mirror of
https://github.com/zed-industries/zed.git
synced 2026-07-09 16:00:35 +00:00
4a99aa870e
Large change to sandboxing: - fixes a nasty TOCTOU relating to a symlink swap attack, documented in the `sandboxing/README.md` - Adds UI and restrictions when in an untrusted workspace - Adds tests for (soon to be removed) git support --- Release Notes: - N/A or Added/Fixed/Improved ...
69 lines
2.3 KiB
TOML
69 lines
2.3 KiB
TOML
[package]
|
|
name = "sandbox"
|
|
version = "0.1.0"
|
|
edition.workspace = true
|
|
publish.workspace = true
|
|
license = "GPL-3.0-or-later"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[lib]
|
|
path = "src/sandbox.rs"
|
|
|
|
[features]
|
|
# Builds `bwrap_test_helper`, the behavior helper driven by the NixOS sandbox
|
|
# VM tests in `nix/tests/sandboxing`. Off by default so normal builds don't
|
|
# produce the test binary. Pulls in serde only when enabled (the helper parses
|
|
# its check list as JSON), and enables the matching `http_proxy` escape hatch so
|
|
# the in-process proxy can reach the VM's private-network echo servers.
|
|
nixos-test = [
|
|
"dep:serde",
|
|
"dep:serde_json",
|
|
"http_proxy/nixos-integration-tests",
|
|
]
|
|
|
|
# Builds `wsl_sandbox_test_helper`, the Windows analog of `bwrap_test_helper`.
|
|
# It drives the real WSL/Bubblewrap sandbox end-to-end (see
|
|
# `script/test-wsl-sandbox.ps1` / `cargo xtask wsl-sandbox-tests`). Off by
|
|
# default so normal builds and the workspace test run don't produce it.
|
|
wsl-test = []
|
|
|
|
# Behavior test helper for the Linux Bubblewrap sandbox. Only built when the
|
|
# `nixos-test` feature is enabled (and only meaningful on Linux).
|
|
[[bin]]
|
|
name = "bwrap_test_helper"
|
|
path = "src/bwrap_test_helper.rs"
|
|
required-features = ["nixos-test"]
|
|
|
|
# Behavior test helper for the Windows WSL/Bubblewrap sandbox. Only built when
|
|
# the `wsl-test` feature is enabled (and only meaningful on Windows).
|
|
[[bin]]
|
|
name = "wsl_sandbox_test_helper"
|
|
path = "src/wsl_sandbox_test_helper.rs"
|
|
required-features = ["wsl-test"]
|
|
|
|
[dependencies]
|
|
anyhow.workspace = true
|
|
futures.workspace = true
|
|
http_proxy.workspace = true
|
|
log.workspace = true
|
|
# Used only by the `nixos-test` helper binary to parse its check list; gated
|
|
# behind the `nixos-test` feature so normal builds don't pull it in.
|
|
serde = { workspace = true, optional = true }
|
|
serde_json = { workspace = true, optional = true }
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
libc.workspace = true
|
|
# Safe wrappers for the SCM_RIGHTS fd-passing and `fstat` the bind validator
|
|
# needs, so that code doesn't hand-roll `msghdr`/`CMSG_*`/`mem::zeroed` unsafe.
|
|
nix = { workspace = true, features = ["fs", "socket", "uio"] }
|
|
|
|
[target.'cfg(target_os = "linux")'.dev-dependencies]
|
|
tempfile.workspace = true
|
|
|
|
[target.'cfg(target_os = "macos")'.dependencies]
|
|
tempfile.workspace = true
|
|
|
|
[target.'cfg(target_os = "windows")'.dependencies]
|
|
smol.workspace = true
|