Given a directory path and an optional user, create a directory suitable for use as a task sandbox. A task sandbox must be owned by the task user (if present) and have restricted permissions.
| 867 | // suitable for use as a task sandbox. A task sandbox must be owned |
| 868 | // by the task user (if present) and have restricted permissions. |
| 869 | Try<Nothing> createSandboxDirectory( |
| 870 | const string& directory, |
| 871 | const Option<string>& user) |
| 872 | { |
| 873 | Try<Nothing> mkdir = os::mkdir(directory); |
| 874 | if (mkdir.isError()) { |
| 875 | return Error("Failed to create directory: " + mkdir.error()); |
| 876 | } |
| 877 | |
| 878 | #ifndef __WINDOWS__ |
| 879 | // Since this is a sandbox directory containing private task data, |
| 880 | // we want to ensure that it is not accessible to "others". |
| 881 | Try<Nothing> chmod = os::chmod(directory, 0750); |
| 882 | if (chmod.isError()) { |
| 883 | return Error("Failed to chmod directory: " + chmod.error()); |
| 884 | } |
| 885 | |
| 886 | if (user.isSome()) { |
| 887 | Try<Nothing> chown = os::chown(user.get(), directory); |
| 888 | if (chown.isError()) { |
| 889 | // Attempt to clean up, but since we've already failed to chown, |
| 890 | // we don't check the return value here. |
| 891 | os::rmdir(directory); |
| 892 | |
| 893 | return Error( |
| 894 | "Failed to chown directory to '" + |
| 895 | user.get() + "': " + chown.error()); |
| 896 | } |
| 897 | } |
| 898 | #endif // __WINDOWS__ |
| 899 | |
| 900 | return Nothing(); |
| 901 | } |
| 902 | |
| 903 | |
| 904 | string createSlaveDirectory( |