Feedback on review

scripts/grader_wrapper.py

@@ -1,7 +1,6 @@
 """A sample wrapper script for running python submissions.
 
-The text in this file is read in :func:`run_submission` and
-executed if ``settings.USE_SANDBOXING`` is not ``True``.
+This is only used when sandboxing is disabled.
 """
 
 from __future__ import annotations

tin/apps/submissions/tasks.py

@@ -71,7 +71,7 @@ def run_submission(submission_id):
         else:  # pragma: no cover
             python_exe = "/usr/bin/python3.10"
 
-        if settings.USE_SANDBOXING:
+        if settings.IS_BUBBLEWRAP_PRESENT and settings.IS_SANDBOXING_MODULE_PRESENT:
             wrapper_text = (
                 Path(settings.BASE_DIR)
                 .joinpath(
@@ -138,7 +138,7 @@ def run_submission(submission_id):
             grader_log_path,
         ]
 
-        if settings.USE_SANDBOXING:
+        if settings.IS_FIREJAIL_PRESENT and settings.IS_SANDBOXING_MODULE_PRESENT:
             whitelist = [os.path.dirname(grader_path)]
             read_only = [grader_path, submission_path, os.path.dirname(submission_wrapper_path)]
             if submission.assignment.venv_fully_created:

tin/settings/__init__.py

@@ -12,6 +12,7 @@
 from __future__ import annotations
 
 import os
+import shutil
 from pathlib import Path
 
 # Build paths inside the project like this: os.path.join(BASE_DIR, ...)
@@ -29,10 +30,6 @@
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = True
 
-USE_SANDBOXING = (
-    not DEBUG or Path(BASE_DIR).joinpath("sandboxing", "wrappers", "sandboxed", "P.txt").exists()
-)
-
 
 ALLOWED_HOSTS = [
     "127.0.0.1",
@@ -330,6 +327,14 @@
 # ImgBB API key (set in secret.py)
 IMGBB_API_KEY = ""
 
+# Sandboxing
+
+IS_SANDBOXING_MODULE_PRESENT = (Path(BASE_DIR) / "sandboxing" / "__init__.py").exists()
+
+IS_FIREJAIL_PRESENT = shutil.which("firejail") is not None
+
+IS_BUBBLEWRAP_PRESENT = shutil.which("bwrap") is not None
+
 try:
     from .secret import *
 except ImportError: