fortify/internal/sandbox/tmpfs.go
Ophestra 8eef266d31
Some checks failed
Test / Create distribution (push) Successful in 26s
Test / Fpkg (push) Successful in 35s
Test / Fortify (push) Failing after 2m8s
Test / Data race detector (push) Failing after 2m34s
Test / Flake checks (push) Has been skipped
sandbox: implement native container tool
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-13 01:06:23 +09:00

43 lines
960 B
Go

package sandbox
import (
"encoding/gob"
"fmt"
"math"
"os"
"path"
"syscall"
)
func init() { gob.Register(new(MountTmpfs)) }
type MountTmpfs struct {
Path string
Size int
Mode os.FileMode
}
func (t *MountTmpfs) apply() error {
if !path.IsAbs(t.Path) || t.Size < 0 || t.Size > math.MaxUint>>1 {
return syscall.EBADE
}
target := toSysroot(t.Path)
if err := os.MkdirAll(target, 0755); err != nil {
return err
}
opt := fmt.Sprintf("mode=%#o", t.Mode)
if t.Size > 0 {
opt += fmt.Sprintf(",size=%d", t.Mode)
}
return syscall.Mount("tmpfs", target, "tmpfs",
syscall.MS_NOSUID|syscall.MS_NODEV,
opt)
}
func (t *MountTmpfs) Is(op FSOp) bool { vt, ok := op.(*MountTmpfs); return ok && *t == *vt }
func (t *MountTmpfs) String() string { return fmt.Sprintf("tmpfs on %q size %d", t.Path, t.Size) }
func (f *Filesystem) Tmpfs(dest string, size int, mode os.FileMode) *Filesystem {
*f = append(*f, &MountTmpfs{dest, size, mode})
return f
}