*  To use, you need to set environment variables:

 *  SANDBOX_ON          If this is set, it turns on sandboxing

 *  SANDBOX_LOG         The log file used for reporting violations.

 *                      Sandbox writes to stderr if not set.

 *  SANDBOX_DEBUG       Turn on sandbox debugging, so you know what it did

 *  SANDBOX_DEBUG_LOG   Logfile for debugging, stderr if not set

 *  SANDBOX_TRACE       Turn on tracing, listing all interesting files read

 *  SANDBOX_TRACE_LOG   Logfile for the above, needs to be set to work

 *

 *  These take path prefixes separated by ':' :

 *  SANDBOX_DENY        Deny access to the listed prefixes

 *  SANDBOX_READ        Allow reads from these prefixes. Normally set to "/"

 *  SANDBOX_WRITE       Allow write access to these prefixes

 *  SANDBOX_PREDICT     Dunno really. Something with error logging.

 *

 *  Notes:

 *  - the above just do sandboxing, the regular access permissions still apply.

 *

 *  - sandbox works by messing with libc. If you have applications that call

 *    the kernel directly (like dietlibc?), it won't work. This means that

 *    malicious code could still be executed. Which is why the portage user is

 *    a good idea.

 *

 *  - using sandbox is faster than something based on ptrace(), which would

 *    not have the above problem. Easily checked by comparing the difference

 *    between

 *    # time FEATURES=-sandbox strace -f -e\!all emerge blabla

 *    and

 *    # time emerge blabla

 *

 *  - If we want total security, maybe something like the systrace patch

 *    (http://www.systrace.org) would be better, although that only exists

 *    for the Linux kernel.

 *

 *    Added logging for opened files in the forbidden zone, thus knowing

 *    what packages were used, see bug #3141

 *

 *    Removed unused write_denied structures

 *

 *    Added docs for libsandbox

 *

 *    Wout Mertens <wmertens@gentoo.org> (13 May 2003)

 *

/* We define as interesting: */

/* All files that we don't have write access to and are reading from */

static int is_interesting(sbcontext_t* sbcontext, const char* func, const char* path)

{

  int result = -1;

  int i = 0;

  char* filtered_path = filter_path(path);

  if ('/' != filtered_path[0]) {

    return 0;

  }

  if ((0 == strncmp(filtered_path, "/etc/ld.so.preload", 18)) && (is_sandbox_pid())) {

    result = 0;

  }

  if (-1 == result) {

    /* These are the functions we care about */

    if ((NULL != sbcontext->write_prefixes) &&

        ((0 == strncmp(func, "open_rd", 7)) ||

         (0 == strncmp(func, "popen", 5)) ||

         (0 == strncmp(func, "system", 6)) ||

         (0 == strncmp(func, "execl", 5)) ||

         (0 == strncmp(func, "execlp", 6)) ||

         (0 == strncmp(func, "execle", 6)) ||

         (0 == strncmp(func, "execv", 5)) ||

         (0 == strncmp(func, "execvp", 6)) ||

         (0 == strncmp(func, "execve", 6))

        )

       ) {

      /* See if we are allowed to write to it */

      for (i = 0; i < sbcontext->num_write_prefixes; i++) {

        if (NULL != sbcontext->write_prefixes[i]) {

          if (0 == strncmp(filtered_path,

                           sbcontext->write_prefixes[i],

                           strlen(sbcontext->write_prefixes[i]))) {

            result = 0;

            break;

          }

        }

      }

      /* All the rest is interesting */

      if (-1 == result) {

        result = 1;

      }

    }

  }

  if (-1 == result) {

    result = 0;

  }

  if (filtered_path) free(filtered_path);

  filtered_path = NULL;

  return result;

}

  struct stat trace_log_stat;

  char* trace_log_env = NULL;

  char* trace_log_path = NULL;

  int trace_log_file = 0;

  trace_log_env = getenv("SANDBOX_TRACE");

  trace_log_path = getenv("SANDBOX_TRACE_LOG");

  /* Save the path if tracing and it's interesting enough */

  if ( (NULL != trace_log_env) &&

       (NULL != trace_log_path) &&

       (0 != strncmp(absolute_path, trace_log_path, strlen(trace_log_path))) &&

       is_interesting(sbcontext, func, absolute_path)

     ) {

    sprintf(buffer, "%s\n", absolute_path);

    if ((0 == lstat(trace_log_path, &trace_log_stat)) &&

        (0 == S_ISREG(trace_log_stat.st_mode))

       ) {

      fprintf(stderr,

              "\e[31;01mSECURITY BREACH\033[0m  %s already exists and is not a regular file.\n",

              log_path);

    } else {

      trace_log_file = true_open(trace_log_path,

                                 O_APPEND | O_WRONLY | O_CREAT,

                                 S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);

      if(trace_log_file >= 0) {

        write(trace_log_file, buffer, strlen(buffer));

        close(trace_log_file);

      }

    }

  }