[patch] mac os x sandbox/seatbelt for current prefix-portage

portage-2.2.01.16616-msb.patch (text/plain), 8.22 KB, created by Michael Weiser on 2010-09-24 09:08:51 UTC

--- ./prefix-portage-2.2.01.16616/pym/portage/const.py.msb	2010-09-23 19:03:07.000000000 +0200
+++ ./prefix-portage-2.2.01.16616/pym/portage/const.py	2010-09-24 10:32:01.000000000 +0200
@@ -80,6 +80,31 @@
 BASH_BINARY              = PORTAGE_BASH
 MOVE_BINARY              = PORTAGE_MV
 PRELINK_BINARY           = "/usr/sbin/prelink"
+MACOSSANDBOX_BINARY      = "/usr/bin/sandbox-exec"
+MACOSSANDBOX_PROFILE     = '''(version 1)
+
+(allow default)
+
+(deny file-write*)
+
+(allow file-read* file-write*
+  (literal
+    #"@@WRITEABLE_PREFIX@@"
+  )
+
+  (regex
+    #"^@@WRITEABLE_PREFIX_RE@@/"
+    #"^(/private)?/var/tmp"
+    #"^(/private)?/tmp"
+  )
+)
+
+(allow file-read-data file-write-data
+  (regex
+    #"^/dev/null$"
+    #"^(/private)?/var/run/syslog$"
+  )
+)'''
 
 PORTAGE_GROUPNAME        = portagegroup
 PORTAGE_USERNAME         = portageuser
--- ./prefix-portage-2.2.01.16616/pym/portage/package/ebuild/config.py.msb	2010-09-17 20:05:38.000000000 +0200
+++ ./prefix-portage-2.2.01.16616/pym/portage/package/ebuild/config.py	2010-09-24 10:32:01.000000000 +0200
@@ -39,7 +39,7 @@
 from portage.exception import InvalidDependString, PortageException
 from portage.localization import _
 from portage.output import colorize
-from portage.process import fakeroot_capable, sandbox_capable
+from portage.process import fakeroot_capable, sandbox_capable, macossandbox_capable
 from portage.util import ensure_dirs, getconfig, grabdict, \
 	grabdict_package, grabfile, grabfile_package, LazyItemsDict, \
 	normalize_path, shlex_split, stack_dictlist, stack_dicts, stack_lists, \
@@ -875,6 +875,18 @@
 				writemsg(colorize("BAD", _("!!! Problem with sandbox"
 					" binary. Disabling...\n\n")), noiselevel=-1)
 
+		if not macossandbox_capable and \
+			("macossandbox" in self.features or "macosusersandbox" in self.features):
+			if self.profile_path is not None and \
+				os.path.realpath(self.profile_path) == \
+				os.path.realpath(os.path.join(
+				self["PORTAGE_CONFIGROOT"], PROFILE_PATH)):
+				""" Don't show this warning when running repoman and the
+				sandbox feature came from a profile that doesn't belong to
+				the user."""
+				writemsg(colorize("BAD", "!!! Problem with macos sandbox" + \
+					" binary. Disabling...\n\n"), noiselevel=-1)
+
 		if "fakeroot" in self.features and \
 			not fakeroot_capable:
 			writemsg(_("!!! FEATURES=fakeroot is enabled, but the "
--- ./prefix-portage-2.2.01.16616/pym/portage/package/ebuild/doebuild.py.msb	2010-09-18 12:50:51.000000000 +0200
+++ ./prefix-portage-2.2.01.16616/pym/portage/package/ebuild/doebuild.py	2010-09-24 10:35:21.000000000 +0200
@@ -35,7 +35,7 @@
 	_shell_quote, _unicode_decode, _unicode_encode
 from portage.const import EBUILD_SH_ENV_FILE, EBUILD_SH_ENV_DIR, \
 	EBUILD_SH_BINARY, INVALID_ENV_FILE, MISC_SH_BINARY, \
-	EPREFIX, EPREFIX_LSTRIP
+	EPREFIX, EPREFIX_LSTRIP, MACOSSANDBOX_PROFILE
 from portage.data import portage_gid, portage_uid, secpass, \
 	uid, userpriv_groups
 from portage.dbapi.virtual import fakedbapi
@@ -941,17 +941,22 @@
 	restrict = settings["PORTAGE_RESTRICT"].split()
 	nosandbox = (("userpriv" in features) and \
 		("usersandbox" not in features) and \
+		("macosusersandbox" not in features) and \
 		"userpriv" not in restrict and \
 		"nouserpriv" not in restrict)
 	if nosandbox and ("userpriv" not in features or \
 		"userpriv" in restrict or \
 		"nouserpriv" in restrict):
 		nosandbox = ("sandbox" not in features and \
-			"usersandbox" not in features)
+			"usersandbox" not in features and \
+			"macosusersandbox" not in features)
 
 	if not portage.process.sandbox_capable:
 		nosandbox = True
 
+	if not portage.process.macossandbox_capable:
+		nosandbox = True
+
 	sesandbox = settings.selinux_enabled() and \
 		"sesandbox" in features
 
@@ -1096,15 +1101,29 @@
 	# fake ownership/permissions will have to be converted to real
 	# permissions in the merge phase.
 	fakeroot = fakeroot and uid != 0 and portage.process.fakeroot_capable
+	macossandbox = ("macossandbox" in features or \
+		"macosusersandbox" in features)
 	if droppriv and not uid and portage_gid and portage_uid:
 		keywords.update({"uid":portage_uid,"gid":portage_gid,
 			"groups":userpriv_groups,"umask":0o02})
 	if not free:
-		free=((droppriv and "usersandbox" not in features) or \
+		free=((droppriv and "usersandbox" not in features and
+			"macosusersandbox" not in features) or \
 			(not droppriv and "sandbox" not in features and \
-			"usersandbox" not in features and not fakeroot))
+			"usersandbox" not in features and not fakeroot and \
+			not macossandbox))
+
+	# confining the process to a prefix sandbox is disabled by default, if
+	# a normal sandbox is requested a this point, it will be used, if no
+	# sandbox is requested, a prefix sandbox will be imposed if requested
+	# by the appropriate features
+	prefixsandbox = False
+	if free:
+		prefixsandbox = "macosprefixsandbox" in features
+		free = not prefixsandbox
 
-	if not free and not (fakeroot or portage.process.sandbox_capable):
+	if not free and not (fakeroot or portage.process.sandbox_capable or \
+		portage.process.macossandbox_capable):
 		free = True
 
 	if mysettings.mycpv is not None:
@@ -1120,6 +1139,25 @@
 		keywords["opt_name"] += " fakeroot"
 		keywords["fakeroot_state"] = os.path.join(mysettings["T"], "fakeroot.state")
 		spawn_func = portage.process.spawn_fakeroot
+	elif macossandbox:
+		keywords["opt_name"] += " macossandbox"
+		if prefixsandbox:
+			sbprefixpath = mysettings["EPREFIX"]
+		else:
+			sbprefixpath = mysettings["PORTAGE_BUILDDIR"]
+
+		# escape some characters with special meaning in re's
+		sbprefixre = sbprefixpath.replace("+", "\+")
+		sbprefixre = sbprefixre.replace("*", "\*")
+		sbprefixre = sbprefixre.replace("[", "\[")
+		sbprefixre = sbprefixre.replace("[", "\[")
+
+		sbprofile = MACOSSANDBOX_PROFILE
+		sbprofile = sbprofile.replace("@@WRITEABLE_PREFIX@@", sbprefixpath)
+		sbprofile = sbprofile.replace("@@WRITEABLE_PREFIX_RE@@", sbprefixre)
+
+		keywords["profile"] = sbprofile
+		spawn_func = portage.process.spawn_macossandbox
 	else:
 		keywords["opt_name"] += " sandbox"
 		spawn_func = portage.process.spawn_sandbox
--- ./prefix-portage-2.2.01.16616/pym/portage/process.py.msb	2010-09-20 17:24:28.000000000 +0200
+++ ./prefix-portage-2.2.01.16616/pym/portage/process.py	2010-09-24 10:32:01.000000000 +0200
@@ -16,7 +16,7 @@
 	'portage.util:dump_traceback',
 )
 
-from portage.const import BASH_BINARY, SANDBOX_BINARY, FAKEROOT_BINARY
+from portage.const import BASH_BINARY, SANDBOX_BINARY, MACOSSANDBOX_BINARY, FAKEROOT_BINARY
 from portage.exception import CommandNotFound
 
 try:
@@ -42,6 +42,9 @@
 fakeroot_capable = (os.path.isfile(FAKEROOT_BINARY) and
                     os.access(FAKEROOT_BINARY, os.X_OK))
 
+macossandbox_capable = (os.path.isfile(MACOSSANDBOX_BINARY) and
+                   os.access(MACOSSANDBOX_BINARY, os.X_OK))
+
 def spawn_bash(mycommand, debug=False, opt_name=None, **keywords):
 	"""
 	Spawns a bash shell running a specific commands
@@ -89,6 +92,19 @@
 	args.append(BASH_BINARY)
 	args.append("-c")
 	args.append(mycommand)
+	return spawn(args, opt_name=opt_name, **keywords)
+
+def spawn_macossandbox(mycommand, profile=None, opt_name=None, **keywords):
+	if not macossandbox_capable:
+		return spawn_bash(mycommand, opt_name=opt_name, **keywords)
+	args=[MACOSSANDBOX_BINARY]
+	if not opt_name:
+		opt_name = os.path.basename(mycommand.split()[0])
+	args.append("-p")
+	args.append(profile)
+	args.append(BASH_BINARY)
+	args.append("-c")
+	args.append(mycommand)
 	return spawn(args, opt_name=opt_name, **keywords)
 
 _exithandlers = []
--- ./prefix-portage-2.2.01.16616/pym/portage/const.py.msb	2010-09-24 10:44:35.000000000 +0200
+++ ./prefix-portage-2.2.01.16616/pym/portage/const.py	2010-09-24 10:54:47.000000000 +0200
@@ -132,6 +132,7 @@
                            "digest", "distcc", "distlocks",
                            "fakeroot", "fail-clean", "fixpackages", "getbinpkg",
                            "installsources", "keeptemp", "keepwork", "fixlafiles", "lmirror",
+                            "macossandbox", "macosprefixsandbox", "macosusersandbox",
                            "metadata-transfer", "mirror", "multilib-strict", "news",
                            "noauto", "noclean", "nodoc", "noinfo", "noman", "nostrip",
                            "notitles", "parallel-fetch", "parse-eapi-ebuild-head",