Open nikomatsakis opened 1 month ago
This issue is intended for status updates only.
For general questions or comments, please contact the owner(s) directly.
Have been looking into different sandbox runtime choices. Here is a simple version of the comparison of three potential choices:
CAP_PERFMON
CAP_NET_ADMIN
CAP_SYS_ADMIN
or CAP_BPF
for loading eBPF programs, unless unprivileged eBPF is enabledmounts
in config.json
cargo run ubuntu:latest
to run docker image!?), and is not really portable.wasmtime --dir
.There are prior research on cross-over between each of these options. I've been busy these two weeks. Will update a more detail post for prior arts afterward.
The biggest challenge I am seeing now is spawning external processes. Most build script usages invoke some external binaries, like pkg-config
for building *-sys
crates, or protoc
for generating protobuf bindings. If process spawning is that common, we need to find a way to provide a fine-grained permission granting scheme. I don't want it to see an βall-or-nothingβ mechanism when process spawning is needed.
The other huge headache is setting library search paths. We cannot know every possible path of system libraries ahead of time, but we need to grant access to the runtime.
None.
None.
Having a family urgency. I will be back after RustConf.
Summary
Explore different strategies for sandboxing build script executions in Cargo.
Tasks and status