Changeset 98193

Timestamp:

Sep 28, 2012, 5:10:50 AM (12 years ago)

Author:

jmr@…

Message:

use sandboxing to prevent writes outside workpath and distpath

Location:

trunk/base/src

Files:

• pextlib1.0/system.c (modified) (1 diff)
• port1.0/portsandbox.tcl (modified) (1 diff)
• port1.0/portutil.tcl (modified) (1 diff)

trunk/base/src/pextlib1.0/system.c

@@ -157 +157 @@
     }
 
-#if 0
     /* check if and how we should use sandbox-exec */
     sandbox = check_sandboxing(interp, &sandbox_exec_path, &profilestr);
-#endif
 
     /*

trunk/base/src/port1.0/portsandbox.tcl

@@ -36 +36 @@
 options portsandbox_supported portsandbox_profile
 default portsandbox_supported {[file executable $portutil::autoconf::sandbox_exec_path]}
-default portsandbox_profile {[portsandbox::get_default_profile]}
+default portsandbox_profile {}
 
-# produce a suitable profile to pass to sandbox-exec
+# set up a suitable profile to pass to sandbox-exec, based on the target
 # command line usage would be:
-# sandbox-exec -p '(version 1) (allow default) (deny file* (subpath "/usr/local") (subpath "/Library/Frameworks"))' some-command
-proc portsandbox::get_default_profile {} {
-    global os.major prefix frameworks_dir
-    set prefix_conflict [expr {$prefix == "/usr/local" || [string match $prefix "/usr/local/*"]}]
-    set frameworks_conflict [expr {$frameworks_dir == "/Library/Frameworks" || [string match $frameworks_dir "/Library/Frameworks/*"]}]
-    if {$prefix_conflict && $frameworks_conflict} {
-        return ""
+# sandbox-exec -p '(version 1) (allow default) (deny file-write*) (allow file-write* <filter>)' some-command
+proc portsandbox::set_profile {target} {
+    global os.major portsandbox_profile workpath distpath altprefix
+
+    switch $target {
+        activate -
+        deactivate -
+        load -
+        unload {
+            set portsandbox_profile ""
+            return
+        }
+        fetch -
+        mirror -
+        clean {
+            set allow_dirs [list $distpath]
+        }
     }
-    set profile "(version 1) (allow default) (deny "
-    if {${os.major} > 9} {
-        append profile "file* "
-        if {!$prefix_conflict} {
-            append profile {(subpath "/usr/local")}
+
+    # TODO: remove altprefix support
+    lappend allow_dirs $workpath $altprefix
+
+    set portsandbox_profile "(version 1) (allow default) (deny file-write*)"
+    foreach dir $allow_dirs {
+        append portsandbox_profile " (allow file-write* "
+        if {${os.major} > 9} {
+            append portsandbox_profile "(subpath \"${dir}\")"
+        } else {
+            append portsandbox_profile "(regex #\"^${dir}/\")"
         }
-        if {!$frameworks_conflict} {
-            append profile { (subpath "/Library/Frameworks")}
-        }
-    } else {
-        append profile "file-read* file-write* (regex "
-        if {!$prefix_conflict} {
-            append profile {#"^/usr/local/"}
-        }
-        if {!$frameworks_conflict} {
-            append profile { #"^/Library/Frameworks/"}
-        }
-        append profile ")"
+        append portsandbox_profile ")"
     }
-    append profile ")"
-    return $profile
+    append portsandbox_profile " (allow file-write-data (literal \"/dev/null\"))"
 }

trunk/base/src/port1.0/portutil.tcl

@@ -1327 +1327 @@
         set targetname [ditem_key $ditem name]
         set target [ditem_key $ditem provides]
+        portsandbox::set_profile $target
         global ${target}.asroot
         if { [tbool ${target}.asroot] } {