| Summary: | use Sandbox/Seatbelt to confine ebuild on Mac OS X 10.5 | ||
|---|---|---|---|
| Product: | Gentoo/Alt | Reporter: | Michael Weiser <michael> |
| Component: | Prefix Support | Assignee: | Gentoo Prefix <prefix> |
| Status: | RESOLVED FIXED | ||
| Severity: | enhancement | CC: | leho |
| Priority: | High | Keywords: | InVCS |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | OS X | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
| Attachments: |
add Mac OS X 10.5 sandboxing to prefix-portage
add sandboxing to bootstrap-prefix.sh add sandboxing to recent version of prefix-portage add sandboxing to recent version of bootstrap-prefix.sh add sandboxing to recent version of prefix-portage mac os x sandbox/seatbelt for current prefix-portage patch for current portage small ebuild for testing various protection mechanisms mac os x sandbox/seatbelt for current prefix-portage |
||
|
Description
Michael Weiser
2008-03-09 12:32:44 UTC
Created attachment 145637 [details, diff]
add Mac OS X 10.5 sandboxing to prefix-portage
question (I lost it) does this also work as non-root? Hi Fabian, the sandboxing mechanism works nicely as non-root and I've used sandbox-enabled portage as non-root before bootstrapping a system-wide prefix portage which runs as root. The patch also contains a feature macosusersandbox analogous to the usersandbox feature for cases where a system-wide portage is told to run with normal user privileges. This is untested though. As of now I've compiled and installed quite a comprehensive prefix installation including aqua'd gtk, gimp and wireshark. I haven't had any problems. Those slight differencies in configure tests still persist and remain unexplained. They don't stop things from working nicely, though. -- Micha Created attachment 146708 [details, diff]
add sandboxing to bootstrap-prefix.sh
Almost forgotten: I've also added sandboxing to the bootstrap-prefix.sh script.
--
Cheers,
Micha
put this in the correct category I think this should wait until it's documented as an official feature (probably 10.6) (In reply to comment #6) > I think this should wait until it's documented as an official > feature (probably 10.6) By now the MAC framework and sandboxing feature are well advertised by Apple. They're just not very well documented, the few bits of documentation claiming a private interface subject to change at any time (header of .sb files in /usr/share/sandbox). This said and knowing Apple, it seems unlikely this will change very much with a future release. They'll change the interface and we'll need to adjust the portage feature for it but they probably won't improve the documentation situation. If you're worried about users unknowingly causing problems for themselves and reporting non-issues caused by a preliminary feature, you're probably right. On the other hand, it obviously won't get tested either. I've made it disabled by default, so two distinct features have to be put into the FEATURE variable explicitly to enable sandboxing on different levels. I've used it for quite some time now and have not had any problems. I still have a bug open with apple about configure test behaving differently when run inside a sandbox. They haven't gotten back to me, but it hasn't caused any problems for me either. Obviously it's low-priority to them, as it's not a user-visible feature. -- Micha I should add your portage patch, long overdue... I hope it still applies (In reply to comment #8) > I should add your portage patch, long overdue... I hope it still applies Never fear! ;) I have current versions and will attach them here right away. The portage patch broke several times, but mostly due to additions in const.py. -- Thanks for getting back to me! Micha Created attachment 208202 [details, diff]
add sandboxing to recent version of prefix-portage
Created attachment 208203 [details, diff]
add sandboxing to recent version of bootstrap-prefix.sh
Created attachment 208569 [details, diff]
add sandboxing to recent version of prefix-portage
here's a fixed version of your portage patch for the latest sources
Created attachment 225873 [details, diff]
mac os x sandbox/seatbelt for current prefix-portage
a new version of the patch for extensively reworked current portage
Created attachment 238679 [details, diff]
patch for current portage
a new patch for the current version of portage in prefix
Created attachment 238687 [details]
small ebuild for testing various protection mechanisms
a small ebuild for testing the various layers of protection against direct or indirect filesystem access
Created attachment 248497 [details, diff]
mac os x sandbox/seatbelt for current prefix-portage
(yet another ;) updated sandbox/seatbelt patch for current prefix-portage (16616)
I decided to commit your patch, should be available in the very next version of portage that hits the tree. Thanks! committed as 2.2.01.16692 |
