1 // Copyright 2020 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // https://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include <libgen.h>
16 #include <syscall.h>
17
18 #include <cstdlib>
19 #include <iostream>
20
21 #include "jsonnet_sapi.sapi.h" // NOLINT(build/include)
22 #include "absl/flags/parse.h"
23 #include "absl/log/check.h"
24 #include "absl/log/globals.h"
25 #include "absl/log/initialize.h"
26 #include "sandboxed_api/util/fileops.h"
27 #include "sandboxed_api/util/path.h"
28
29 class JsonnetSapiSandbox : public JsonnetSandbox {
30 public:
JsonnetSapiSandbox(std::string in_file,std::string out_directory)31 explicit JsonnetSapiSandbox(std::string in_file, std::string out_directory)
32 : in_file_(std::move(in_file)),
33 out_directory_(std::move(out_directory)) {}
34
35 // We need a slightly different policy than the default one
ModifyPolicy(sandbox2::PolicyBuilder *)36 std::unique_ptr<sandbox2::Policy> ModifyPolicy(
37 sandbox2::PolicyBuilder*) override {
38 return sandbox2::PolicyBuilder()
39 .AllowStaticStartup()
40 .AllowOpen()
41 .AllowRead()
42 .AllowWrite()
43 .AllowStat()
44 .AllowSystemMalloc()
45 .AllowExit()
46 .AllowSyscalls({
47 __NR_futex,
48 __NR_close,
49 })
50 .AddDirectoryAt(sapi::file::CleanPath(&out_directory_[0]), "/output",
51 /*is_ro=*/false)
52 .AddDirectoryAt(dirname(&in_file_[0]), "/input", true)
53 .BuildOrDie();
54 }
55
56 private:
57 std::string in_file_;
58 std::string out_directory_;
59 };
60
JsonnetMain(std::string in_file,std::string out_file)61 absl::Status JsonnetMain(std::string in_file, std::string out_file) {
62 using sapi::file::JoinPath;
63 using sapi::file_util::fileops::Basename;
64
65 // Initialize sandbox.
66 JsonnetSapiSandbox sandbox(in_file, out_file);
67 SAPI_RETURN_IF_ERROR(sandbox.Init());
68
69 JsonnetApi api(&sandbox);
70
71 // Initialize library's main structure.
72 SAPI_ASSIGN_OR_RETURN(JsonnetVm * jsonnet_vm, api.c_jsonnet_make());
73 sapi::v::RemotePtr vm_pointer(jsonnet_vm);
74
75 // Read input file.
76 std::string in_file_in_sandboxee(JoinPath("/input", Basename(in_file)));
77 sapi::v::ConstCStr in_file_var(in_file_in_sandboxee.c_str());
78 SAPI_ASSIGN_OR_RETURN(char* input,
79 api.c_read_input(false, in_file_var.PtrBefore()));
80
81 // Process jsonnet data.
82 sapi::v::RemotePtr input_pointer(input);
83 sapi::v::Int error;
84 SAPI_ASSIGN_OR_RETURN(char* output, api.c_jsonnet_evaluate_snippet_multi(
85 &vm_pointer, in_file_var.PtrBefore(),
86 &input_pointer, error.PtrAfter()));
87 CHECK(!error.GetValue()) << "Jsonnet code evaluation failed: "
88 << error.GetValue() << "\n"
89 << "Make sure all files used by your jsonnet file "
90 "are in the same directory as your file.";
91
92 // Write data to file.
93 std::string out_file_in_sandboxee(JoinPath("/output", Basename(out_file)));
94 sapi::v::ConstCStr out_file_var(out_file_in_sandboxee.c_str());
95 sapi::v::RemotePtr output_pointer(output);
96
97 SAPI_ASSIGN_OR_RETURN(
98 bool success,
99 api.c_write_output_file(&output_pointer, out_file_var.PtrBefore()));
100 CHECK(success) << "Writing to output file failed: " << success;
101
102 // Clean up.
103 SAPI_ASSIGN_OR_RETURN(char* result,
104 api.c_jsonnet_realloc(&vm_pointer, &output_pointer, 0));
105 SAPI_RETURN_IF_ERROR(api.c_jsonnet_destroy(&vm_pointer));
106 SAPI_RETURN_IF_ERROR(api.c_free_input(&input_pointer));
107
108 return absl::OkStatus();
109 }
110
main(int argc,char * argv[])111 int main(int argc, char* argv[]) {
112 using sapi::file_util::fileops::Basename;
113
114 absl::SetStderrThreshold(absl::LogSeverityAtLeast::kInfo);
115 absl::ParseCommandLine(argc, argv);
116 absl::InitializeLog();
117
118 if (argc != 3) {
119 std::cerr << "Usage:\n"
120 << Basename(argv[0])
121 << " /absolute/path/to/INPUT.jsonnet /absolute/path/to/OUTPUT\n";
122 return EXIT_FAILURE;
123 }
124
125 std::string in_file(argv[1]);
126 std::string out_file(argv[2]);
127
128 absl::Status status = JsonnetMain(in_file, out_file);
129 if (!status.ok()) {
130 LOG(ERROR) << "Failed: " << status.ToString();
131 return EXIT_FAILURE;
132 }
133
134 return EXIT_SUCCESS;
135 }
136