(
command: Vec<String>,
workdir: Option<String>,
timeout_secs: u64,
interactive: bool,
sandbox_id: Option<String>,
sandbox: Option<String>,
openshell_endpoint: Option<Strin
| 81 | clippy::fn_params_excessive_bools |
| 82 | )] |
| 83 | pub async fn run_sandbox( |
| 84 | command: Vec<String>, |
| 85 | workdir: Option<String>, |
| 86 | timeout_secs: u64, |
| 87 | interactive: bool, |
| 88 | sandbox_id: Option<String>, |
| 89 | sandbox: Option<String>, |
| 90 | openshell_endpoint: Option<String>, |
| 91 | policy_rules: Option<String>, |
| 92 | policy_data: Option<String>, |
| 93 | ssh_socket_path: Option<String>, |
| 94 | _health_check: bool, |
| 95 | _health_port: u16, |
| 96 | inference_routes: Option<String>, |
| 97 | ocsf_enabled: Arc<std::sync::atomic::AtomicBool>, |
| 98 | network_enabled: bool, |
| 99 | process_enabled: bool, |
| 100 | ) -> Result<i32> { |
| 101 | let (program, args) = command |
| 102 | .split_first() |
| 103 | .ok_or_else(|| miette::miette!("No command specified"))?; |
| 104 | |
| 105 | // Initialize the process-wide OCSF context early so that events emitted |
| 106 | // during policy loading (filesystem config, validation) have a context. |
| 107 | // Proxy IP/port use defaults here; they are only significant for network |
| 108 | // events which happen after the netns is created. |
| 109 | { |
| 110 | let hostname = std::fs::read_to_string("/etc/hostname").map_or_else( |
| 111 | |_| "openshell-sandbox".to_string(), |
| 112 | |s| s.trim().to_string(), |
| 113 | ); |
| 114 | |
| 115 | if !openshell_ocsf::ctx::set_ctx(SandboxContext { |
| 116 | sandbox_id: sandbox_id.clone().unwrap_or_default(), |
| 117 | sandbox_name: sandbox.as_deref().unwrap_or_default().to_string(), |
| 118 | container_image: std::env::var("OPENSHELL_CONTAINER_IMAGE").unwrap_or_default(), |
| 119 | hostname, |
| 120 | product_version: openshell_core::VERSION.to_string(), |
| 121 | proxy_ip: std::net::IpAddr::from([127, 0, 0, 1]), |
| 122 | proxy_port: 3128, |
| 123 | }) { |
| 124 | debug!("OCSF context already initialized, keeping existing"); |
| 125 | } |
| 126 | } |
| 127 | |
| 128 | // Load policy and initialize OPA engine |
| 129 | let openshell_endpoint_for_proxy = openshell_endpoint.clone(); |
| 130 | let sandbox_name_for_agg = sandbox.clone(); |
| 131 | let (mut policy, opa_engine, retained_proto) = load_policy( |
| 132 | sandbox_id.clone(), |
| 133 | sandbox, |
| 134 | openshell_endpoint.clone(), |
| 135 | policy_rules, |
| 136 | policy_data, |
| 137 | ) |
| 138 | .await?; |
| 139 | |
| 140 | // Override the policy's process identity with the driver-resolved UID/GID |
no test coverage detected