From 47ff51009fa05d83bb67cd5db16829ab4c0081d7 Mon Sep 17 00:00:00 2001 From: Andrew Clayton Date: Wed, 9 Aug 2023 18:22:46 +0100 Subject: Wasm: Add support for directory access. Due to the sandboxed nature of WebAssembly, by default WASM modules don't have any access to the underlying filesystem. There is however a capabilities based mechanism[0] for allowing such access. This adds a config option to the 'wasm' application type; 'access.filesystem' which takes an array of directory paths that are then made available to the WASM module. This access works recursively, i.e everything under a specific path is allowed access to. Example config might look like "access" { "filesystem": [ "/tmp", "/var/tmp" ] } The actual mechanism used allows directories to be mapped differently in the guest. But at the moment we don't support that and just map say /tmp to /tmp. This can be revisited if it's something users clamour for. Network sockets are another resource that may be controlled in this manner, for example there is a wasi_config_preopen_socket() function, however this requires the runtime to open the network socket then effectively pass this through to the guest. This is something that can be revisited in the future if users desire it. [0]: Reviewed-by: Alejandro Colomar Signed-off-by: Andrew Clayton --- src/nxt_conf_validation.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'src/nxt_conf_validation.c') diff --git a/src/nxt_conf_validation.c b/src/nxt_conf_validation.c index 0603c98d..f00b28b8 100644 --- a/src/nxt_conf_validation.c +++ b/src/nxt_conf_validation.c @@ -252,6 +252,7 @@ static nxt_conf_vldt_object_t nxt_conf_vldt_python_target_members[]; static nxt_conf_vldt_object_t nxt_conf_vldt_php_common_members[]; static nxt_conf_vldt_object_t nxt_conf_vldt_php_options_members[]; static nxt_conf_vldt_object_t nxt_conf_vldt_php_target_members[]; +static nxt_conf_vldt_object_t nxt_conf_vldt_wasm_access_members[]; static nxt_conf_vldt_object_t nxt_conf_vldt_common_members[]; static nxt_conf_vldt_object_t nxt_conf_vldt_app_limits_members[]; static nxt_conf_vldt_object_t nxt_conf_vldt_app_processes_members[]; @@ -1081,12 +1082,27 @@ static nxt_conf_vldt_object_t nxt_conf_vldt_wasm_members[] = { }, { .name = nxt_string("response_end_handler"), .type = NXT_CONF_VLDT_STRING, + }, { + .name = nxt_string("access"), + .type = NXT_CONF_VLDT_OBJECT, + .validator = nxt_conf_vldt_object, + .u.members = nxt_conf_vldt_wasm_access_members, }, NXT_CONF_VLDT_NEXT(nxt_conf_vldt_common_members) }; +static nxt_conf_vldt_object_t nxt_conf_vldt_wasm_access_members[] = { + { + .name = nxt_string("filesystem"), + .type = NXT_CONF_VLDT_ARRAY, + }, + + NXT_CONF_VLDT_END +}; + + static nxt_conf_vldt_object_t nxt_conf_vldt_common_members[] = { { .name = nxt_string("type"), -- cgit