1 files changed, 32 insertions, 12 deletions
diff --git a/sandboxlib/chroot.py b/sandboxlib/chroot.py
index 9f7b16a..e224ec0 100644
--- a/sandboxlib/chroot.py
+++ b/sandboxlib/chroot.py
@@ -24,10 +24,6 @@ syscall, which is likely to require 'root' priviliges.
 If any 'extra_mounts' are specified, there must be a working 'mount' binary in
 the host system.
 
-Supported mounts settings: 'undefined'.
-
-Supported network settings: 'undefined'.
-
 The code would be simpler if we just used the 'chroot' program, but it's not
 always practical to do that. First, it may not be installed. Second, we can't
 set the working directory of the program inside the chroot, unless we assume
@@ -46,17 +42,41 @@ import warnings
 import sandboxlib
 
 
-def maximum_possible_isolation():
-    return {
-        'mounts': 'undefined',
-        'network': 'undefined',
-    }
+CAPABILITIES = {
+    'network': ['undefined'],
+    'mounts': ['undefined'],
+    'writable_paths': ['all'],
+}
 
 
-def process_mount_config(mounts, extra_mounts):
-    supported_values = ['undefined', 'isolated']
+def degrade_config_for_capabilities(in_config, warn=True):
+    # Currently this is all done manually... it may make sense to add something
+    # in utils.py that automatically checks the config against CAPABILITIES.
+    out_config = in_config.copy()
+    backend = 'chroot'
+
+    def degrade_and_warn(name, allowed_value):
+        out_config[name] = allowed_value
+        if warn:
+            msg = (
+                'Unable to set %(name)s=%(value)s in a %(backend)s sandbox, '
+                'falling back to %(name)s=%(allowed_value)s'.format(locals()))
+            warnings.warn(msg)
+
+    if out_config.get('mounts', 'undefined') != 'undefined':
+        degrade_and_warn('mounts', 'undefined')
 
-    assert mounts in supported_values, \
+    if out_config.get('network', 'undefined') != 'undefined':
+        degrade_and_warn('network', 'undefined')
+
+    if out_config.get('filesystem_writable_paths', 'all') != 'all':
+        degrade_and_warn('network', 'all')
+
+    return out_config
+
+
+def process_mount_config(mounts, extra_mounts):
+    assert mounts == 'undefined', \
         "'%s' is an unsupported value for 'mounts' in the 'chroot' " \
         "Mount sharing cannot be configured in this backend." % mounts