complete path whitelisting

Author: valoq

src/main.rs

@@ -46,37 +46,50 @@ fn main() {
 fn run() -> Result<()> {
     let (args, skip_questions_positively, file_visibility_policy) = CliArgs::parse_and_validate_args()?;
 
-    // check args if case A: "decompress -d <outputdir>" or case B: "decompress -r" is used
-    //if true
-    //Case A:
-    // write_dirs = outputdir
-    //Case B:
-    // write_dir = inputdir
 
-    //init_sandbox( write_dirs );
-    init_sandbox();
+    let working_dir = args.output_dir
+
+
+    // Get the output dir if specified, else use current dir
+    let working_dir = args.output_dir
+        .clone()
+        .unwrap_or_else(|| env::current_dir().unwrap_or_default());
+
+    // restrict filesystem access to working_dir;
+    init_sandbox(&working_dir);
 
     commands::run(args, skip_questions_positively, file_visibility_policy)
 }
 
 // init_sandbox( write_dirs
 fn init_sandbox() {
 
+
+    use std::ffi::OsStr;
+    use std::os::unix::ffi::OsStrExt;
+
     if landlock_support::is_landlock_supported() {
-        println!("Landlock is supported and can be enabled.");
+        info!("Landlock is supported and will be enabled");
+
+        let path_str = allowed_dir.to_str().expect("Cannot convert path");
+        //let status = sandbox::restrict_paths(&[path_str]).expect("failed to build the ruleset");
+
+        match sandbox::restrict_paths(&[path_str]) {
+            Ok(status) => {
+                if !status.is_restricted() {
+                warn!("Landlock restriction was not successfully applied!");
+                }
+            }
+            Err(e) => {
+                error!("Failed to build the Landlock ruleset: {e}");
+                std::process::exit(EXIT_FAILURE);
+            }
+        }
 
-        let working_dir = get_current_working_dir().expect("Cannot get current working dir");
-        let path_str = working_dir.to_str().expect("Cannot convert path");
-        let status = sandbox::restrict_paths(&[path_str]).expect("failed to build the ruleset");
 
     } else {
-        println!("Landlock is NOT supported on this platform or kernel (<5.19).");
+        info!("Landlock is NOT supported on this platform or kernel (<5.19)");
     }
 
-    // todos:
-    // check status and report error or warning if landlock restriction failed
 }
 
-fn get_current_working_dir() -> std::io::Result<PathBuf> {
-    env::current_dir()
-}