@sysid/sandbox-runtime-improved 0.0.56-sysid.1 → 0.0.61-sysid.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +43 -2
- package/dist/index.d.ts +3 -3
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/dist/sandbox/credential-mask-files.d.ts +72 -0
- package/dist/sandbox/credential-mask-files.d.ts.map +1 -0
- package/dist/sandbox/credential-mask-files.js +146 -0
- package/dist/sandbox/credential-mask-files.js.map +1 -0
- package/dist/sandbox/credential-sentinel.d.ts +72 -0
- package/dist/sandbox/credential-sentinel.d.ts.map +1 -0
- package/dist/sandbox/credential-sentinel.js +130 -0
- package/dist/sandbox/credential-sentinel.js.map +1 -0
- package/dist/sandbox/domain-pattern.d.ts +36 -0
- package/dist/sandbox/domain-pattern.d.ts.map +1 -0
- package/dist/sandbox/domain-pattern.js +60 -0
- package/dist/sandbox/domain-pattern.js.map +1 -0
- package/dist/sandbox/http-proxy.d.ts +32 -1
- package/dist/sandbox/http-proxy.d.ts.map +1 -1
- package/dist/sandbox/http-proxy.js +10 -2
- package/dist/sandbox/http-proxy.js.map +1 -1
- package/dist/sandbox/linux-sandbox-utils.d.ts +15 -0
- package/dist/sandbox/linux-sandbox-utils.d.ts.map +1 -1
- package/dist/sandbox/linux-sandbox-utils.js +106 -47
- package/dist/sandbox/linux-sandbox-utils.js.map +1 -1
- package/dist/sandbox/listen-in-range.d.ts +12 -0
- package/dist/sandbox/listen-in-range.d.ts.map +1 -0
- package/dist/sandbox/listen-in-range.js +43 -0
- package/dist/sandbox/listen-in-range.js.map +1 -0
- package/dist/sandbox/macos-sandbox-utils.d.ts +11 -0
- package/dist/sandbox/macos-sandbox-utils.d.ts.map +1 -1
- package/dist/sandbox/macos-sandbox-utils.js +69 -14
- package/dist/sandbox/macos-sandbox-utils.js.map +1 -1
- package/dist/sandbox/mitm-ca.d.ts +18 -2
- package/dist/sandbox/mitm-ca.d.ts.map +1 -1
- package/dist/sandbox/mitm-ca.js +49 -9
- package/dist/sandbox/mitm-ca.js.map +1 -1
- package/dist/sandbox/mitm-leaf.d.ts.map +1 -1
- package/dist/sandbox/mitm-leaf.js +24 -6
- package/dist/sandbox/mitm-leaf.js.map +1 -1
- package/dist/sandbox/mux-proxy.d.ts +59 -0
- package/dist/sandbox/mux-proxy.d.ts.map +1 -0
- package/dist/sandbox/mux-proxy.js +159 -0
- package/dist/sandbox/mux-proxy.js.map +1 -0
- package/dist/sandbox/request-filter.d.ts +11 -1
- package/dist/sandbox/request-filter.d.ts.map +1 -1
- package/dist/sandbox/request-filter.js.map +1 -1
- package/dist/sandbox/sandbox-config.d.ts +254 -25
- package/dist/sandbox/sandbox-config.d.ts.map +1 -1
- package/dist/sandbox/sandbox-config.js +200 -13
- package/dist/sandbox/sandbox-config.js.map +1 -1
- package/dist/sandbox/sandbox-manager.d.ts +4 -0
- package/dist/sandbox/sandbox-manager.d.ts.map +1 -1
- package/dist/sandbox/sandbox-manager.js +601 -194
- package/dist/sandbox/sandbox-manager.js.map +1 -1
- package/dist/sandbox/sandbox-schemas.d.ts +15 -0
- package/dist/sandbox/sandbox-schemas.d.ts.map +1 -1
- package/dist/sandbox/sandbox-utils.d.ts +42 -6
- package/dist/sandbox/sandbox-utils.d.ts.map +1 -1
- package/dist/sandbox/sandbox-utils.js +115 -27
- package/dist/sandbox/sandbox-utils.js.map +1 -1
- package/dist/sandbox/socks-proxy.d.ts +11 -5
- package/dist/sandbox/socks-proxy.d.ts.map +1 -1
- package/dist/sandbox/socks-proxy.js +13 -81
- package/dist/sandbox/socks-proxy.js.map +1 -1
- package/dist/sandbox/tls-terminate-proxy.d.ts +2 -2
- package/dist/sandbox/tls-terminate-proxy.d.ts.map +1 -1
- package/dist/sandbox/tls-terminate-proxy.js +31 -5
- package/dist/sandbox/tls-terminate-proxy.js.map +1 -1
- package/dist/sandbox/windows-sandbox-utils.d.ts +347 -11
- package/dist/sandbox/windows-sandbox-utils.d.ts.map +1 -1
- package/dist/sandbox/windows-sandbox-utils.js +437 -45
- package/dist/sandbox/windows-sandbox-utils.js.map +1 -1
- package/package.json +7 -4
- package/vendor/seccomp/build.ts +8 -30
- package/vendor/srt-win/build.ts +21 -0
- package/dist/vendor/seccomp/Dockerfile.build +0 -6
- package/dist/vendor/seccomp/arm64/apply-seccomp +0 -0
- package/dist/vendor/seccomp/build.ts +0 -91
- package/dist/vendor/seccomp/x64/apply-seccomp +0 -0
- package/dist/vendor/seccomp-src/apply-seccomp.c +0 -280
- package/dist/vendor/seccomp-src/seccomp-unix-block.c +0 -148
- package/dist/vendor/srt-win/Cargo.lock +0 -361
- package/dist/vendor/srt-win/Cargo.toml +0 -46
- package/dist/vendor/srt-win/ci/cleanup.ps1 +0 -49
- package/dist/vendor/srt-win/ci/smoke-exec.ps1 +0 -446
- package/dist/vendor/srt-win/ci/smoke.ps1 +0 -307
- package/dist/vendor/srt-win/src/job.rs +0 -102
- package/dist/vendor/srt-win/src/launch.rs +0 -732
- package/dist/vendor/srt-win/src/lib.rs +0 -20
- package/dist/vendor/srt-win/src/main.rs +0 -669
- package/dist/vendor/srt-win/src/self_protect.rs +0 -169
- package/dist/vendor/srt-win/src/sid.rs +0 -296
- package/dist/vendor/srt-win/src/token.rs +0 -341
- package/dist/vendor/srt-win/src/util.rs +0 -42
- package/dist/vendor/srt-win/src/wfp.rs +0 -992
- package/dist/vendor/srt-win/src/winsta.rs +0 -209
- package/dist/vendor/srt-win/tests/sd_access_check_matrix.rs +0 -259
- package/vendor/seccomp-src/apply-seccomp.c +0 -280
- package/vendor/seccomp-src/seccomp-unix-block.c +0 -148
- package/vendor/srt-win/Cargo.lock +0 -361
- package/vendor/srt-win/Cargo.toml +0 -46
- package/vendor/srt-win/ci/cleanup.ps1 +0 -49
- package/vendor/srt-win/ci/smoke-exec.ps1 +0 -446
- package/vendor/srt-win/ci/smoke.ps1 +0 -307
- package/vendor/srt-win/src/job.rs +0 -102
- package/vendor/srt-win/src/launch.rs +0 -732
- package/vendor/srt-win/src/lib.rs +0 -20
- package/vendor/srt-win/src/main.rs +0 -669
- package/vendor/srt-win/src/self_protect.rs +0 -169
- package/vendor/srt-win/src/sid.rs +0 -296
- package/vendor/srt-win/src/token.rs +0 -341
- package/vendor/srt-win/src/util.rs +0 -42
- package/vendor/srt-win/src/wfp.rs +0 -992
- package/vendor/srt-win/src/winsta.rs +0 -209
- package/vendor/srt-win/tests/sd_access_check_matrix.rs +0 -259
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"windows-sandbox-utils.js","sourceRoot":"","sources":["../../src/sandbox/windows-sandbox-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAGzD;;;;;;;;;;;;;;;;GAgBG;AAEH,uEAAuE;AACvE,QAAQ;AACR,uEAAuE;AAEvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAAqB,CAAA;AAC/D,MAAM,CAAC,MAAM,gCAAgC,GAA8B;IACzE,KAAK,EAAE,KAAK;CACb,CAAA;AAkDD,uEAAuE;AACvE,oBAAoB;AACpB,uEAAuE;AAEvE,SAAS,QAAQ;IACf,8EAA8E;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;AACvC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAA;IACxC,IAAI,OAAO,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;IACvB,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC;QACxE,IAAI,CAAC,IAAI,CACP,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,SAAS,EACT,aAAa,CACd;KACF,CAAA;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAChC,CAAC;IACD,MAAM,IAAI,KAAK,CACb,wDAAwD;QACtD,uEAAuE;QACvE,cAAc,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtE,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,0BAA0B;AAC1B,uEAAuE;AAEvE,SAAS,YAAY,CAAC,GAAoB;IACxC,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;IACtD,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,0BAA0B,CAAC,CAAA;AAChE,CAAC;AAQD,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAM,EAAE,CAAC,CAAA;IACrE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IACzE,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC/B,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;KAChC,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAI,IAAc;IACtC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxE,CAAA;IACH,CAAC;IACD,sEAAsE;IACtE,4DAA4D;IAC5D,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAM,CAAA;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B;YACnD,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAM,CAAW,CAAC,OAAO,EAAE,CACzD,CAAA;IACH,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,uBAAuB;AACvB,uEAAuE;AAEvE;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAoB;IAEpB,OAAO,aAAa,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAkC,EAAE;IAEpC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC9B,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,MAAM,GAAG,GAAG,aAAa,CAItB,IAAI,CAAC,CAAA;IACR,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;KACrD,CAAA;AACH,CAAC;AAmCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/C,IAAI,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CACP,oBAAoB,EACpB,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CACtD,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAEpC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,eAAe,CACb,kCAAkC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACtE,CAAA;IAED,sCAAsC;IACtC,UAAU;IACV,oCAAoC;IACpC,2BAA2B;IAC3B,0BAA0B;IAC1B,6DAA6D;IAC7D,uCAAuC;IACvC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAA;IAChC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,CAAC;YACJ,MAAK;QACP,KAAK,EAAE;YACL,OAAO;gBACL,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC;gBAClC,GAAG,EAAE,mBAAmB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC7D,SAAS,EAAE,IAAI;aAChB,CAAA;QACH,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAA;QACjE,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAA;QACvE,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CACb,kEAAkE;gBAChE,qDAAqD;gBACrD,mEAAmE;gBACnE,WAAW,GAAG,EAAE,CACnB,CAAA;QACH;YACE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,MAAM,MAAM,GAAG,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,OAAO;QACL,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC;QAClC,GAAG,EAAE,mBAAmB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;KAC9D,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAkC,EAAE;IAG1E,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;IAC1B,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,eAAe,CACb,oCAAoC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxE,CAAA;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;IAC/C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,kCAAkC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACvE,CAAA;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAoB;IACrD,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC9D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,qCAAqC,CAAC,CAAC,MAAM,KAAK;YAChD,+BAA+B,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxD,CAAA;IACH,CAAC;IACD,eAAe,CAAC,mCAAmC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAA2C;IAE3C,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IACtD,IAAI,GAAG,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IACrD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,qCAAqC,CAAC,CAAC,MAAM,KAAK;YAChD,kDAAkD;YAClD,WAAW,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACpC,CAAA;IACH,CAAC;IACD,eAAe,CAAC,mCAAmC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAGC;IAED,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IACrD,IAAI,GAAG,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;IACpE,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CACP,oBAAoB,EACpB,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CACpD,CAAA;IACH,CAAC;IACD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,oCAAoC,CAAC,CAAC,MAAM,KAAK;YAC/C,kDAAkD;YAClD,WAAW,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACpC,CAAA;IACH,CAAC;IACD,eAAe,CAAC,kCAAkC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC3E,CAAC;AAED,uEAAuE;AACvE,OAAO;AACP,uEAAuE;AAEvE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,6BAA6B,CAAC,CAAuB;IAInE,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,MAAM,IAAI,GAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEf,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,CAAA;IAC1D,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;IACjD,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GACT,KAAK,KAAK,MAAM;YACd,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,IAAI,CAAC,IAAI,CACP,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,MAAM,EACN,gBAAgB,CACjB,CAAA;QACP,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;IACvD,CAAC;SAAM,CAAC;QACN,+DAA+D;QAC/D,gEAAgE;QAChE,+DAA+D;QAC/D,mDAAmD;QACnD,IAAI,CAAC,IAAI,CACP,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,EAC5C,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,CAAC,CAAC,OAAO,CACV,CAAA;IACH,CAAC;IAED,gEAAgE;IAChE,gDAAgD;IAChD,MAAM,SAAS,GAAG,eAAe,CAC/B,oBAAoB,CAClB,CAAC,CAAC,aAAa,EACf,CAAC,CAAC,cAAc,EAChB,SAAS,EACT,CAAC,CAAC,cAAc,CACjB,CACF,CAAA;IACD,mEAAmE;IACnE,qEAAqE;IACrE,OAAO,SAAS,CAAC,MAAM,CAAA;IACvB,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAA;IAC/D,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;AACtB,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAc;IACrC,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAQ;QACvB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,uEAAuE;AACvE,+BAA+B;AAC/B,uEAAuE;AAEvE;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAoB,EACpB,YAAgC,EAChC,UAA8B;IAE9B,IAAI,UAAU,KAAK,sBAAsB,EAAE,CAAC;QAC1C,OAAO,CACL,kEAAkE;YAClE,iEAAiE;YACjE,6DAA6D;YAC7D,qEAAqE;YACrE,kBAAkB,CACnB,CAAA;IACH,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ;QACpB,CAAC,CAAC,eAAe,GAAG,CAAC,QAAQ,EAAE;QAC/B,CAAC,CAAC,UAAU,GAAG,CAAC,SAAS,IAAI,0BAA0B,EAAE,CAAA;IAC3D,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,oBAAoB,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACjE,OAAO,CACL,8DAA8D;QAC9D,yCAAyC;QACzC,8CAA8C;QAC9C,yBAAyB,CAAC,GAAG,EAAE,iBAAiB;QAChD,yEAAyE;QACzE,wEAAwE;QACxE,oDAAoD,CACrD,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAoB,EACpB,YAAqB;IAErB,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,qBAAqB;IACrB,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,aAAa,EAAE,CAAA;IACvB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,CAAE,CAAW,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAA;IACrD,CAAC;IACD,eAAe,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAA;IAE5D,6DAA6D;IAC7D,IAAI,EAA4B,CAAA;IAChC,IAAI,CAAC;QACH,EAAE,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,gCAAiC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;QACnE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC7B,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CACT,0BAA0B,EAAE,CAAC,KAAK,EAAE;YAClC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,IAAI;YACJ,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,CAC1D,CAAA;IACH,CAAC;IACD,IAAI,EAAE,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAA;IAEzC,+CAA+C;IAC/C,IAAI,EAA0B,CAAA;IAC9B,IAAI,CAAC;QACH,EAAE,GAAG,mBAAmB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,8BAA+B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;QACjE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC7B,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QAC7B,8DAA8D;QAC9D,yDAAyD;QACzD,yDAAyD;QACzD,mDAAmD;QACnD,IAAI,EAAE,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CACT,2CAA2C;gBACzC,GAAG,YAAY,IAAI,WAAW,IAAI;gBAClC,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,CAAC,CAC1D,CAAA;QACH,CAAC;IACH,CAAC;SAAM,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QACxB,eAAe,CACb,oCAAoC,EAAE,CAAC,OAAO,YAAY;YACxD,oBAAoB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAA;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AAC7B,CAAC"}
|
|
1
|
+
{"version":3,"file":"windows-sandbox-utils.js","sourceRoot":"","sources":["../../src/sandbox/windows-sandbox-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,oBAAoB,CAAA;AAC3B,4DAA4D;AAC5D,6CAA6C;AAC7C,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,oBAAoB,CAAA;AAG3B;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,uEAAuE;AACvE,QAAQ;AACR,uEAAuE;AAEvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAAqB,CAAA;AAC/D,MAAM,CAAC,MAAM,gCAAgC,GAA8B;IACzE,KAAK,EAAE,KAAK;CACb,CAAA;AAiGD;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAC7C,iEAAiE;IACjE,0BAA0B;IAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;IACnD,IACE,IAAI,KAAK,MAAM;QACf,IAAI,KAAK,UAAU;QACnB,IAAI,KAAK,IAAI;QACb,IAAI,KAAK,QAAQ,EACjB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,4CAA4C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK;gBAClE,yCAAyC,CAC5C,CAAA;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;IACpC,CAAC;IACD,mEAAmE;IACnE,iEAAiE;IACjE,gEAAgE;IAChE,4CAA4C;IAC5C,QAAQ,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QACzB,KAAK,YAAY,CAAC;QAClB,KAAK,gBAAgB;YACnB,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;QAC/B,KAAK,KAAK,CAAC;QACX,KAAK,SAAS;YACZ,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QACxB;YACE,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa;gBACvD,sEAAsE,CACzE,CAAA;IACL,CAAC;AACH,CAAC;AAwGD,uEAAuE;AACvE,oBAAoB;AACpB,uEAAuE;AAEvE,SAAS,QAAQ;IACf,8EAA8E;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;AACvC,CAAC;AAED,MAAM,aAAa,GAA2B,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AAE5E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAA;IACxC,IAAI,OAAO,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;IACvB,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACxC,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,IAAI,IAAI,EAAE,CAAC;QACT,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAA;IAC5E,CAAC;IACD,UAAU,CAAC,IAAI,CACb,IAAI,CAAC,IAAI,CACP,IAAI,EACJ,QAAQ,EACR,aAAa,EACb,QAAQ,EACR,SAAS,EACT,aAAa,CACd;IACD,qEAAqE;IACrE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,CACzE,CAAA;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAChC,CAAC;IACD,MAAM,IAAI,KAAK,CACb,wDAAwD;QACtD,2EAA2E;QAC3E,cAAc,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtE,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,0BAA0B;AAC1B,uEAAuE;AAEvE,SAAS,YAAY,CAAC,GAAoB;IACxC,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;IACtD,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,0BAA0B,CAAC,CAAA;AAChE,CAAC;AAQD,SAAS,SAAS,CAChB,IAAc,EACd,KAAc,EACd,SAAS,GAAG,KAAM;IAElB,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE;QAC7B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,SAAS;QAClB,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;KAC7C,CAAC,CAAA;IACF,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IACzE,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC/B,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;KAChC,CAAA;AACH,CAAC;AAaD,SAAS,aAAa,CACpB,IAAc,EACd,IAAqD;IAErD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IACrD,4DAA4D;IAC5D,6DAA6D;IAC7D,0DAA0D;IAC1D,IAAI,IAAmB,CAAA;IACvB,IAAI,QAA4B,CAAA;IAChC,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAM,CAAA;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,GAAI,CAAW,CAAC,OAAO,CAAA;IACjC,CAAC;IACD,IAAI,IAAI,EAAE,YAAY,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAA;IACvD,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxE,CAAA;IACH,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B;QACnD,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAC7C,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,uBAAuB;AACvB,uEAAuE;AAEvE;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAoB;IAEpB,OAAO,aAAa,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAkC,EAAE;IAEpC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC9B,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,MAAM,GAAG,GAAG,aAAa,CAMtB,IAAI,CAAC,CAAA;IACR,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;QACpD,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;KAC/C,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,GAAG,GAAG,aAAa,CActB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;IACtB,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM;QAC5B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1C,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY;QAClC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC3D,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB;QACzC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB;QACzC,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,iBAAiB;QAC3C,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,GAAG,CAAC,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,IAAI;YAC5C,aAAa,EAAE,GAAG,CAAC,cAAc;SAClC,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;QAC5D,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;KACvD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAiC;IAEjC,MAAM,CAAC,GAAG,MAAM,IAAI,2BAA2B,EAAE,CAAA;IACjD,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAC/C,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,wDAAwD;IACxD,iEAAiE;IACjE,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,KAAM,CAAC,CAAA;IACxE,eAAe,CACb,wCAAwC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAC5E,CAAA;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,0BAA0B,UAAU,iBAAiB;YACnD,GAAG,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAC1C,CAAA;IACH,CAAC;AACH,CAAC;AAqCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/C,IAAI,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CACP,oBAAoB,EACpB,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CACtD,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAEpC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAM,CAAC,CAAA;IAC5C,eAAe,CACb,kCAAkC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACtE,CAAA;IAED,sCAAsC;IACtC,UAAU;IACV,oCAAoC;IACpC,2BAA2B;IAC3B,0BAA0B;IAC1B,6DAA6D;IAC7D,wCAAwC;IACxC,uCAAuC;IACvC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAA;IAChC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,CAAC;YACJ,MAAK;QACP,KAAK,EAAE;YACL,OAAO;gBACL,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC;gBAClC,GAAG,EAAE,mBAAmB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC7D,IAAI,EAAE,2BAA2B,EAAE;gBACnC,SAAS,EAAE,IAAI;aAChB,CAAA;QACH,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAA;QACjE,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAA;QACvE,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CACb,sDAAsD,GAAG,EAAE,CAC5D,CAAA;QACH,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CACb,kEAAkE;gBAChE,qDAAqD;gBACrD,mEAAmE;gBACnE,WAAW,GAAG,EAAE,CACnB,CAAA;QACH;YACE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,MAAM,MAAM,GAAG,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,OAAO;QACL,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC;QAClC,GAAG,EAAE,mBAAmB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7D,IAAI,EAAE,2BAA2B,EAAE;KACpC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAsD,EAAE;IAIxD,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;IAC1B,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,IAAI,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC3C,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,eAAe,CACb,oCAAoC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxE,CAAA;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;IAC/C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,kCAAkC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACvE,CAAA;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAoB;IACrD,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC9D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,qCAAqC,CAAC,CAAC,MAAM,KAAK;YAChD,+BAA+B,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxD,CAAA;IACH,CAAC;IACD,eAAe,CAAC,mCAAmC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAA2C;IAE3C,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IACtD,IAAI,GAAG,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IACrD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,qCAAqC,CAAC,CAAC,MAAM,KAAK;YAChD,kDAAkD;YAClD,WAAW,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACpC,CAAA;IACH,CAAC;IACD,eAAe,CAAC,mCAAmC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAGC;IAED,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IACrD,IAAI,GAAG,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;IACpE,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CACP,oBAAoB,EACpB,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CACpD,CAAA;IACH,CAAC;IACD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,oCAAoC,CAAC,CAAC,MAAM,KAAK;YAC/C,kDAAkD;YAClD,WAAW,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACpC,CAAA;IACH,CAAC;IACD,eAAe,CAAC,kCAAkC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC3E,CAAC;AA0DD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAA;QACzC,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC;YAC3C,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YACpD,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACV,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAA;YACpD,IAAI,CAAC,EAAE;gBAAE,SAAQ;YACjB,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,gDAAgD;oBAC9C,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yBAAyB;oBAC/C,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,wCAAwC,CAC/D,CAAA;YACH,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACZ,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAA;AACjB,CAAC;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,eAAe,CAAC,IAA4B;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAA;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAA;IACF,MAAM,CAAC,GAAG,SAAS,CACjB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC,EAC1E,KAAK,EACL,KAAM,CACP,CAAA;IACD,eAAe,CACb,oCAAoC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxE,CAAA;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,4DAA4D;QAC5D,4DAA4D;QAC5D,MAAM,IAAI,KAAK,CACb,4BAA4B,CAAC,CAAC,MAAM,GAAG;YACrC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,UAAU,CAAC;YACjE,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAC9B,CAAA;IACH,CAAC;AACH,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAA8B;IAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAA;IAC5C,MAAM,IAAI,GAAG;QACX,KAAK;QACL,SAAS;QACT,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3B,cAAc;QACd,GAAG,MAAM,EAAE;QACX,QAAQ;KACT,CAAA;IACD,gEAAgE;IAChE,4DAA4D;IAC5D,8DAA8D;IAC9D,2DAA2D;IAC3D,+DAA+D;IAC/D,0DAA0D;IAC1D,wDAAwD;IACxD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,aAAa,CAA0B,IAAI,EAAE;YACrD,SAAS,EAAE,KAAM;YACjB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAA;QACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,eAAe,CACb,0DAA0D;gBACxD,wBAAwB,CAAC,CAAC,MAAM,EAAE,EACpC,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACH,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAA;IACf,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,eAAe,CAAC,kCAAmC,CAAW,CAAC,OAAO,EAAE,EAAE;YACxE,KAAK,EAAE,OAAO;SACf,CAAC,CAAA;QACF,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAkC;IAC1E,UAAU;CACX,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAC1C,CAAC,UAAU,EAAE,iBAAiB,EAAE,WAAW,CAAC,CAC7C,CAAA;AAED,uEAAuE;AACvE,OAAO;AACP,uEAAuE;AAEvE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,6BAA6B,CAAC,CAAuB;IAInE,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,6DAA6D;IAC7D,8DAA8D;IAC9D,mDAAmD;IACnD,EAAE;IACF,iEAAiE;IACjE,sDAAsD;IACtD,iEAAiE;IACjE,8DAA8D;IAC9D,kEAAkE;IAClE,iEAAiE;IACjE,iEAAiE;IACjE,iEAAiE;IACjE,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClD,eAAe,CACb,iCAAiC,CAAC,CAAC,UAAU,kBAAkB;YAC7D,sDAAsD;YACtD,2DAA2D;YAC3D,kDAAkD,CACrD,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAC/B,oBAAoB,CAClB,CAAC,CAAC,aAAa,EACf,CAAC,CAAC,cAAc,EAChB,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAC1C,CAAC,CAAC,cAAc,CACjB,CACF,CAAA;IACD,mEAAmE;IACnE,qEAAqE;IACrE,OAAO,SAAS,CAAC,MAAM,CAAA;IAEvB,MAAM,IAAI,GAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9D,0CAA0C;IAC1C,8DAA8D;IAC9D,8DAA8D;IAC9D,iEAAiE;IACjE,4BAA4B;IAC5B,IAAI,CAAC,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,YAAY,CAAC,CAAA;IAChE,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAA;IAC7C,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAA;IAC7D,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAA;IAC/D,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QAC9B,gEAAgE;QAChE,gEAAgE;QAChE,8DAA8D;QAC9D,2DAA2D;QAC3D,8BAA8B;QAC9B,MAAM,OAAO,GAAsB;YACjC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;YACtB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;YAC5B,GAAG,SAAS;SACb,CAAA;QACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEf,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,CAAA;IAC1D,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACxC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,MAAM;YACT,0DAA0D;YAC1D,8DAA8D;YAC9D,kEAAkE;YAClE,6DAA6D;YAC7D,8DAA8D;YAC9D,+DAA+D;YAC/D,iEAAiE;YACjE,mDAAmD;YACnD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;YACnC,MAAK;QACP,KAAK,MAAM;YACT,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;YAC1D,MAAK;QACP,KAAK,YAAY;YACf,IAAI,CAAC,IAAI,CACP,IAAI,CAAC,IAAI,CACP,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,MAAM,EACN,gBAAgB,CACjB,EACD,YAAY,EACZ,UAAU,EACV,CAAC,CAAC,OAAO,CACV,CAAA;YACD,MAAK;QACP,KAAK,KAAK;YACR,+DAA+D;YAC/D,gEAAgE;YAChE,+DAA+D;YAC/D,mDAAmD;YACnD,IAAI,CAAC,IAAI,CACP,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,EAC5C,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,CAAC,CAAC,OAAO,CACV,CAAA;YACD,MAAK;IACT,CAAC;IAED,6DAA6D;IAC7D,8DAA8D;IAC9D,6DAA6D;IAC7D,2DAA2D;IAC3D,0DAA0D;IAC1D,2DAA2D;IAC3D,4DAA4D;IAC5D,6DAA6D;IAC7D,2DAA2D;IAC3D,0BAA0B;IAC1B,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAClE,IAAI,eAAe,GAAG,KAAM,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,CAAA;QACpE,MAAM,IAAI,KAAK,CACb,4BAA4B,eAAe,SAAS;YAClD,qCAAqC,KAAK,YAAY;YACtD,4DAA4D;YAC5D,6DAA6D;YAC7D,8DAA8D;YAC9D,kCAAkC,CACrC,CAAA;IACH,CAAC;IAED,+DAA+D;IAC/D,gEAAgE;IAChE,kEAAkE;IAClE,8DAA8D;IAC9D,mDAAmD;IACnD,EAAE;IACF,4DAA4D;IAC5D,+DAA+D;IAC/D,yDAAyD;IACzD,MAAM,OAAO,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACrD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IAC5E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAA;IAE1C,+DAA+D;IAC/D,kEAAkE;IAClE,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,EAAE,CAAA;IAC3D,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;AACtB,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAc;IACrC,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAQ;QACvB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,uEAAuE;AACvE,+BAA+B;AAC/B,uEAAuE;AAEvE;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAoB,EACpB,YAAgC,EAChC,UAA8B;IAE9B,IAAI,UAAU,KAAK,sBAAsB,EAAE,CAAC;QAC1C,OAAO,CACL,kEAAkE;YAClE,iEAAiE;YACjE,6DAA6D;YAC7D,qEAAqE;YACrE,kBAAkB,CACnB,CAAA;IACH,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ;QACpB,CAAC,CAAC,eAAe,GAAG,CAAC,QAAQ,EAAE;QAC/B,CAAC,CAAC,UAAU,GAAG,CAAC,SAAS,IAAI,0BAA0B,EAAE,CAAA;IAC3D,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,oBAAoB,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACjE,OAAO,CACL,8DAA8D;QAC9D,yCAAyC;QACzC,8CAA8C;QAC9C,yBAAyB,CAAC,GAAG,EAAE,iBAAiB;QAChD,yEAAyE;QACzE,wEAAwE;QACxE,oDAAoD,CACrD,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAoB,EACpB,YAAqB;IAErB,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,qBAAqB;IACrB,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,aAAa,EAAE,CAAA;IACvB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,CAAE,CAAW,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAA;IACrD,CAAC;IACD,eAAe,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAA;IAE5D,6DAA6D;IAC7D,IAAI,EAA4B,CAAA;IAChC,IAAI,CAAC;QACH,EAAE,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,gCAAiC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;QACnE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC7B,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CACT,0BAA0B,EAAE,CAAC,KAAK,EAAE;YAClC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,IAAI;YACJ,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,CAC1D,CAAA;IACH,CAAC;IACD,IAAI,EAAE,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAA;IAEzC,+CAA+C;IAC/C,IAAI,EAA0B,CAAA;IAC9B,IAAI,CAAC;QACH,EAAE,GAAG,mBAAmB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,8BAA+B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;QACjE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC7B,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QAC7B,8DAA8D;QAC9D,yDAAyD;QACzD,yDAAyD;QACzD,mDAAmD;QACnD,IAAI,EAAE,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CACT,2CAA2C;gBACzC,GAAG,YAAY,IAAI,WAAW,IAAI;gBAClC,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,CAAC,CAC1D,CAAA;QACH,CAAC;IACH,CAAC;SAAM,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QACxB,eAAe,CACb,oCAAoC,EAAE,CAAC,OAAO,YAAY;YACxD,oBAAoB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAA;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AAC7B,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@sysid/sandbox-runtime-improved",
|
|
3
|
-
"version": "0.0.
|
|
3
|
+
"version": "0.0.61-sysid.1",
|
|
4
4
|
"description": "Improved Anthropic Sandbox Runtime (ASRT) - A general-purpose tool for wrapping security boundaries around arbitrary processes (sysid fork with several improvements and bug fixes)",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.js",
|
|
@@ -9,18 +9,19 @@
|
|
|
9
9
|
"srti": "dist/cli.js"
|
|
10
10
|
},
|
|
11
11
|
"engines": {
|
|
12
|
-
"node": ">=
|
|
12
|
+
"node": ">=20.11.0"
|
|
13
13
|
},
|
|
14
14
|
"scripts": {
|
|
15
15
|
"build": "tsc",
|
|
16
16
|
"build:seccomp": "bun vendor/seccomp/build.ts",
|
|
17
|
+
"build:srt-win": "bun vendor/srt-win/build.ts",
|
|
17
18
|
"clean": "rm -rf dist",
|
|
18
19
|
"test": "bun test",
|
|
19
20
|
"typecheck": "tsc --noEmit",
|
|
20
21
|
"lint": "eslint 'src/**/*.ts' --fix --cache --cache-location=node_modules/.cache/.eslintcache",
|
|
21
22
|
"lint:check": "eslint 'src/**/*.ts' --cache --cache-location=node_modules/.cache/.eslintcache",
|
|
22
23
|
"format": "prettier --write 'src/**/*.ts' --cache --log-level warn",
|
|
23
|
-
"prepublishOnly": "npm run clean && npm run build &&
|
|
24
|
+
"prepublishOnly": "npm run clean && npm run build && node -e \"['x64','arm64'].forEach(a=>{if(!require('fs').existsSync('vendor/seccomp/'+a+'/apply-seccomp')){console.error('Missing seccomp binary: '+a);process.exit(1)}})\"",
|
|
24
25
|
"prepare": "husky"
|
|
25
26
|
},
|
|
26
27
|
"dependencies": {
|
|
@@ -42,6 +43,7 @@
|
|
|
42
43
|
"eslint-plugin-import": "^2.31.0",
|
|
43
44
|
"eslint-plugin-n": "^17.16.2",
|
|
44
45
|
"eslint-plugin-prettier": "^5.1.3",
|
|
46
|
+
"fast-check": "^4.8.0",
|
|
45
47
|
"globals": "^15.12.0",
|
|
46
48
|
"husky": "^9.1.7",
|
|
47
49
|
"lint-staged": "^16.2.6",
|
|
@@ -51,7 +53,8 @@
|
|
|
51
53
|
},
|
|
52
54
|
"files": [
|
|
53
55
|
"dist",
|
|
54
|
-
"vendor",
|
|
56
|
+
"vendor/seccomp",
|
|
57
|
+
"vendor/srt-win",
|
|
55
58
|
"README.md",
|
|
56
59
|
"LICENSE"
|
|
57
60
|
],
|
package/vendor/seccomp/build.ts
CHANGED
|
@@ -1,32 +1,12 @@
|
|
|
1
|
-
import {
|
|
2
|
-
import {
|
|
3
|
-
import {
|
|
4
|
-
import { fileURLToPath } from 'node:url'
|
|
1
|
+
import { readFileSync, rmSync, writeFileSync } from 'node:fs'
|
|
2
|
+
import { join } from 'node:path'
|
|
3
|
+
import { run, setup } from '../build-common.js'
|
|
5
4
|
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
const HERE = dirname(fileURLToPath(import.meta.url))
|
|
12
|
-
const SRC = join(HERE, '..', 'seccomp-src')
|
|
13
|
-
|
|
14
|
-
const nodeArchToDir: Record<string, string> = { x64: 'x64', arm64: 'arm64' }
|
|
15
|
-
const arch = nodeArchToDir[process.arch]
|
|
16
|
-
if (!arch) {
|
|
17
|
-
console.error('seccomp build: unsupported arch ' + process.arch)
|
|
18
|
-
process.exit(1)
|
|
19
|
-
}
|
|
20
|
-
const OUT = join(HERE, arch)
|
|
21
|
-
|
|
22
|
-
function run(argv: string[]): void {
|
|
23
|
-
const [cmd, ...args] = argv
|
|
24
|
-
const r = spawnSync(cmd, args, { stdio: 'inherit' })
|
|
25
|
-
if (r.status !== 0) {
|
|
26
|
-
console.error(argv.join(' ') + ' exited ' + (r.status ?? r.signal))
|
|
27
|
-
process.exit(1)
|
|
28
|
-
}
|
|
29
|
-
}
|
|
5
|
+
const { SRC, OUT } = setup({
|
|
6
|
+
importMetaUrl: import.meta.url,
|
|
7
|
+
requirePlatform: 'linux',
|
|
8
|
+
srcDirName: 'seccomp-src',
|
|
9
|
+
})
|
|
30
10
|
|
|
31
11
|
function toCArray(bytes: Buffer): string {
|
|
32
12
|
const hex = Array.from(bytes, b => '0x' + b.toString(16).padStart(2, '0'))
|
|
@@ -37,8 +17,6 @@ function toCArray(bytes: Buffer): string {
|
|
|
37
17
|
return lines.join('\n')
|
|
38
18
|
}
|
|
39
19
|
|
|
40
|
-
mkdirSync(OUT, { recursive: true })
|
|
41
|
-
|
|
42
20
|
const cflags = ['-static', '-O2', '-Wall', '-Wextra']
|
|
43
21
|
|
|
44
22
|
const gen = join(OUT, 'seccomp-unix-block')
|
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
import { copyFileSync, existsSync } from 'node:fs'
|
|
2
|
+
import { join } from 'node:path'
|
|
3
|
+
import { run, setup } from '../build-common.js'
|
|
4
|
+
|
|
5
|
+
const { SRC, OUT } = setup({
|
|
6
|
+
importMetaUrl: import.meta.url,
|
|
7
|
+
requirePlatform: 'win32',
|
|
8
|
+
srcDirName: 'srt-win-src',
|
|
9
|
+
})
|
|
10
|
+
|
|
11
|
+
run(['cargo', 'build', '--release', '--manifest-path', join(SRC, 'Cargo.toml')])
|
|
12
|
+
|
|
13
|
+
const built = join(SRC, 'target', 'release', 'srt-win.exe')
|
|
14
|
+
if (!existsSync(built)) {
|
|
15
|
+
console.error('srt-win build: expected output not found at ' + built)
|
|
16
|
+
process.exit(1)
|
|
17
|
+
}
|
|
18
|
+
|
|
19
|
+
const dest = join(OUT, 'srt-win.exe')
|
|
20
|
+
copyFileSync(built, dest)
|
|
21
|
+
console.log('built ' + dest)
|
|
Binary file
|
|
@@ -1,91 +0,0 @@
|
|
|
1
|
-
import { spawnSync } from 'node:child_process'
|
|
2
|
-
import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
|
|
3
|
-
import { dirname, join } from 'node:path'
|
|
4
|
-
import { fileURLToPath } from 'node:url'
|
|
5
|
-
|
|
6
|
-
if (process.platform !== 'linux') {
|
|
7
|
-
console.error('seccomp build: Linux only')
|
|
8
|
-
process.exit(1)
|
|
9
|
-
}
|
|
10
|
-
|
|
11
|
-
const HERE = dirname(fileURLToPath(import.meta.url))
|
|
12
|
-
const SRC = join(HERE, '..', 'seccomp-src')
|
|
13
|
-
|
|
14
|
-
const nodeArchToDir: Record<string, string> = { x64: 'x64', arm64: 'arm64' }
|
|
15
|
-
const arch = nodeArchToDir[process.arch]
|
|
16
|
-
if (!arch) {
|
|
17
|
-
console.error('seccomp build: unsupported arch ' + process.arch)
|
|
18
|
-
process.exit(1)
|
|
19
|
-
}
|
|
20
|
-
const OUT = join(HERE, arch)
|
|
21
|
-
|
|
22
|
-
function run(argv: string[]): void {
|
|
23
|
-
const [cmd, ...args] = argv
|
|
24
|
-
const r = spawnSync(cmd, args, { stdio: 'inherit' })
|
|
25
|
-
if (r.status !== 0) {
|
|
26
|
-
console.error(argv.join(' ') + ' exited ' + (r.status ?? r.signal))
|
|
27
|
-
process.exit(1)
|
|
28
|
-
}
|
|
29
|
-
}
|
|
30
|
-
|
|
31
|
-
function toCArray(bytes: Buffer): string {
|
|
32
|
-
const hex = Array.from(bytes, b => '0x' + b.toString(16).padStart(2, '0'))
|
|
33
|
-
const lines: string[] = []
|
|
34
|
-
for (let i = 0; i < hex.length; i += 8) {
|
|
35
|
-
lines.push(' ' + hex.slice(i, i + 8).join(', ') + ',')
|
|
36
|
-
}
|
|
37
|
-
return lines.join('\n')
|
|
38
|
-
}
|
|
39
|
-
|
|
40
|
-
mkdirSync(OUT, { recursive: true })
|
|
41
|
-
|
|
42
|
-
const cflags = ['-static', '-O2', '-Wall', '-Wextra']
|
|
43
|
-
|
|
44
|
-
const gen = join(OUT, 'seccomp-unix-block')
|
|
45
|
-
run([
|
|
46
|
-
'gcc',
|
|
47
|
-
...cflags,
|
|
48
|
-
'-o',
|
|
49
|
-
gen,
|
|
50
|
-
join(SRC, 'seccomp-unix-block.c'),
|
|
51
|
-
'-lseccomp',
|
|
52
|
-
])
|
|
53
|
-
|
|
54
|
-
const bpf: Record<string, Buffer> = {}
|
|
55
|
-
for (const target of ['x86_64', 'aarch64']) {
|
|
56
|
-
const tmp = join(OUT, target + '.bpf')
|
|
57
|
-
run([gen, tmp, target])
|
|
58
|
-
bpf[target] = readFileSync(tmp)
|
|
59
|
-
rmSync(tmp)
|
|
60
|
-
}
|
|
61
|
-
rmSync(gen)
|
|
62
|
-
|
|
63
|
-
const header = join(OUT, 'unix-block-bpf.h')
|
|
64
|
-
writeFileSync(
|
|
65
|
-
header,
|
|
66
|
-
'#if defined(__x86_64__)\n' +
|
|
67
|
-
'static const unsigned char unix_block_bpf[] = {\n' +
|
|
68
|
-
toCArray(bpf.x86_64) +
|
|
69
|
-
'\n};\n' +
|
|
70
|
-
'#elif defined(__aarch64__)\n' +
|
|
71
|
-
'static const unsigned char unix_block_bpf[] = {\n' +
|
|
72
|
-
toCArray(bpf.aarch64) +
|
|
73
|
-
'\n};\n' +
|
|
74
|
-
'#else\n' +
|
|
75
|
-
'#error "unsupported architecture for unix-block BPF filter"\n' +
|
|
76
|
-
'#endif\n',
|
|
77
|
-
)
|
|
78
|
-
|
|
79
|
-
run([
|
|
80
|
-
'gcc',
|
|
81
|
-
...cflags,
|
|
82
|
-
'-I',
|
|
83
|
-
OUT,
|
|
84
|
-
'-o',
|
|
85
|
-
join(OUT, 'apply-seccomp'),
|
|
86
|
-
join(SRC, 'apply-seccomp.c'),
|
|
87
|
-
])
|
|
88
|
-
run(['strip', join(OUT, 'apply-seccomp')])
|
|
89
|
-
rmSync(header)
|
|
90
|
-
|
|
91
|
-
console.log('built ' + join(OUT, 'apply-seccomp'))
|
|
Binary file
|
|
@@ -1,280 +0,0 @@
|
|
|
1
|
-
/*
|
|
2
|
-
* apply-seccomp.c - Apply seccomp BPF filter in an isolated PID namespace
|
|
3
|
-
*
|
|
4
|
-
* Usage: apply-seccomp <command> [args...]
|
|
5
|
-
*
|
|
6
|
-
* This program applies a baked-in seccomp BPF filter, isolates the
|
|
7
|
-
* target command in a nested user+PID+mount namespace so it cannot see or
|
|
8
|
-
* ptrace any process that lacks the filter, applies the filter with
|
|
9
|
-
* prctl(PR_SET_SECCOMP), and execs the command.
|
|
10
|
-
*
|
|
11
|
-
* Process layout inside the outer bwrap sandbox:
|
|
12
|
-
*
|
|
13
|
-
* bwrap init (PID 1) <- outer PID ns, no seccomp
|
|
14
|
-
* \_ bash / socat ... <- outer PID ns, no seccomp
|
|
15
|
-
* \_ apply-seccomp [outer] <- outer PID ns, waits for inner init
|
|
16
|
-
* ================================================= PID ns boundary
|
|
17
|
-
* \_ apply-seccomp [inner init] <- inner PID 1, PR_SET_DUMPABLE=0
|
|
18
|
-
* \_ user command <- inner PID 2, seccomp applied
|
|
19
|
-
*
|
|
20
|
-
* From the user command's point of view /proc contains only its own process
|
|
21
|
-
* tree. The bwrap init, bash wrapper, and socat helpers are not addressable,
|
|
22
|
-
* so they cannot be ptraced or patched via /proc/N/mem even on systems with
|
|
23
|
-
* kernel.yama.ptrace_scope=0. The inner init (PID 1) sets PR_SET_DUMPABLE=0
|
|
24
|
-
* so it cannot be ptraced either.
|
|
25
|
-
*
|
|
26
|
-
* Any failure to set up the nested namespaces aborts with a non-zero exit
|
|
27
|
-
* status; we never fall back to running the command without isolation.
|
|
28
|
-
*
|
|
29
|
-
* Compile: gcc -static -O2 -o apply-seccomp apply-seccomp.c
|
|
30
|
-
*/
|
|
31
|
-
|
|
32
|
-
#define _GNU_SOURCE
|
|
33
|
-
#include <stdio.h>
|
|
34
|
-
#include <stdlib.h>
|
|
35
|
-
#include <stdarg.h>
|
|
36
|
-
#include <string.h>
|
|
37
|
-
#include <unistd.h>
|
|
38
|
-
#include <fcntl.h>
|
|
39
|
-
#include <errno.h>
|
|
40
|
-
#include <sched.h>
|
|
41
|
-
#include <signal.h>
|
|
42
|
-
#include <sys/prctl.h>
|
|
43
|
-
#include <sys/wait.h>
|
|
44
|
-
#include <sys/mount.h>
|
|
45
|
-
#include <linux/seccomp.h>
|
|
46
|
-
#include <linux/filter.h>
|
|
47
|
-
|
|
48
|
-
#include "unix-block-bpf.h"
|
|
49
|
-
|
|
50
|
-
#ifndef PR_SET_NO_NEW_PRIVS
|
|
51
|
-
#define PR_SET_NO_NEW_PRIVS 38
|
|
52
|
-
#endif
|
|
53
|
-
|
|
54
|
-
#ifndef PR_CAP_AMBIENT
|
|
55
|
-
#define PR_CAP_AMBIENT 47
|
|
56
|
-
#define PR_CAP_AMBIENT_CLEAR_ALL 4
|
|
57
|
-
#endif
|
|
58
|
-
|
|
59
|
-
#ifndef SECCOMP_MODE_FILTER
|
|
60
|
-
#define SECCOMP_MODE_FILTER 2
|
|
61
|
-
#endif
|
|
62
|
-
|
|
63
|
-
static void die(const char *msg) {
|
|
64
|
-
perror(msg);
|
|
65
|
-
_exit(1);
|
|
66
|
-
}
|
|
67
|
-
|
|
68
|
-
static int write_file(const char *path, const char *fmt, ...) {
|
|
69
|
-
char buf[256];
|
|
70
|
-
va_list ap;
|
|
71
|
-
va_start(ap, fmt);
|
|
72
|
-
int len = vsnprintf(buf, sizeof(buf), fmt, ap);
|
|
73
|
-
va_end(ap);
|
|
74
|
-
if (len < 0 || (size_t)len >= sizeof(buf)) {
|
|
75
|
-
errno = EOVERFLOW;
|
|
76
|
-
return -1;
|
|
77
|
-
}
|
|
78
|
-
|
|
79
|
-
int fd = open(path, O_WRONLY);
|
|
80
|
-
if (fd < 0) {
|
|
81
|
-
return -1;
|
|
82
|
-
}
|
|
83
|
-
ssize_t r = write(fd, buf, (size_t)len);
|
|
84
|
-
int saved = errno;
|
|
85
|
-
close(fd);
|
|
86
|
-
if (r != len) {
|
|
87
|
-
errno = (r < 0) ? saved : EIO;
|
|
88
|
-
return -1;
|
|
89
|
-
}
|
|
90
|
-
return 0;
|
|
91
|
-
}
|
|
92
|
-
|
|
93
|
-
/* PID the current process forwards signals to. Used by both the outer stub
|
|
94
|
-
* (forwards to inner init) and the inner init (forwards to the worker).
|
|
95
|
-
* PID 1 ignores signals it has no handler for, so the inner init MUST install
|
|
96
|
-
* these or SIGTERM from the outside is silently dropped. */
|
|
97
|
-
static volatile pid_t forward_target = -1;
|
|
98
|
-
|
|
99
|
-
static void forward_signal(int sig) {
|
|
100
|
-
if (forward_target > 0) {
|
|
101
|
-
kill(forward_target, sig);
|
|
102
|
-
}
|
|
103
|
-
}
|
|
104
|
-
|
|
105
|
-
static void install_forwarders(pid_t target) {
|
|
106
|
-
forward_target = target;
|
|
107
|
-
struct sigaction sa = { .sa_handler = forward_signal };
|
|
108
|
-
sigemptyset(&sa.sa_mask);
|
|
109
|
-
sigaction(SIGTERM, &sa, NULL);
|
|
110
|
-
sigaction(SIGINT, &sa, NULL);
|
|
111
|
-
sigaction(SIGHUP, &sa, NULL);
|
|
112
|
-
sigaction(SIGQUIT, &sa, NULL);
|
|
113
|
-
sigaction(SIGUSR1, &sa, NULL);
|
|
114
|
-
sigaction(SIGUSR2, &sa, NULL);
|
|
115
|
-
}
|
|
116
|
-
|
|
117
|
-
/*
|
|
118
|
-
* Wait for `main_child`, reaping any other children that exit first.
|
|
119
|
-
* Returns as soon as `main_child` terminates — the caller then _exit()s,
|
|
120
|
-
* which as PID 1 tears down the namespace and SIGKILLs any stragglers.
|
|
121
|
-
* Returns an exit(3)-style status: exit code, or 128+signal.
|
|
122
|
-
*/
|
|
123
|
-
static int reap_until(pid_t main_child) {
|
|
124
|
-
int status = 0;
|
|
125
|
-
for (;;) {
|
|
126
|
-
pid_t r = waitpid(-1, &status, 0);
|
|
127
|
-
if (r < 0) {
|
|
128
|
-
if (errno == EINTR) {
|
|
129
|
-
continue;
|
|
130
|
-
}
|
|
131
|
-
return 1; /* ECHILD without seeing main_child — shouldn't happen. */
|
|
132
|
-
}
|
|
133
|
-
if (r == main_child) {
|
|
134
|
-
if (WIFEXITED(status)) {
|
|
135
|
-
return WEXITSTATUS(status);
|
|
136
|
-
}
|
|
137
|
-
if (WIFSIGNALED(status)) {
|
|
138
|
-
return 128 + WTERMSIG(status);
|
|
139
|
-
}
|
|
140
|
-
return 1;
|
|
141
|
-
}
|
|
142
|
-
/* Reaped an orphan that died before main_child; keep waiting. */
|
|
143
|
-
}
|
|
144
|
-
}
|
|
145
|
-
|
|
146
|
-
int main(int argc, char *argv[]) {
|
|
147
|
-
if (argc < 2) {
|
|
148
|
-
fprintf(stderr, "Usage: %s <command> [args...]\n", argv[0]);
|
|
149
|
-
return 1;
|
|
150
|
-
}
|
|
151
|
-
|
|
152
|
-
char **command_argv = &argv[1];
|
|
153
|
-
|
|
154
|
-
_Static_assert(sizeof(unix_block_bpf) % sizeof(struct sock_filter) == 0,
|
|
155
|
-
"BPF filter size must be a multiple of sock_filter");
|
|
156
|
-
struct sock_fprog prog = {
|
|
157
|
-
.len = (unsigned short)(sizeof(unix_block_bpf) / sizeof(struct sock_filter)),
|
|
158
|
-
.filter = (struct sock_filter *)unix_block_bpf,
|
|
159
|
-
};
|
|
160
|
-
|
|
161
|
-
/* ---- New PID + mount namespaces. Children (not us) enter the PID ns. ----
|
|
162
|
-
*
|
|
163
|
-
* Two paths to get CAP_SYS_ADMIN for the unshare:
|
|
164
|
-
* (a) The caller (bwrap) kept CAP_SYS_ADMIN in this user namespace via
|
|
165
|
-
* --cap-add. Just unshare directly.
|
|
166
|
-
* (b) We don't have the cap. Create a nested user namespace to get it,
|
|
167
|
-
* map uid/gid, then unshare. This also works when apply-seccomp is
|
|
168
|
-
* run standalone outside bwrap.
|
|
169
|
-
*
|
|
170
|
-
* Path (a) is tried first. If the caller didn't give us the cap, the
|
|
171
|
-
* kernel returns EPERM and we fall through to (b). Path (b) can itself
|
|
172
|
-
* fail on hosts where unprivileged user namespaces are gated by an LSM
|
|
173
|
-
* (Ubuntu 24.04's AppArmor restriction, for example) — the unshare
|
|
174
|
-
* succeeds but the new namespace grants no capabilities, so the setgroups
|
|
175
|
-
* write fails. In that case we abort: the caller must supply CAP_SYS_ADMIN.
|
|
176
|
-
*/
|
|
177
|
-
if (unshare(CLONE_NEWPID | CLONE_NEWNS) < 0) {
|
|
178
|
-
if (errno != EPERM) {
|
|
179
|
-
die("apply-seccomp: unshare(CLONE_NEWPID|CLONE_NEWNS)");
|
|
180
|
-
}
|
|
181
|
-
|
|
182
|
-
uid_t uid = geteuid();
|
|
183
|
-
gid_t gid = getegid();
|
|
184
|
-
|
|
185
|
-
if (unshare(CLONE_NEWUSER) < 0) {
|
|
186
|
-
die("apply-seccomp: unshare(CLONE_NEWUSER)");
|
|
187
|
-
}
|
|
188
|
-
if (write_file("/proc/self/setgroups", "deny") < 0) {
|
|
189
|
-
die("apply-seccomp: write /proc/self/setgroups "
|
|
190
|
-
"(nested userns is capability-restricted; "
|
|
191
|
-
"caller must provide CAP_SYS_ADMIN)");
|
|
192
|
-
}
|
|
193
|
-
if (write_file("/proc/self/uid_map", "%u %u 1\n", uid, uid) < 0) {
|
|
194
|
-
die("apply-seccomp: write /proc/self/uid_map");
|
|
195
|
-
}
|
|
196
|
-
if (write_file("/proc/self/gid_map", "%u %u 1\n", gid, gid) < 0) {
|
|
197
|
-
die("apply-seccomp: write /proc/self/gid_map");
|
|
198
|
-
}
|
|
199
|
-
if (unshare(CLONE_NEWPID | CLONE_NEWNS) < 0) {
|
|
200
|
-
die("apply-seccomp: unshare(CLONE_NEWPID|CLONE_NEWNS) after userns");
|
|
201
|
-
}
|
|
202
|
-
}
|
|
203
|
-
|
|
204
|
-
pid_t child = fork();
|
|
205
|
-
if (child < 0) {
|
|
206
|
-
die("apply-seccomp: fork");
|
|
207
|
-
}
|
|
208
|
-
|
|
209
|
-
if (child > 0) {
|
|
210
|
-
/* Outer stub: still in bwrap's PID namespace. Forward signals and
|
|
211
|
-
* wait so the caller sees the real exit status. */
|
|
212
|
-
install_forwarders(child);
|
|
213
|
-
|
|
214
|
-
int status;
|
|
215
|
-
for (;;) {
|
|
216
|
-
pid_t r = waitpid(child, &status, 0);
|
|
217
|
-
if (r < 0 && errno == EINTR) continue;
|
|
218
|
-
if (r < 0) die("apply-seccomp: waitpid");
|
|
219
|
-
break;
|
|
220
|
-
}
|
|
221
|
-
if (WIFSIGNALED(status)) return 128 + WTERMSIG(status);
|
|
222
|
-
return WIFEXITED(status) ? WEXITSTATUS(status) : 1;
|
|
223
|
-
}
|
|
224
|
-
|
|
225
|
-
/* ================================================================
|
|
226
|
-
* Inner init — PID 1 in the nested PID namespace.
|
|
227
|
-
* ================================================================ */
|
|
228
|
-
|
|
229
|
-
/* Block ptrace and /proc/1/mem writes against this process. */
|
|
230
|
-
if (prctl(PR_SET_DUMPABLE, 0) < 0) {
|
|
231
|
-
die("apply-seccomp: prctl(PR_SET_DUMPABLE)");
|
|
232
|
-
}
|
|
233
|
-
|
|
234
|
-
/* Don't let our /proc mount propagate anywhere. */
|
|
235
|
-
if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL) < 0) {
|
|
236
|
-
die("apply-seccomp: mount(MS_PRIVATE)");
|
|
237
|
-
}
|
|
238
|
-
/* EPERM here means a masked /proc is underneath (unprivileged Docker)
|
|
239
|
-
* and the kernel domination check refused the overmount. The nested
|
|
240
|
-
* userns above is the isolation boundary; this remount only hides
|
|
241
|
-
* outer PIDs from `ls /proc`. enableWeakerNestedSandbox targets
|
|
242
|
-
* exactly this environment. */
|
|
243
|
-
if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NODEV | MS_NOEXEC, NULL) < 0
|
|
244
|
-
&& errno != EPERM) {
|
|
245
|
-
die("apply-seccomp: mount(/proc)");
|
|
246
|
-
}
|
|
247
|
-
|
|
248
|
-
/* bwrap --cap-add places CAP_SYS_ADMIN in the ambient set so it survives
|
|
249
|
-
* exec. Clear it now that the mount is done; combined with
|
|
250
|
-
* PR_SET_NO_NEW_PRIVS, the worker's execve drops to zero capabilities. */
|
|
251
|
-
if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0) < 0) {
|
|
252
|
-
die("apply-seccomp: prctl(PR_CAP_AMBIENT_CLEAR_ALL)");
|
|
253
|
-
}
|
|
254
|
-
|
|
255
|
-
/* Fork the real workload so PID 1 can stay as a non-dumpable reaper. */
|
|
256
|
-
pid_t worker = fork();
|
|
257
|
-
if (worker < 0) {
|
|
258
|
-
die("apply-seccomp: fork(worker)");
|
|
259
|
-
}
|
|
260
|
-
|
|
261
|
-
if (worker > 0) {
|
|
262
|
-
/* Inner init: reap everything, exit with the worker's status.
|
|
263
|
-
* When PID 1 exits the kernel tears down the whole namespace.
|
|
264
|
-
* PID 1 drops signals without handlers, so install forwarders. */
|
|
265
|
-
install_forwarders(worker);
|
|
266
|
-
_exit(reap_until(worker));
|
|
267
|
-
}
|
|
268
|
-
|
|
269
|
-
/* ---- Worker (inner PID 2): apply seccomp and exec. ---- */
|
|
270
|
-
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
|
|
271
|
-
die("apply-seccomp: prctl(PR_SET_NO_NEW_PRIVS)");
|
|
272
|
-
}
|
|
273
|
-
if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0) {
|
|
274
|
-
die("apply-seccomp: prctl(PR_SET_SECCOMP)");
|
|
275
|
-
}
|
|
276
|
-
|
|
277
|
-
execvp(command_argv[0], command_argv);
|
|
278
|
-
die("apply-seccomp: execvp");
|
|
279
|
-
return 1;
|
|
280
|
-
}
|