Process::{syd,sand}box

2 files changed, 69 insertions, 0 deletions

diff --git a/paludis/util/process.cc b/paludis/util/process.cc
index 750473e7e..25fe95ca9 100644
--- a/paludis/util/process.cc
+++ b/paludis/util/process.cc
@@ -25,6 +25,8 @@
 #include <paludis/util/fs_entry.hh>
 #include <paludis/util/stringify.hh>
 #include <paludis/util/safe_ofstream.hh>
+#include <paludis/util/log.hh>
+#include <paludis/util/system.hh>
 
 #include <iostream>
 #include <functional>
@@ -74,6 +76,12 @@ ProcessCommand::ProcessCommand(ProcessCommand && other) :
 ProcessCommand::~ProcessCommand() = default;
 
 void
+ProcessCommand::prepend_args(const std::initializer_list<std::string> & l)
+{
+    _imp->args.insert(_imp->args.begin(), l);
+}
+
+void
 ProcessCommand::exec()
 {
     if (_imp->args.size() < 1)
@@ -698,6 +706,62 @@ Process::prefix_stderr(const std::string & s)
     return *this;
 }
 
+namespace
+{
+    bool check_cmd(const std::string & s)
+    {
+        bool result(0 == Process(ProcessCommand({ "sh", "-c", s + " --version >/dev/null 2>/dev/null" })).run().wait());
+        if (! result)
+            Log::get_instance()->message("util.system.boxless", ll_warning, lc_context) <<
+                "I don't seem to be able to use " + s;
+        return result;
+    }
+}
+
+Process &
+Process::sandbox()
+{
+    static bool can_use_sandbox(check_cmd("sandbox"));
+
+    if (can_use_sandbox)
+    {
+        if (! getenv_with_default("PALUDIS_DO_NOTHING_SANDBOXY", "").empty())
+            Log::get_instance()->message("util.system.nothing_sandboxy", ll_debug, lc_no_context)
+                << "PALUDIS_DO_NOTHING_SANDBOXY is set, not using sandbox";
+        else if (! getenv_with_default("SANDBOX_ACTIVE", "").empty())
+            Log::get_instance()->message("util.system.sandbox_in_sandbox", ll_warning, lc_no_context)
+                << "Already inside sandbox, not spawning another sandbox instance";
+        else
+        {
+            _imp->command.prepend_args({ "sandbox" });
+            if (getenv_with_default("BASH_ENV", "").empty())
+                setenv("BASH_ENV", "/dev/null");
+        }
+    }
+
+    return *this;
+}
+
+Process &
+Process::sydbox()
+{
+    static bool can_use_sydbox(check_cmd("sydbox"));
+
+    if (can_use_sydbox)
+    {
+        if (! getenv_with_default("PALUDIS_DO_NOTHING_SANDBOXY", "").empty())
+            Log::get_instance()->message("util.system.nothing_sandboxy", ll_debug, lc_no_context)
+                << "PALUDIS_DO_NOTHING_SANDBOXY is set, not using sydbox";
+        else if (! getenv_with_default("SYDBOX_ACTIVE", "").empty())
+            Log::get_instance()->message("util.system.sandbox_in_sandbox", ll_warning, lc_no_context)
+                << "Already inside sydbox, not spawning another sydbox instance";
+        else
+            _imp->command.prepend_args({ "sydbox", "--profile", "paludis", "--" });
+    }
+
+    return *this;
+}
+
 namespace paludis
 {
     template <>
diff --git a/paludis/util/process.hh b/paludis/util/process.hh
index 1ec4b2408..6703a270b 100644
--- a/paludis/util/process.hh
+++ b/paludis/util/process.hh
@@ -61,6 +61,8 @@ namespace paludis
             ProcessCommand(const ProcessCommand &) = delete;
             ProcessCommand & operator= (const ProcessCommand &) = delete;
 
+            void prepend_args(const std::initializer_list<std::string> &);
+
             void echo_command_to(std::ostream &);
 
             void exec() PALUDIS_ATTRIBUTE((noreturn));
@@ -94,6 +96,9 @@ namespace paludis
 
             Process & prefix_stdout(const std::string &);
             Process & prefix_stderr(const std::string &);
+
+            Process & sandbox();
+            Process & sydbox();
     };
 
     class PALUDIS_VISIBLE RunningProcessHandle :