surma
9e9cde5241
Throwaway prototypes for Sausage v3. Plan and decisions: ~/research/sausage-v3/PLAN.md. Results and evidence: the spike READMEs.
18 lines
688 B
Rust
18 lines
688 B
Rust
//! Asserts that native build scripts cannot access host files or the network.
|
|
use std::{
|
|
env, fs,
|
|
net::{SocketAddr, TcpStream},
|
|
time::Duration,
|
|
};
|
|
|
|
fn main() {
|
|
let home = env::var("HOME").unwrap();
|
|
assert!(fs::read_dir(format!("{home}/.ssh")).is_err());
|
|
assert!(fs::read_dir("/home/surma/.ssh").is_err());
|
|
assert!(fs::write("/outside-target-probe", "escape").is_err());
|
|
let address: SocketAddr = "1.1.1.1:443".parse().unwrap();
|
|
assert!(TcpStream::connect_timeout(&address, Duration::from_secs(1)).is_err());
|
|
println!("cargo:warning=PASS: HOME/.ssh hidden, outside write denied, network denied");
|
|
println!("cargo:rerun-if-changed=build.rs");
|
|
}
|