Nanos ops config

{"Klibs": ["sandbox"  ],"ManifestPassthrough": {"sandbox": {"pledge": {},"unveil": {}    }  }}

pledge

package mainimport ("log""os""github.com/rinor/sandbox")funcmain() {ifsandbox.Noop() {log.Print("PLEDGE: calls won't have any effect (noop)")}else {log.Print("PLEDGE: calls will fail if not implemented in kernel")}log.Print("PLEDGE: calling PledgePromises(stdio error rpath)")err:=sandbox.PledgePromises("stdio error rpath")iferr!=nil {log.Fatalf("PLEDGE: PledgePromises - %q",err)}log.Print("PLEDGE: Readir should work - (rpath - enabled)")_,err=os.ReadDir(".")iferr!=nil {log.Fatalf("%q",err)}log.Print("PLEDGE: Readir OK")log.Print("PLEDGE: Disabling rpath")err=sandbox.PledgePromises("stdio error")iferr!=nil {log.Fatalf("PLEDGE: PledgePromises - %q",err)}log.Print("PLEDGE: Readir should fail - (rpath - disabled)")_,err=os.ReadDir(".")iferr!=nil {log.Fatalf("PLEDGE: Readir %q",err)}}

unveil

package mainimport ("log""os""github.com/rinor/sandbox")funcmain() {ifsandbox.Noop() {log.Print("UNVEIL: calls won't have any effect (noop)")}else {log.Print("UNVEIL: calls will fail if not implemented in kernel")}log.Print("UNVEIL: calling Unveil(/, rwxc)")err:=sandbox.Unveil("/","rwxc")iferr!=nil {log.Fatalf("UNVEIL: unveil - %q",err)}log.Print("UNVEIL: Readir should work - (unveil r - enabled)")_,err=os.ReadDir("/")iferr!=nil {log.Fatalf("%q",err)}log.Print("UNVEIL: Readir OK")log.Print("UNVEIL: Disabling r")err=sandbox.Unveil("/","wxc")iferr!=nil {log.Fatalf("UNVEIL: unveil - %q",err)}log.Print("UNVEIL: Readir should fail - (unveil r - disabled)")_,err=os.ReadDir("/")iferr!=nil {log.Printf("UNVEIL: Readir %q",err)}log.Print("UNVEIL: calling unveilBlock")err=sandbox.UnveilBlock()iferr!=nil {log.Fatalf("UNVEIL: unveilBlock - %q",err)}log.Print("UNVEIL: unveil calls should fail - (unveilBlock called)")err=sandbox.Unveil("/","rwxc")iferr!=nil {log.Fatalf("UNVEIL: unveil - %q",err)}}