[patch] add sandboxing to bootstrap-prefix.sh

bootstrap-prefix-msb.patch (text/plain), 1.14 KB, created by Michael Weiser on 2008-03-20 22:25:54 UTC

--- bootstrap-prefix.sh.orig	2008-03-06 14:31:24.000000000 +0100
+++ bootstrap-prefix.sh	2008-03-06 16:12:04.000000000 +0100
@@ -804,9 +807,41 @@
 GNU_URL="http://ftp.gnu.org/gnu"
 GCC_APPLE_URL="http://www.opensource.apple.com/darwinsource/tarballs/other"
 GENTOO_URL="http://gentoo.osuosl.org"
+MACOSSANDBOX_BINARY="/usr/bin/sandbox-exec"
+MACOSSANDBOX_PROFILE='(version 1)
 
-export CFLAGS CXXFLAGS MAKE
+(allow default)
+
+(deny file-write*)
 
+(allow file-read* file-write*
+  (literal
+    #"@@WRITEABLE_PREFIX@@"
+  )
+
+  (regex
+    #"^@@WRITEABLE_PREFIX@@/"
+    #"^(/private)?/var/tmp"
+    #"^(/private)?/tmp"
+  )
+)
+
+(allow file-read-data file-write-data
+  (regex
+    #"^/dev/null$"
+    #"^(/private)?/var/run/syslog$"
+  )
+)'
+
+if [ -x "$MACOSSANDBOX_BINARY" -a -z "$MACOSSANDBOX" ] ; then
+	einfo "Sandboxing bootstrap to ${ROOT} using Mac OS X ${MACOSSANDBOX_BINARY}"
+	MACOSSANDBOX=1 \
+		exec ${MACOSSANDBOX_BINARY} -p "$(echo "${MACOSSANDBOX_PROFILE}" | \
+		sed -e "s,@@WRITEABLE_PREFIX@@,${ROOT},g")" \
+		$0 $@
+fi
+
+export CFLAGS CXXFLAGS MAKE
 
 einfo "Bootstrapping Gentoo prefixed portage installation using"
 einfo "host:   ${CHOST}"