add some basic darwin tests

Author: maxmcd

pkg/sandbox/chrootenv_linux.go

@@ -146,3 +146,22 @@ func (chr *chroot) Cleanup() (err error) {
 	}
 	return nil
 }
+
+func (s Sandbox) runExecStep() {
+	cmd := exec.Cmd{
+		Path: s.Path,
+		Dir:  s.Dir,
+		Args: append([]string{s.Path}, s.Args...),
+		Env:  os.Environ(),
+
+		// We don't use the passed sandbox stdio because
+		// it's been passed to the very first run command
+		Stdin:  os.Stdin,
+		Stdout: os.Stdout,
+		Stderr: os.Stderr,
+	}
+	if err := cmd.Run(); err != nil {
+		fmt.Println(err.Error())
+		os.Exit(1)
+	}
+}

pkg/sandbox/sandbox.go

@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"os/exec"
 	"os/signal"
 	"syscall"
 
@@ -120,22 +119,3 @@ func interruptContext() context.Context {
 	}()
 	return ctx
 }
-
-func (s Sandbox) runExecStep() {
-	cmd := exec.Cmd{
-		Path: s.Path,
-		Dir:  s.Dir,
-		Args: append([]string{s.Path}, s.Args...),
-		Env:  os.Environ(),
-
-		// We don't use the passed sandbox stdio because
-		// it's been passed to the very first run command
-		Stdin:  os.Stdin,
-		Stdout: os.Stdout,
-		Stderr: os.Stderr,
-	}
-	if err := cmd.Run(); err != nil {
-		fmt.Println(err.Error())
-		os.Exit(1)
-	}
-}

pkg/sandbox/sandbox_darwin.go

@@ -1,12 +1,27 @@
 // +build darwin
+
 package sandbox
 
 import (
 	"os/exec"
 )
 
 func (s Sandbox) runCommand() (*exec.Cmd, error) {
-	return exec.Command("sandbox-exec"), nil
+	profile := `(version 1)
+	(deny default)
+	(allow process-exec*)
+	(import "/System/Library/Sandbox/Profiles/bsd.sb")`
+	if !s.DisableNetwork {
+		profile += `(allow network*)`
+	}
+	cmd := exec.Command("sandbox-exec", "-p", profile, s.Path)
+	cmd.Args = append(cmd.Args, s.Args...)
+	cmd.Dir = s.Dir
+	cmd.Env = s.Env
+	cmd.Stderr = s.Stderr
+	cmd.Stdout = s.Stdout
+	cmd.Stdin = s.Stdin
+	return cmd, nil
 }
 
 func firstArgMatchesStep() bool {

pkg/sandbox/sandbox_darwin_test.go

@@ -0,0 +1,55 @@
+// +build darwin
+
+package sandbox
+
+import (
+	"bytes"
+	"context"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSandbox_runCommand(t *testing.T) {
+	t.Run("no network", func(t *testing.T) {
+		var buf bytes.Buffer
+		sbx := Sandbox{
+			Stdout:         os.Stdout,
+			Stderr:         &buf,
+			DisableNetwork: true,
+			Path:           "/sbin/ping",
+			Args:           []string{"-c1", "google.com"},
+			Dir:            "/Users/maxm/go/src/github.com/maxmcd/bramble", //TODO
+		}
+		require.Error(t, sbx.Run(context.Background()))
+		assert.Contains(t, buf.String(), "Unknown host")
+	})
+	t.Run("yes network", func(t *testing.T) {
+		var buf bytes.Buffer
+		sbx := Sandbox{
+			Stdout:         &buf,
+			Stderr:         os.Stderr,
+			DisableNetwork: false,
+			Path:           "/sbin/ping",
+			Args:           []string{"-c1", "google.com"},
+			Dir:            "/Users/maxm/go/src/github.com/maxmcd/bramble", //TODO
+		}
+		require.NoError(t, sbx.Run(context.Background()))
+		assert.Contains(t, buf.String(), "0.0% packet loss")
+	})
+	t.Run("hllo wrld", func(t *testing.T) {
+		var buf bytes.Buffer
+		sbx := Sandbox{
+			Stdout:         &buf,
+			Stderr:         os.Stderr,
+			DisableNetwork: true,
+			Path:           "/bin/echo",
+			Args:           []string{"hi"},
+			Dir:            "/Users/maxm/go/src/github.com/maxmcd/bramble", //TODO
+		}
+		require.NoError(t, sbx.Run(context.Background()))
+		assert.Equal(t, buf.String(), "hi\n")
+	})
+}