+impl File for RubyFile {
+    fn read_at(&mut self, buf: &mut [u8], offset: u64) -> Result<usize, FilesystemError> {
+        ask(
+            self.file.get(),
+            "pread",
+            FilesystemError::Unsupported,
+            |ruby, file| {
+                // `IO#pread` raises `EOFError` at the end of a file, which reads as nothing.
+                let read: Option<RString> = match file.funcall("pread", (buf.len(), offset)) {
+                    Err(err) if err.is_kind_of(ruby.exception_eof_error()) => None,
+                    read => read?,
+                };
+                let Some(read) = read else { return Ok(0) };
+                // SAFETY: the bytes are copied out before Ruby runs again.
+                let bytes = unsafe { read.as_slice() };
+                let len = bytes.len().min(buf.len());
+                buf[..len].copy_from_slice(&bytes[..len]);
+                Ok(len)
+            },
+        )
+    }
+
+    fn write_at(&mut self, buf: &[u8], offset: u64) -> Result<usize, FilesystemError> {
+        ask(
+            self.file.get(),
+            "pwrite",
+            FilesystemError::ReadOnlyFilesystem,
+            |ruby, file| file.funcall("pwrite", (ruby.str_from_slice(buf), offset)),
+        )
+        .and_then(|written: usize| match written {
+            written if written <= buf.len() => Ok(written),
+            written => Err(FilesystemError::Other(format!(
+                "pwrite answered {written} bytes written of the {} it was handed",
+                buf.len()
+            ))),
+        })
+    }
+
+    /// The file's `append` writes all of `buf` at its end in one step and
+    /// answers where the file then ends, as `IO#pos` does after a write to
+    /// a file opened to append. A file lacking it cannot append, since its
+    /// `size` and `pwrite` are two steps another writer can land between.
+    fn append(&mut self, buf: &[u8]) -> Result<(u64, usize), FilesystemError> {
+        ask(
+            self.file.get(),
+            "append",
+            FilesystemError::Unsupported,
+            |ruby, file| file.funcall("append", (ruby.str_from_slice(buf),)),
+        )
+        .and_then(|end: u64| match end.checked_sub(buf.len() as u64) {
+            Some(at) => Ok((at, buf.len())),
+            None => Err(FilesystemError::Other(format!(
+                "append answered the file ending at {end}, before the {} bytes it wrote",
+                buf.len()
+            ))),
+        })
+    }
+
+    fn metadata(&self) -> Result<Metadata, FilesystemError> {
+        ask(
+            self.file.get(),
+            "size",
+            FilesystemError::Unsupported,
+            |_, file| Ok(Metadata::new(FileType::File, file.funcall("size", ())?)),
+        )
+    }
+
+    fn set_len(&mut self, len: u64) -> Result<(), FilesystemError> {
+        change(
+            self.file.get(),
+            "truncate",
+            (len,),
+            FilesystemError::ReadOnlyFilesystem,
+        )
+    }
+
+    /// A file lacking `fsync` has nothing of its own to flush.
+    fn sync(&mut self) -> Result<(), FilesystemError> {
+        change_if_answered(self.file.get(), "fsync")
+    }
+
+    fn close(mut self: Box<Self>) -> Result<(), FilesystemError> {
+        self.release()
+    }
+}
+
+/// A file the guest never closed is closed here, its failure discarded.
+impl Drop for RubyFile {
+    fn drop(&mut self) {
+        if !self.closed {
+            let _ = self.release();
+        }
+    }
+}