pkgcore.spawn module

Bash and sandbox support for running commands.

Commands are spawned with subprocess; what lives here is what it has no opinion about: where bash and sandbox are, the argv that runs a command under either, and probes for the system bash version and for whether the host can sandbox or drop privileges at all.

bash_command() and sandbox_command() only build an argv – the caller spawns it, keeping file descriptors, environment and privileges in its own hands.

pkgcore.spawn.bash_command(command: str | Iterable[str], debug: bool = False) → list[str]

Build the argv running command under a bash ignoring its rc files.

pkgcore.spawn.bash_version() → str | None

The system bash version, of the form major.minor.patch.

pkgcore.spawn.is_sandbox_capable() → bool

Can a sandboxed process be spawned?

pkgcore.spawn.is_userpriv_capable() → bool

Can this process drop to another uid/gid?

pkgcore.spawn.sandbox_command(command: Sequence[str]) → list[str]

Build the argv running command under sandbox.

The caller is expected to have checked is_sandbox_capable() first.