mxc 0.4.0 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fccd6da3c4cef2c5422949e1a28b2c38fad41a709a33db744e95c255e32c72fa
-  data.tar.gz: 165b13bffc2f44b45468a215647b054413acb392aed297d8f9325a8e9f38d707
+  metadata.gz: 3b22a8e3054e56f63421b06b11d5db03c5a4d2a78302759b069207b6f57e0881
+  data.tar.gz: 2425c817778256ec3bb937d9587f8d7513d8aa4106cd3727c9163806893b8d26
 SHA512:
-  metadata.gz: c8296fcb1dacf6434405b6e821a88f69871dc3877f05c3fa04e9140017f564aa773f43276812e9954a09335022732e20b4b88159ce63d4eca6ff58d5cea9281a
-  data.tar.gz: 9908ebc2252e66cf4d06e4d23c07fd2975943d60aa4b629c0e6b1127f0c690acbc2eab8a5955ed7bb6ec71fc803d30a82d3fb5aefe398f65a9720eb210ae897e
+  metadata.gz: ad1387eafb7076d2a18e954e94cc5641a4a7bb9be532ffbba8ad3e496ca0021f7693e41d3fd4301108454d2863c469e415f6f8c6b9a1045cbd1c0ce4e1305544
+  data.tar.gz: 200a97933411bf815af791fb136f94c53d3270ff409318e0364a78fe9a7007fcf709d7eadfcae5a59054e53a088ce9af80fc563585b07b4f58f185135b2bed23

data/Cargo.lock

@@ -593,7 +593,7 @@ dependencies = [
 
 [[package]]
 name = "mxc"
-version = "0.4.0"
+version = "0.4.1"
 dependencies = [
  "magnus",
  "mxc-sdk",
@@ -605,7 +605,7 @@ dependencies = [
 [[package]]
 name = "mxc-sdk"
 version = "1.0.0"
-source = "git+https://github.com/crmne/microsoft-mxc?rev=d57b0d1aa3a2d552001fa54ef4ac4baaa733c26d#d57b0d1aa3a2d552001fa54ef4ac4baaa733c26d"
+source = "git+https://github.com/crmne/microsoft-mxc?rev=d7ba62b299fbcd7bdd4d7876cefcd68ada9a469b#d7ba62b299fbcd7bdd4d7876cefcd68ada9a469b"
 dependencies = [
  "anyhow",
  "base64",

data/README.md

@@ -128,6 +128,8 @@ MXC.backends                   # => [#<MXC::Backend name=:bubblewrap ...>]
 
 On Windows, a single String runs through `cmd.exe` instead of `sh`. See [Running Commands](https://crmne.github.io/mxc/running-commands/#windows) and [Policies](https://crmne.github.io/mxc/policies/#windows) for what else differs.
 
+A sandbox controls files, network, and resources. It does not always hide other processes: on some backends a command can read their command lines, and on macOS the environment your application started with. [Policies](https://crmne.github.io/mxc/policies/#what-the-command-can-see-of-other-processes) lists what each backend shows.
+
 Docker blocks the namespaces Bubblewrap needs by default, so a default container runs sandboxes on Landlock. [Running in Docker](https://crmne.github.io/mxc/running-in-docker/) shows what that gives up, and the smallest set of changes that makes Bubblewrap work, with a seccomp profile and a Kamal configuration for a job role.
 
 ## Documentation

data/ext/mxc/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "mxc"
-version = "0.4.0"
+version = "0.4.1"
 edition = "2021"
 authors = ["Carmine Paolino <carmine@paolino.me>"]
 license = "MIT"
@@ -13,7 +13,7 @@ crate-type = ["cdylib"]
 magnus = "0.8.2"
 # A fork of mxc-sdk 1.0.0 that adds resource limits (microsoft/mxc#1498) and
 # a Landlock backend (microsoft/mxc#1494), until MXC releases them.
-mxc-sdk = { git = "https://github.com/crmne/microsoft-mxc", rev = "d57b0d1aa3a2d552001fa54ef4ac4baaa733c26d" }
+mxc-sdk = { git = "https://github.com/crmne/microsoft-mxc", rev = "d7ba62b299fbcd7bdd4d7876cefcd68ada9a469b" }
 rb-sys = { version = "0.9.130", features = ["stable-api-compiled-fallback"] }
 serde_json = "1"
 

data/lib/mxc/sandbox.rb

@@ -177,7 +177,8 @@ module MXC
       add_paths(:readable, paths)
     end
 
-    # Adds paths the command can read and write.
+    # Adds paths the command can read and write. A path that is also #readable is writable,
+    # whichever was added first. A readable path inside a writable one stays read-only.
     def with_writable(*paths)
       add_paths(:writable, paths)
     end
@@ -470,9 +471,11 @@ module MXC
 
     def request(arguments)
       Preflight.check!(network:, denied:, resources:, backend:)
+      readwrite = expand(writable)
       {
-        readonly: expand(readable) | library_files(arguments),
-        readwrite: expand(writable),
+        # MXC resolves a path in both lists to read-only.
+        readonly: (expand(readable) | library_files(arguments)) - readwrite,
+        readwrite:,
         denied: expand(denied) | hidden_resolver_sockets,
         environment:,
         working_directory:,

data/lib/mxc/version.rb

@@ -2,5 +2,5 @@
 
 module MXC
   # The gem version.
-  VERSION = '0.4.0'
+  VERSION = '0.4.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mxc
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
 platform: ruby
 authors:
 - Carmine Paolino