mirror of
https://github.com/kemko/nomad.git
synced 2026-01-05 01:45:44 +03:00
fd1e40537c
This adds artifact inspection after download to detect any issues with the content fetched. Currently this means checking for any symlinks within the artifact that resolve outside the task or allocation directories. On platforms where lockdown is available (some Linux) this inspection is not performed. The inspection can be disabled with the DisableArtifactInspection option. A dedicated option for disabling this behavior allows the DisableFilesystemIsolation option to be enabled but still have artifacts inspected after download.
31 lines
641 B
Go
31 lines
641 B
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
//go:build !linux && !windows
|
|
|
|
package getter
|
|
|
|
import (
|
|
"path/filepath"
|
|
)
|
|
|
|
// lockdown is not available by default
|
|
func lockdownAvailable() bool {
|
|
return false
|
|
}
|
|
|
|
// lockdown is not implemented by default
|
|
func lockdown(string, string, []string) error {
|
|
return nil
|
|
}
|
|
|
|
// defaultEnvironment is the default minimal environment variables for Unix-like
|
|
// operating systems.
|
|
func defaultEnvironment(taskDir string) map[string]string {
|
|
tmpDir := filepath.Join(taskDir, "tmp")
|
|
return map[string]string{
|
|
"PATH": "/usr/local/bin:/usr/bin:/bin",
|
|
"TMPDIR": tmpDir,
|
|
}
|
|
}
|