cage

Documentation

Index

• Constants
• type Cage
  • func New(cage *DefaultCage, runtime defaultCageRuntime) Cage
• type DefaultCage
  • func (c *DefaultCage) Encage(monster *exec.Cmd) (*exec.Cmd, error)
  • func (c *DefaultCage) Execute() error

Constants

const (
	// CommandLine is the command-line command used to invoke the cage.
	CommandLine = "cage" // TODO rename to CommandLine

	// CommandLineFlagPrefix is the prefix to be prepended to a flag name to get a valid
	// command-line.
	CommandLineFlagPrefix = "--"

	// TimeLimitFlag is the command line flag for cage to set the TimeLimit option.
	TimeLimitFlag = "time-limit"

	// ExecPathFlag is the command line flag for cage to set the ExecPath property.
	ExecPathFlag = "exec-path"

	// ExecArgsFlag is the command line flag for cage to set the ExecArgs property.
	ExecArgsFlag = "exec-args"
)

Types

type Cage

type Cage interface {
	// Encage encages the given command, returning a command that will invoke the cage with
	// the arguments necessary to run the given command.
	Encage(monster *exec.Cmd) (*exec.Cmd, error)

	// Execute installs the restrictions in the current process and then executes the command.
	Execute() error
}

Cage offers a safe environment to execute a command through a set of restriction options.

func New

func New(cage *DefaultCage, runtime defaultCageRuntime) Cage

New instantiates a default cage and/or a default runtime and returns them.

type DefaultCage

type DefaultCage struct {
	// TimeLimit is the maximum time duration for which the process can stay running,
	// before SIGXCPU signal is sent.
	TimeLimit *time.Duration

	// ExecPath is the path to binary/script executable to be executed, and will be passed to
	// unix.Exec() as the (first) argv0 argument.
	ExecPath string

	// ExecArgs are the arguments to be passed to unix.Exec() (through argument argv).
	ExecArgs []string
	// contains filtered or unexported fields
}

DefaultCage is the default implementation for Cage. Uses the golang.org/x/sys/unix package.

func (*DefaultCage) Encage

func (c *DefaultCage) Encage(monster *exec.Cmd) (*exec.Cmd, error)

Encage encages the given command, returning a command that will invoke the cage with the arguments necessary to run the given command.

func (*DefaultCage) Execute

func (c *DefaultCage) Execute() error

Execute installs the restrictions in the current process and then does the actual unix.Exec().