| 1 | //! Windows sandbox helper contract. |
| 2 | //! |
| 3 | //! Current status: CodeWhale does not advertise an in-process Windows |
| 4 | //! sandbox. Future Windows support must run commands through a dedicated |
| 5 | //! helper that provides process-tree containment with a Job Object and |
| 6 | //! `JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE`. |
| 7 | //! |
| 8 | //! The first Windows helper slice is process containment only. It must not |
| 9 | //! claim read-only filesystem isolation, workspace-write enforcement, network |
| 10 | //! blocking, registry isolation, or AppContainer-level isolation until those |
| 11 | //! guarantees are implemented and tested separately. |
| 12 | |
| 13 | use std::path::Path; |
| 14 | |
| 15 | use super::SandboxPolicy; |
| 16 | |
| 17 | #[derive(Debug, Clone, Copy, PartialEq, Eq)] |
| 18 | pub enum WindowsSandboxKind { |
| 19 | ProcessContainment, |
| 20 | } |
| 21 | |
| 22 | impl std::fmt::Display for WindowsSandboxKind { |
| 23 | fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { |
| 24 | match self { |
| 25 | WindowsSandboxKind::ProcessContainment => write!(f, "process-containment"), |
| 26 | } |
| 27 | } |
| 28 | } |
| 29 | |
| 30 | pub fn is_available() -> bool { |
| 31 | false |
| 32 | } |
| 33 | |
| 34 | pub fn select_best_kind(_policy: &SandboxPolicy, _cwd: &Path) -> WindowsSandboxKind { |
| 35 | WindowsSandboxKind::ProcessContainment |
| 36 | } |
| 37 | |
| 38 | pub fn detect_denial(exit_code: i32, stderr: &str) -> bool { |
| 39 | if exit_code == 0 { |
| 40 | return false; |
| 41 | } |
| 42 | |
| 43 | let patterns = [ |
| 44 | "Access is denied", |
| 45 | "access denied", |
| 46 | "STATUS_ACCESS_DENIED", |
| 47 | "privilege", |
| 48 | "AppContainer", |
| 49 | "sandbox", |
| 50 | ]; |
| 51 | |
| 52 | patterns.iter().any(|p| stderr.contains(p)) |
| 53 | } |
| 54 | #[cfg(test)] |
| 55 | mod tests { |
| 56 | use super::*; |
| 57 | |
| 58 | #[test] |
| 59 | fn windows_sandbox_is_not_advertised_until_helper_exists() { |
| 60 | assert!(!is_available()); |
| 61 | assert_eq!( |
| 62 | select_best_kind(&SandboxPolicy::default(), Path::new(".")), |
| 63 | WindowsSandboxKind::ProcessContainment |
| 64 | ); |
| 65 | } |
| 66 | } |
| 67 |