Function wrap_command_with_bubblewrap

src/execution/mod.rs:42–97

Wrap a command with bubblewrap sandbox to isolate network access Returns true if bubblewrap was applied, false otherwise

(
    binary: &Path,
    extra_args: &Vec<S>,
    extra_envs: &Vec<(S, S)>,
    asan_options: &str,
    fuzzer_args: &[String],
)

/// Wrap a command with bubblewrap sandbox to isolate network access
/// Returns true if bubblewrap was applied, false otherwise
fn wrap_command_with_bubblewrap<S: AsRef<OsStr> + Debug>(
    binary: &Path,
    extra_args: &Vec<S>,
    extra_envs: &Vec<(S, S)>,
    asan_options: &str,
    fuzzer_args: &[String],
) -> Command {

    // Reset the command to use bwrap as the main executable
    let mut cmd = Command::new("bwrap");
    
    
    // Mount essential system directories as read-only
    cmd.arg("--ro-bind").arg("/").arg("/");
    cmd.arg("--proc").arg("/proc");
    cmd.arg("--dev").arg("/dev");
    cmd.arg("--tmpfs").arg("/tmp");


    // Deny network access
    cmd.arg("--unshare-net");
    //cmd.arg("--unshare-pid");
    cmd.arg("--die-with-parent");
    cmd.arg("--new-session");
    
    // Mount the working directory with read-write access
    //let workspace_root = std::env::current_dir().unwrap_or_else(|_| PathBuf::from("/"));
    cmd.arg("--bind").arg(Deopt::get_crate_dir().unwrap()).arg(Deopt::get_crate_dir().unwrap());
    
    // Pass through environment variables
    for (key, val) in extra_envs {
        cmd.arg("--setenv")
            .arg(key.as_ref())
            .arg(val.as_ref());
    }
    
    // Set ASAN_OPTIONS
    cmd.arg("--setenv").arg("ASAN_OPTIONS").arg(asan_options);
    cmd.arg("stdbuf").arg("-oL").arg("-eL");
    
    // Add the actual binary to execute
    cmd.arg(binary);
    
    // Add fuzzer-specific arguments
    for arg in fuzzer_args {
        cmd.arg(arg);
    }
    
    // Add extra arguments
    for arg in extra_args {
        cmd.arg(arg.as_ref());
    }
    
    log::trace!("Running with bubblewrap sandbox: {:?}", cmd);
    return cmd;
}

#[derive(Debug, Clone, clap::ValueEnum, PartialEq)]