diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 4fca0b9..2443df2 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -24,7 +24,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Install Rust toolchain run: | diff --git a/Cargo.toml b/Cargo.toml index 3ebbe5a..b386a34 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -5,9 +5,9 @@ description = "Cross-platform embeddable sandbox" authors = ["Phylum, Inc. "] repository = "https://github.com/phylum-dev/birdcage" documentation = "https://docs.rs/birdcage" -rust-version = "1.70.0" +rust-version = "1.85.0" license = "GPL-3.0-or-later" -edition = "2021" +edition = "2024" [[test]] name = "harness" diff --git a/integration/command_io.rs b/integration/command_io.rs index ea03838..a419ad9 100644 --- a/integration/command_io.rs +++ b/integration/command_io.rs @@ -1,8 +1,10 @@ -use std::io::Write; -use std::os::unix::process::ExitStatusExt; - -use birdcage::process::{Command, Stdio}; -use birdcage::{Birdcage, Exception, Sandbox}; +#[cfg(target_os = "linux")] +use { + birdcage::process::{Command, Stdio}, + birdcage::{Birdcage, Exception, Sandbox}, + std::io::Write, + std::os::unix::process::ExitStatusExt, +}; // macOs uses `std::process` and thus does not require explicit testing. This // allows running multiple tests in the same process rather than having to add diff --git a/integration/env.rs b/integration/env.rs index b9a4670..3e7347d 100644 --- a/integration/env.rs +++ b/integration/env.rs @@ -7,8 +7,8 @@ use crate::TestSetup; pub fn setup(_tempdir: PathBuf) -> TestSetup { // Setup our environment variables - env::set_var("PUBLIC", "GOOD"); - env::set_var("PRIVATE", "BAD"); + unsafe { env::set_var("PUBLIC", "GOOD") }; + unsafe { env::set_var("PRIVATE", "BAD") }; // Activate our sandbox. let mut sandbox = Birdcage::new(); diff --git a/integration/full_env.rs b/integration/full_env.rs index a9372e0..916d612 100644 --- a/integration/full_env.rs +++ b/integration/full_env.rs @@ -7,7 +7,7 @@ use crate::TestSetup; pub fn setup(_tempdir: PathBuf) -> TestSetup { // Setup our environment variables - env::set_var("PUBLIC", "GOOD"); + unsafe { env::set_var("PUBLIC", "GOOD") }; // Activate our sandbox. let mut sandbox = Birdcage::new(); diff --git a/integration/full_sandbox.rs b/integration/full_sandbox.rs index b83038c..d5f6c6e 100644 --- a/integration/full_sandbox.rs +++ b/integration/full_sandbox.rs @@ -36,7 +36,7 @@ pub fn setup(tempdir: PathBuf) -> TestSetup { assert!(cmd.is_ok()); // Ensure non-sandboxed env access works. - env::set_var("TEST", "value"); + unsafe { env::set_var("TEST", "value") }; assert_eq!(env::var("TEST"), Ok("value".into())); // Setup birdcage sandbox. diff --git a/src/lib.rs b/src/lib.rs index f7e077c..eae0bc8 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -121,6 +121,6 @@ pub(crate) fn restrict_env_variables(exceptions: &[String]) { // Invalid unicode will cause `env::vars()` to panic, so we don't have to worry // about them getting ignored. for (key, _) in env::vars().filter(|(key, _)| !exceptions.contains(key)) { - env::remove_var(key); + unsafe { env::remove_var(key) }; } } diff --git a/src/linux/namespaces.rs b/src/linux/namespaces.rs index c27bd70..7a97109 100644 --- a/src/linux/namespaces.rs +++ b/src/linux/namespaces.rs @@ -170,11 +170,7 @@ fn mount_tmpfs(dst: &CStr) -> io::Result<()> { libc::mount(ptr::null(), dst.as_ptr(), fstype.as_ptr(), flags.bits(), ptr::null()) }; - if res == 0 { - Ok(()) - } else { - Err(IoError::last_os_error()) - } + if res == 0 { Ok(()) } else { Err(IoError::last_os_error()) } } /// Mount a new procfs. @@ -185,11 +181,7 @@ pub fn mount_proc(dst: &CStr) -> io::Result<()> { libc::mount(fstype.as_ptr(), dst.as_ptr(), fstype.as_ptr(), flags.bits(), ptr::null()) }; - if res == 0 { - Ok(()) - } else { - Err(IoError::last_os_error()) - } + if res == 0 { Ok(()) } else { Err(IoError::last_os_error()) } } /// Create a new bind mount. @@ -198,11 +190,7 @@ fn bind_mount(src: &CStr, dst: &CStr) -> io::Result<()> { let res = unsafe { libc::mount(src.as_ptr(), dst.as_ptr(), ptr::null(), flags.bits(), ptr::null()) }; - if res == 0 { - Ok(()) - } else { - Err(IoError::last_os_error()) - } + if res == 0 { Ok(()) } else { Err(IoError::last_os_error()) } } /// Remount an existing bind mount with a new set of mount flags. @@ -220,11 +208,7 @@ fn update_mount_flags(mount: &CStr, flags: MountAttrFlags) -> io::Result<()> { ) }; - if res == 0 { - Ok(()) - } else { - Err(IoError::last_os_error()) - } + if res == 0 { Ok(()) } else { Err(IoError::last_os_error()) } } /// Recursively update the root to deny mount propagation. @@ -234,11 +218,7 @@ fn deny_mount_propagation() -> io::Result<()> { let res = unsafe { libc::mount(ptr::null(), root.as_ptr(), ptr::null(), flags.bits(), ptr::null()) }; - if res == 0 { - Ok(()) - } else { - Err(IoError::last_os_error()) - } + if res == 0 { Ok(()) } else { Err(IoError::last_os_error()) } } /// Change root directory to `new_root` and mount the old root in `put_old`. diff --git a/src/macos.rs b/src/macos.rs index 6d5e0fc..51119b5 100644 --- a/src/macos.rs +++ b/src/macos.rs @@ -233,7 +233,7 @@ fn escape_path(path: &Path) -> Result { Ok(format!("\"{path_str}\"")) } -extern "C" { +unsafe extern "C" { fn sandbox_init(profile: *const i8, flags: u64, errorbuf: *mut *mut i8) -> i32; fn sandbox_free_error(errorbuf: *mut i8); } diff --git a/src/process/linux.rs b/src/process/linux.rs index d21786a..ded68c7 100644 --- a/src/process/linux.rs +++ b/src/process/linux.rs @@ -659,11 +659,7 @@ impl Stdio { }, StdioType::Null => { let null_fd = rustix::fs::open("/dev/null", OFlags::RDWR, Mode::empty())?; - if stdin { - Ok((Some(null_fd), None)) - } else { - Ok((None, Some(null_fd))) - } + if stdin { Ok((Some(null_fd), None)) } else { Ok((None, Some(null_fd))) } }, } }