Method Exec

pkg/sandbox/local.go:375–443

Exec 执行命令

(ctx context.Context, cmd string, opts *ExecOptions)

// Exec 执行命令
func (ls *LocalSandbox) Exec(ctx context.Context, cmd string, opts *ExecOptions) (*ExecResult, error) {
	startTime := time.Now()
	cmdName := ls.extractCommandName(cmd)

	// 1. 检查是否为排除命令（直接执行，但仍有关键安全检查）
	if ls.isExcludedCommand(cmd) {
		result, err := ls.execDirect(ctx, cmd, opts)
		if err != nil {
			return nil, err
		}
		ls.recordAudit(cmd, opts, result, startTime, false, "excluded_command")
		return result, nil
	}

	// 2. 检查是否在阻止列表
	if ls.blockedCommands[cmdName] {
		ls.recordAudit(cmd, opts, nil, startTime, true, "command in blocklist")
		return &ExecResult{
			Code:   1,
			Stdout: "",
			Stderr: fmt.Sprintf("Command '%s' is blocked by security policy", cmdName),
		}, nil
	}

	// 3. 严格模式：检查命令白名单
	if ls.securityLevel >= SecurityLevelStrict {
		if !allowedCommands[cmdName] && !ls.isExcludedCommand(cmd) {
			ls.recordAudit(cmd, opts, nil, startTime, true, "command not in whitelist")
			return &ExecResult{
				Code:   1,
				Stdout: "",
				Stderr: fmt.Sprintf("Command '%s' is not in the allowed list (strict mode)", cmdName),
			}, nil
		}
	}

	// 4. 安全检查：阻止危险命令
	if blockReason := ls.checkDangerousCommand(cmd); blockReason != "" {
		ls.recordAudit(cmd, opts, nil, startTime, true, blockReason)
		return &ExecResult{
			Code:   1,
			Stdout: "",
			Stderr: "Dangerous command blocked: " + blockReason,
		}, nil
	}

	// 5. 路径安全检查
	if ls.securityLevel >= SecurityLevelStrict {
		if pathIssue := ls.checkPathSecurity(cmd); pathIssue != "" {
			ls.recordAudit(cmd, opts, nil, startTime, true, pathIssue)
			return &ExecResult{
				Code:   1,
				Stdout: "",
				Stderr: "Path security violation: " + pathIssue,
			}, nil
		}
	}