(
sandbox: Callable[..., Sandbox],
)
| 359 | |
| 360 | |
| 361 | def test_policy_applies_to_exec_commands( |
| 362 | sandbox: Callable[..., Sandbox], |
| 363 | ) -> None: |
| 364 | def current_user() -> str: |
| 365 | import os |
| 366 | import pwd |
| 367 | |
| 368 | return pwd.getpwuid(os.getuid()).pw_name |
| 369 | |
| 370 | def write_allowed_files() -> str: |
| 371 | from pathlib import Path |
| 372 | |
| 373 | Path("/sandbox/allowed.txt").write_text("ok") |
| 374 | Path("/tmp/allowed.txt").write_text("ok") |
| 375 | return "ok" |
| 376 | |
| 377 | spec = datamodel_pb2.SandboxSpec(policy=_policy_for_python_proxy_tests()) |
| 378 | |
| 379 | with sandbox(spec=spec, delete_on_exit=True) as policy_sandbox: |
| 380 | user_result = policy_sandbox.exec_python(current_user) |
| 381 | assert user_result.exit_code == 0, user_result.stderr |
| 382 | assert user_result.stdout.strip() == "sandbox" |
| 383 | |
| 384 | file_result = policy_sandbox.exec_python(write_allowed_files) |
| 385 | assert file_result.exit_code == 0, file_result.stderr |
| 386 | assert file_result.stdout.strip() == "ok" |
| 387 | |
| 388 | |
| 389 | def test_policy_blocks_unauthorized_proxy_connect( |
nothing calls this directly
no test coverage detected