bug#45198: 28.0.50; Sandbox mode

[Philipp Stephani]

Am Sa., 17. Apr. 2021 um 19:48 Uhr schrieb Mattias Engdegård <mattiase@acm.org>:
>
> 17 apr. 2021 kl. 18.10 skrev Philipp <p.stephani2@gmail.com>:
>
> > (cl-defun start-sandbox (function &key readable-directories stdout-buffer) 
> > ...)
> > (defun wait-for-sandbox (sandbox) ...)
> >
> > where start-sandbox returns an opaque sandbox object running FUNCTION that 
> > wait-for-sandbox can wait for.  That should be generic enough that it's 
> > extensible and implementable on several platforms, and doesn't lock us into 
> > specific implementation choices.
>
> That's probably a nice interface. A slightly more low-level mechanism is what 
> I had in mind, a `make-process` variant that starts an Emacs subprocess with 
> the required arguments to set up a sandbox and leaving it to the user to 
> supply remaining arguments. But maybe we are really talking about more or 
> less the same thing.

Yes, that would essentially be how start-sandbox would get
implemented. In the Seccomp case, something like (conceptually)
(start-process "bwrap ... -- emacs --seccomp=... --quick --batch
--eval=FUNCTION")
where bwrap can set up mount namespaces to restrict the filesystem.