11 Adamant

Bubblewrap is great if verbose. Some automation is called for. Enter Adamant: A profile-based sandbox runner built on top of Bubblewrap.

The idea is ridiculously simple: use ldd (or even readelf or strace) to determine which libraries and files an executable requires and store the list somewhere. A profile system makes sense. Something like

# ~/.config/adamant/profiles/shell.toml
network = "none"

ro = [
    "/usr/lib/ld-linux-x86-64.so.2",
    "/usr/lib/libc.so.6",
    "/usr/lib/libgcc_s.so.1",
    "/usr/lib/libm.so.6",
    "/usr/lib/libpcre2-32.so.0",
    "/usr/lib/libpcre2-32.so.0.15.0",
    "/usr/lib/libpcre2-8.so.0",
    "/usr/lib/libpcre2-8.so.0.15.0",
    "/lib64/ld-linux-x86-64.so.2",
    "/usr/lib/libncursesw.so.6",
    "/usr/lib/libncursesw.so.6.6",
    "/usr/lib/libreadline.so.8",
    "/usr/lib/libreadline.so.8.3",
    "/usr/bin/bash",
    "/usr/bin/ls",
    "/usr/lib/libcap.so.2",
    "/usr/lib/libcap.so.2.78",
]

which can be produced using

adamant prepare --profile shell bash
adamant prepare --profile shell ls

and run like so:

adamant run --profile shell bash

This command uses the list to produce the bwrap --clearenv ... machinery we saw earlier.

Problems:

• Network is all or nothing
• node works. npm doesn't, as it is a shell script and not an ELF executable
• ldd and readelf results do not tally. Is readelf even necessary?

Investigation is required.