miniswen 1.3.4 → 1.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d3124b6837dc7ec83d7abb8ec1a49da77b96767a0ab0e564d99b1cc639d6bf4f
-  data.tar.gz: b16c938ec5c39af746923c5814583e22ff576d357332c579ef8f7c0d9bdc73b1
+  metadata.gz: bb0210425289d60629f23be4579598a50bd5e901da6ba2c8198ba3d9cb5760a0
+  data.tar.gz: e9377f196e3342d3cc3b67cd1ff5be7af22937be9a49647872a90a9a5ff888d1
 SHA512:
-  metadata.gz: 3084347bf1ccf8c6fbcab21af5b1699ee00b30d27dc5f8dfe7610c684bf27709b47e82658ec5a4e00234ce235c27a180f532f1f520ec8613e20f6e02634c96a7
-  data.tar.gz: d7a7873f8af98236c23d32809b2361409b0f0d27a310979b93bb705feafab0d26dfac3764c4378ade8de2e56943b54f6746e258e8a675861ec93709dada0542a
+  metadata.gz: 8fbdd1b68f84eab112e32de6a8eed4d85872424cae07ae3166aa334bb924e2c00b73654d59386b22e58b4ad4125fb0405dbff3b82484495c9927e650173f1af4
+  data.tar.gz: 5f6e01261b89cc6fc048f3ea960a89eef3ce5e43b9d2d16e2758b2c8899731e3eb849a1b7bd996224b30f21c216ad7abf1baf540b3ae9036c6278531669a1d6b

data/lib/miniswen/environment.rb

@@ -10,5 +10,7 @@ module Miniswen
 
     # Execute a shell command
     def exec(cmd, timeout: nil, env: nil) = raise NotImplementedError
+
+    def stop = nil
   end
 end

data/lib/miniswen/jail.rb

@@ -1,27 +1,22 @@
 # frozen_string_literal: true
 
+require "shellwords"
+
 require "miniswen/local"
 
 module Miniswen
   # Runs every command in its own namespaces: none of the harness's environment,
   # no network, read-only system, none of its files.
   class Jail < Local
-    SETUP = <<~SH
-      set -eu
-      ip link set lo up
-      for dir in /usr /etc /opt; do mount -o bind,ro "$dir" "$dir"; done
-      for dir in /tmp /run /root; do mkdir -p "/var/lib/miniswen$dir" && mount --bind "/var/lib/miniswen$dir" "$dir"; done
-      echo ready
-      exec sleep infinity
-    SH
-
     def initialize(workdir: Dir.pwd)
       @workdir = workdir
     end
 
     def start
       _, @stdout, @stderr, @holder = Open3.popen3(
-        "unshare", "--net", "--mount", "--pid", "--fork", "--kill-child", "--mount-proc", "sh", "-c", SETUP, pgroup: true
+        ENV.to_h.slice(*container_variables),
+        "unshare", "--net", "--mount", "--pid", "--fork", "--kill-child", "--mount-proc", "sh", "-c", setup,
+        pgroup: true, unsetenv_others: true
       )
       return self if @stdout.gets == "ready\n"
 
@@ -34,6 +29,20 @@ module Miniswen
 
     private
 
+    def setup = <<~SH
+      set -eu
+      # Bring loopback up
+      ip link set lo up
+      # Make the workdir its own mount
+      mount --bind #{Shellwords.escape(@workdir)} #{Shellwords.escape(@workdir)}
+      # Make private temp dirs their own mounts
+      for dir in /tmp /run /root; do mkdir -p "/var/lib/miniswen$dir" && mount --bind "/var/lib/miniswen$dir" "$dir"; done
+      # Make everything without its own mount read-only
+      mount -o remount,bind,ro /
+      echo ready
+      exec sleep infinity
+    SH
+
     def spawn_arguments(command, env)
       [ ENV.to_h.merge(env.to_h).slice(*container_variables),
         "nsenter", "--target", @holder.pid.to_s, "--net", "--mount", "--pid=/proc/#{@holder.pid}/ns/pid_for_children", "--wd=#{@workdir}",

data/lib/miniswen/local.rb

@@ -27,8 +27,6 @@ module Miniswen
       end
     end
 
-    def stop = nil
-
     private
 
     def spawn_arguments(command, env) = [ env || {}, "sh", "-c", command ]

data/lib/miniswen/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Miniswen
-  VERSION = "1.3.4"
+  VERSION = "1.3.5"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: miniswen
 version: !ruby/object:Gem::Version
-  version: 1.3.4
+  version: 1.3.5
 platform: ruby
 authors:
 - Svyatoslav Kryukov