Bump actions/checkout from 6 to 7

.github/workflows/test.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Rust toolchain
         run: |

Cargo.toml

@@ -5,9 +5,9 @@ description = "Cross-platform embeddable sandbox"
 authors = ["Phylum, Inc. <engineering@phylum.io>"]
 repository = "https://github.com/phylum-dev/birdcage"
 documentation = "https://docs.rs/birdcage"
-rust-version = "1.70.0"
+rust-version = "1.85.0"
 license = "GPL-3.0-or-later"
-edition = "2021"
+edition = "2024"
 
 [[test]]
 name = "harness"

integration/command_io.rs

@@ -1,8 +1,10 @@
-use std::io::Write;
-use std::os::unix::process::ExitStatusExt;
-
-use birdcage::process::{Command, Stdio};
-use birdcage::{Birdcage, Exception, Sandbox};
+#[cfg(target_os = "linux")]
+use {
+    birdcage::process::{Command, Stdio},
+    birdcage::{Birdcage, Exception, Sandbox},
+    std::io::Write,
+    std::os::unix::process::ExitStatusExt,
+};
 
 // macOs uses `std::process` and thus does not require explicit testing. This
 // allows running multiple tests in the same process rather than having to add

integration/env.rs

@@ -7,8 +7,8 @@ use crate::TestSetup;
 
 pub fn setup(_tempdir: PathBuf) -> TestSetup {
     // Setup our environment variables
-    env::set_var("PUBLIC", "GOOD");
-    env::set_var("PRIVATE", "BAD");
+    unsafe { env::set_var("PUBLIC", "GOOD") };
+    unsafe { env::set_var("PRIVATE", "BAD") };
 
     // Activate our sandbox.
     let mut sandbox = Birdcage::new();

integration/full_env.rs

@@ -7,7 +7,7 @@ use crate::TestSetup;
 
 pub fn setup(_tempdir: PathBuf) -> TestSetup {
     // Setup our environment variables
-    env::set_var("PUBLIC", "GOOD");
+    unsafe { env::set_var("PUBLIC", "GOOD") };
 
     // Activate our sandbox.
     let mut sandbox = Birdcage::new();

integration/full_sandbox.rs

@@ -36,7 +36,7 @@ pub fn setup(tempdir: PathBuf) -> TestSetup {
     assert!(cmd.is_ok());
 
     // Ensure non-sandboxed env access works.
-    env::set_var("TEST", "value");
+    unsafe { env::set_var("TEST", "value") };
     assert_eq!(env::var("TEST"), Ok("value".into()));
 
     // Setup birdcage sandbox.

src/lib.rs

@@ -121,6 +121,6 @@ pub(crate) fn restrict_env_variables(exceptions: &[String]) {
     // Invalid unicode will cause `env::vars()` to panic, so we don't have to worry
     // about them getting ignored.
     for (key, _) in env::vars().filter(|(key, _)| !exceptions.contains(key)) {
-        env::remove_var(key);
+        unsafe { env::remove_var(key) };
     }
 }

src/linux/namespaces.rs

@@ -170,11 +170,7 @@ fn mount_tmpfs(dst: &CStr) -> io::Result<()> {
         libc::mount(ptr::null(), dst.as_ptr(), fstype.as_ptr(), flags.bits(), ptr::null())
     };
 
-    if res == 0 {
-        Ok(())
-    } else {
-        Err(IoError::last_os_error())
-    }
+    if res == 0 { Ok(()) } else { Err(IoError::last_os_error()) }
 }
 
 /// Mount a new procfs.
@@ -185,11 +181,7 @@ pub fn mount_proc(dst: &CStr) -> io::Result<()> {
         libc::mount(fstype.as_ptr(), dst.as_ptr(), fstype.as_ptr(), flags.bits(), ptr::null())
     };
 
-    if res == 0 {
-        Ok(())
-    } else {
-        Err(IoError::last_os_error())
-    }
+    if res == 0 { Ok(()) } else { Err(IoError::last_os_error()) }
 }
 
 /// Create a new bind mount.
@@ -198,11 +190,7 @@ fn bind_mount(src: &CStr, dst: &CStr) -> io::Result<()> {
     let res =
         unsafe { libc::mount(src.as_ptr(), dst.as_ptr(), ptr::null(), flags.bits(), ptr::null()) };
 
-    if res == 0 {
-        Ok(())
-    } else {
-        Err(IoError::last_os_error())
-    }
+    if res == 0 { Ok(()) } else { Err(IoError::last_os_error()) }
 }
 
 /// Remount an existing bind mount with a new set of mount flags.
@@ -220,11 +208,7 @@ fn update_mount_flags(mount: &CStr, flags: MountAttrFlags) -> io::Result<()> {
         )
     };
 
-    if res == 0 {
-        Ok(())
-    } else {
-        Err(IoError::last_os_error())
-    }
+    if res == 0 { Ok(()) } else { Err(IoError::last_os_error()) }
 }
 
 /// Recursively update the root to deny mount propagation.
@@ -234,11 +218,7 @@ fn deny_mount_propagation() -> io::Result<()> {
     let res =
         unsafe { libc::mount(ptr::null(), root.as_ptr(), ptr::null(), flags.bits(), ptr::null()) };
 
-    if res == 0 {
-        Ok(())
-    } else {
-        Err(IoError::last_os_error())
-    }
+    if res == 0 { Ok(()) } else { Err(IoError::last_os_error()) }
 }
 
 /// Change root directory to `new_root` and mount the old root in `put_old`.

src/macos.rs

@@ -233,7 +233,7 @@ fn escape_path(path: &Path) -> Result<String> {
     Ok(format!("\"{path_str}\""))
 }
 
-extern "C" {
+unsafe extern "C" {
     fn sandbox_init(profile: *const i8, flags: u64, errorbuf: *mut *mut i8) -> i32;
     fn sandbox_free_error(errorbuf: *mut i8);
 }

src/process/linux.rs

@@ -659,11 +659,7 @@ impl Stdio {
             },
             StdioType::Null => {
                 let null_fd = rustix::fs::open("/dev/null", OFlags::RDWR, Mode::empty())?;
-                if stdin {
-                    Ok((Some(null_fd), None))
-                } else {
-                    Ok((None, Some(null_fd)))
-                }
+                if stdin { Ok((Some(null_fd), None)) } else { Ok((None, Some(null_fd))) }
             },
         }
     }