Changes between Initial Version and Version 1 of soc2007/epimenov

Oct 5, 2007, 5:51:25 PM (13 years ago)



  • soc2007/epimenov

    v1 v1  
     1Sorry for my English.
     3= Idea =
     5Port isolation :). When MacPorts build port it can deny to see files that port should not see.
     7= Current status =
     9It almost work :)
     11SVN commits: r26682 r28091 r28147 r29367 r29369 r29641 [[BR]]
     12Sources: [source:trunk/base/src/darwintracelib1.0/darwintrace.c darwintrace.c] [source:trunk/base/src/port1.0/porttrace.tcl porttrace.tcl] [source:trunk/base/src/port1.0/portutil.tcl portutil.tcl] [source:trunk/base/src/pextlib1.0/tracelib.c tracelib.c] [source:trunk/base/src/pextlib1.0/tracelib.h tracelib.h]
     14== How it works  ==
     16=== tracelib ===
     17port command opens unix socket in /tmp/macports/{pid of port command} and injects tracelib into process' address space. Tracelib hooks close, execve, lstat, mkdir, open, readlink, rename, rmdir, stat, unlink.
     19When some activity is occurred, it looks at filemap. There are 4 cases:
     20 1. path marked as 0           — grant access
     21 2. path marked as 1           — do redirect
     22 3. path marked as 2           — ask port command for advise
     23 4. path not listed in filemap — deny and report incident to port command
     25When fourth case is occurred you'll see something like “{{{Warning: A creation/deletion/modification was attempted outside sandbox: /etc/group}}}”. It a little bit incorrect, because it can happen on read/stat actions too. But it is old Paul's warning, and I don't know why I didn't change it :)
     27When third case is occurred tracelib asks port command about permit to interact with file. If it says no you'll see “{{{trace: access denied to /opt/local/bin/perl (perl5.8)}}}”. If it says yes we allow access to file. Unlike fourth case dirs are ignored.
     29=== Filemap ===
     31Filemap is piece of memory in form:
     32  {{{path\0action[redirect_path]\0path\0\action...path\0action[redirect_path]\0\0}}}
     34path is path prefix (for example, `/` matches all paths, `/opt` matches `/optblah/blah` and `/opt/blah etc`)[[BR]]
     35action is actions listed before[[BR]]
     36redirect_path is path for !SDK redirection, present only with 1 action.[[BR]]
     37\0 — is byte with code zero
     39Filemap's building performed [source:trunk/base/src/pextlib1.0/tracelib.c@29369#L170 here]. And it can be influenced by tcl code [source:trunk/base/src/port1.0/porttrace.tcl@29641#L76 here].
     41=== SDK redirection ===
     43There are SDKs in `/Developer/SDKs/`. Tracelib can map `/` to SDK dir.
     46We building port with SDK `MacOSX10.2.8.sdk`. gcc wants to use `/usr/include/stdio.h` and calls open(`/usr/include/stdio.h`), but tracelib returns open(`/Developer/SDKs/MacOSX10.2.8.sdk/usr/include/stdio.h`).
     48But there are some problems.
     49 1. I don't have any version of Mac OS X but 10.4, and can test, but I think there will be issues with ABI, and version of gcc.
     50 2. Some files missed in SDK directory (for example CPAN).
     52== User's part ==
     54User can use SDK redirection by specify `--with-trace-sdk=SDK`
     56Port trace can be enabled by specifying option -t for port command. For example:
     57  {{{sudo port -t install ghc}}}
     59== Problems ==
     61Some ports can reject to build in port trace mode because of sandbox. For example before r29641 you could not build gtk (it use files dir in $portdir, which wasn't allowed for read).
     63There are common programs (like gawk or perl) which dirt output.
     65SDK redirection is untested in real world.
     67== How it can be used ==
     69Maintainers can test dependencies with it.
     71MacPorts can provide binary packages (SDK redirection is for it) :)