| 1148 | ) |
| 1149 | )] |
| 1150 | pub fn install_pre_exec_no_pty( |
| 1151 | cmd: &mut Command, |
| 1152 | policy: SandboxPolicy, |
| 1153 | _workdir: Option<String>, |
| 1154 | netns_fd: Option<RawFd>, |
| 1155 | #[cfg(target_os = "linux")] prepared: crate::sandbox::linux::PreparedSandbox, |
| 1156 | ) -> anyhow::Result<()> { |
| 1157 | #[cfg(target_os = "linux")] |
| 1158 | let mut prepared = Some(prepared); |
| 1159 | #[cfg(target_os = "linux")] |
| 1160 | let supervisor_identity_mount = crate::process::supervisor_identity_mount_from_env() |
| 1161 | .map_err(|err| { |
| 1162 | anyhow::anyhow!("failed to prepare supervisor identity isolation: {err}") |
| 1163 | })?; |
| 1164 | unsafe { |
| 1165 | cmd.pre_exec(move || { |
| 1166 | enter_netns_and_sandbox( |
| 1167 | netns_fd, |
| 1168 | &policy, |
| 1169 | #[cfg(target_os = "linux")] |
| 1170 | supervisor_identity_mount, |
| 1171 | #[cfg(target_os = "linux")] |
| 1172 | prepared.take(), |
| 1173 | ) |
| 1174 | }); |
| 1175 | } |
| 1176 | Ok(()) |
| 1177 | } |
| 1178 | |
| 1179 | fn enter_netns_and_sandbox( |
| 1180 | netns_fd: Option<RawFd>, |