Changes between Initial Version and Version 1 of soc2007/epimenov


Ignore:
Timestamp:
Oct 5, 2007, 5:51:25 PM (13 years ago)
Author:
epimenov@…
Comment:

--

Legend:

Unmodified
Added
Removed
Modified
  • soc2007/epimenov

    v1 v1  
     1Sorry for my English.
     2
     3= Idea =
     4
     5Port isolation :). When MacPorts build port it can deny to see files that port should not see.
     6
     7= Current status =
     8
     9It almost work :)
     10
     11SVN commits: r26682 r28091 r28147 r29367 r29369 r29641 [[BR]]
     12Sources: [source:trunk/base/src/darwintracelib1.0/darwintrace.c darwintrace.c] [source:trunk/base/src/port1.0/porttrace.tcl porttrace.tcl] [source:trunk/base/src/port1.0/portutil.tcl portutil.tcl] [source:trunk/base/src/pextlib1.0/tracelib.c tracelib.c] [source:trunk/base/src/pextlib1.0/tracelib.h tracelib.h]
     13
     14== How it works  ==
     15
     16=== tracelib ===
     17port command opens unix socket in /tmp/macports/{pid of port command} and injects tracelib into process' address space. Tracelib hooks close, execve, lstat, mkdir, open, readlink, rename, rmdir, stat, unlink.
     18
     19When some activity is occurred, it looks at filemap. There are 4 cases:
     20 1. path marked as 0           — grant access
     21 2. path marked as 1           — do redirect
     22 3. path marked as 2           — ask port command for advise
     23 4. path not listed in filemap — deny and report incident to port command
     24
     25When fourth case is occurred you'll see something like “{{{Warning: A creation/deletion/modification was attempted outside sandbox: /etc/group}}}”. It a little bit incorrect, because it can happen on read/stat actions too. But it is old Paul's warning, and I don't know why I didn't change it :)
     26
     27When third case is occurred tracelib asks port command about permit to interact with file. If it says no you'll see “{{{trace: access denied to /opt/local/bin/perl (perl5.8)}}}”. If it says yes we allow access to file. Unlike fourth case dirs are ignored.
     28
     29=== Filemap ===
     30
     31Filemap is piece of memory in form:
     32  {{{path\0action[redirect_path]\0path\0\action...path\0action[redirect_path]\0\0}}}
     33
     34path is path prefix (for example, `/` matches all paths, `/opt` matches `/optblah/blah` and `/opt/blah etc`)[[BR]]
     35action is actions listed before[[BR]]
     36redirect_path is path for !SDK redirection, present only with 1 action.[[BR]]
     37\0 — is byte with code zero
     38
     39Filemap's building performed [source:trunk/base/src/pextlib1.0/tracelib.c@29369#L170 here]. And it can be influenced by tcl code [source:trunk/base/src/port1.0/porttrace.tcl@29641#L76 here].
     40
     41=== SDK redirection ===
     42
     43There are SDKs in `/Developer/SDKs/`. Tracelib can map `/` to SDK dir.
     44
     45Example:
     46We building port with SDK `MacOSX10.2.8.sdk`. gcc wants to use `/usr/include/stdio.h` and calls open(`/usr/include/stdio.h`), but tracelib returns open(`/Developer/SDKs/MacOSX10.2.8.sdk/usr/include/stdio.h`).
     47
     48But there are some problems.
     49 1. I don't have any version of Mac OS X but 10.4, and can test, but I think there will be issues with ABI, and version of gcc.
     50 2. Some files missed in SDK directory (for example CPAN).
     51
     52== User's part ==
     53
     54User can use SDK redirection by specify `--with-trace-sdk=SDK`
     55
     56Port trace can be enabled by specifying option -t for port command. For example:
     57  {{{sudo port -t install ghc}}}
     58
     59== Problems ==
     60
     61Some ports can reject to build in port trace mode because of sandbox. For example before r29641 you could not build gtk (it use files dir in $portdir, which wasn't allowed for read).
     62
     63There are common programs (like gawk or perl) which dirt output.
     64
     65SDK redirection is untested in real world.
     66
     67== How it can be used ==
     68
     69Maintainers can test dependencies with it.
     70
     71MacPorts can provide binary packages (SDK redirection is for it) :)
     72