If access is called with W_OK on a protected file, an open_wr violation is caused. For instance, with the attached program, I get the following output: loeh@bard ~/trans $ gcc -o access access.c loeh@bard ~/trans $ sandboxshell * Loading sandboxed shell * Log File: /tmp/sandboxme-05.08.2005-15.11.19.log * Debug Log File: /tmp/sandboxme-05.08.2005-15.11.19.log.debug * sandboxon: turn sandbox on * sandboxoff: turn sandbox off * addread <path>: allow <path> to be read * addwrite <path>: allow <path> to be written * adddeny <path>: deny access to <path> * addpredict <path>: allow fake access to <path> [s]loeh@bard ~/trans $ ./access ACCESS DENIED access_wr: /usr/bin/ls I would expect the access test to fail, but without a sandbox violation. Occurs with sandbox-1.2.11, but also with older versions. Really old versions (before sys-apps/sandbox existed) didn't have this problem, but I can no longer easily check.
Created attachment 65172 [details] test program
Created attachment 65176 [details, diff] sandbox-bug101433.patch Should fix it: ----- lycan kpathsea # sandbox ========================== Gentoo linux path sandbox =========================== Detection of the support files. Verification of the required files. Setting up the required environment variables. The protected environment has been started. -------------------------------------------------------------------------------- Process being started in forked instance. lycan portage # /root/bin/access w /bin/ls && echo yes || echo no no lycan portage # exit exit Cleaning up sandbox process ========================== Gentoo linux path sandbox =========================== The protected environment has been shut down. -------------------------------------------------------------------------------- lycan kpathsea #
Committed in trunk .. will be in next version (1.2.12).
*** Bug 95840 has been marked as a duplicate of this bug. ***
*** Bug 96453 has been marked as a duplicate of this bug. ***
*** Bug 101515 has been marked as a duplicate of this bug. ***
*** Bug 97707 has been marked as a duplicate of this bug. ***
Can we please stable sandbox-1.2.12 by all archs?
stable on ppc64
Stable on x86
Stable on ppc and hppa.
sparc stable.
*** Bug 98694 has been marked as a duplicate of this bug. ***
Stable on alpha, sorry for the delay guys Cheers, Ferdy
Hmm, does mips actually use sandbox by now? Or can we consider this closed?
sandbox does work on MIPS, however, it's been known to really slow down build times. It also causes problems with large builds. Given the hardware we use doesn't need assistance as far as going slow is concirned, we therefore don't use sandbox on MIPS. If there's a compelling reason for us to mark it stable, then sure, but otherwise I don't think it worth while. Close at will. :-)
K, fixed.
*** Bug 147714 has been marked as a duplicate of this bug. ***
*** Bug 147935 has been marked as a duplicate of this bug. ***
*** Bug 148610 has been marked as a duplicate of this bug. ***
I had my system repaired this way: FEATURES="-sandbox -usersandbox" emerge sandbox Then all access violation problems disappeared.
*** Bug 148982 has been marked as a duplicate of this bug. ***
*** Bug 149481 has been marked as a duplicate of this bug. ***
*** Bug 149486 has been marked as a duplicate of this bug. ***
*** Bug 150081 has been marked as a duplicate of this bug. ***
*** Bug 150305 has been marked as a duplicate of this bug. ***
*** Bug 150854 has been marked as a duplicate of this bug. ***
*** Bug 151066 has been marked as a duplicate of this bug. ***
*** Bug 152004 has been marked as a duplicate of this bug. ***
*** Bug 152035 has been marked as a duplicate of this bug. ***
*** Bug 152452 has been marked as a duplicate of this bug. ***
*** Bug 152698 has been marked as a duplicate of this bug. ***
*** Bug 152754 has been marked as a duplicate of this bug. ***
*** Bug 152755 has been marked as a duplicate of this bug. ***
*** Bug 152857 has been marked as a duplicate of this bug. ***
*** Bug 153316 has been marked as a duplicate of this bug. ***
*** Bug 156025 has been marked as a duplicate of this bug. ***
