diff --git a/oss-internship-2020/jsonnet/examples/jsonnet_base_transaction.cc b/oss-internship-2020/jsonnet/examples/jsonnet_base_transaction.cc new file mode 100644 index 0000000..d1ae7b1 --- /dev/null +++ b/oss-internship-2020/jsonnet/examples/jsonnet_base_transaction.cc @@ -0,0 +1,14 @@ +// Copyright 2020 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + diff --git a/oss-internship-2020/jsonnet/examples/jsonnet_base_transaction.h b/oss-internship-2020/jsonnet/examples/jsonnet_base_transaction.h new file mode 100644 index 0000000..bc0bb24 --- /dev/null +++ b/oss-internship-2020/jsonnet/examples/jsonnet_base_transaction.h @@ -0,0 +1,51 @@ +// Copyright 2020 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#include +#include + +#include "sandboxed_api/transaction.h" +#include "sandboxed_api/vars.h" + +#include "jsonnet_sapi.sapi.h" + +class JsonnetSapiTransactionSandbox : public JsonnetSandbox { + public: + explicit JsonnetSapiTransactionSandbox(std::string in_file, std::string out_file) + : in_file_(std::move(in_file)), out_file_(std::move(out_file)) {} + + std::unique_ptr ModifyPolicy( + sandbox2::PolicyBuilder *) override { + return sandbox2::PolicyBuilder() + .AllowStaticStartup() + .AllowOpen() + .AllowRead() + .AllowWrite() + .AllowStat() + .AllowSystemMalloc() + .AllowExit() + .AllowSyscalls({ + __NR_futex, + __NR_close, + }) + .AddDirectoryAt(dirname(&out_file_[0]), "/output", /*is_ro=*/false) + .AddDirectoryAt(dirname(&in_file_[0]), "/input", true) + .BuildOrDie(); + } + + private: + std::string in_file_; + std::string out_file_; +}; +