* [gentoo-commits] dev/anarchy:master commit in: sys-apps/sandbox/files/, sys-apps/sandbox/
@ 2013-09-01 18:01 Jory Pratt
0 siblings, 0 replies; 2+ messages in thread
From: Jory Pratt @ 2013-09-01 18:01 UTC (permalink / raw
To: gentoo-commits
commit: 1452587eeadccfe5e58bde990d67f6447bbddb33
Author: Jory A. Pratt <anarchy <AT> gentoo <DOT> org>
AuthorDate: Sun Sep 1 18:01:04 2013 +0000
Commit: Jory Pratt <anarchy <AT> gentoo <DOT> org>
CommitDate: Sun Sep 1 18:01:04 2013 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=dev/anarchy.git;a=commit;h=1452587e
Add pch useflag to sandbox-2.6 for hardened support
---
sys-apps/sandbox/Manifest | 10 +
sys-apps/sandbox/files/09sandbox | 1 +
.../files/sandbox-2.6-check-empty-paths-at.patch | 201 +++++++++++++++++++++
sys-apps/sandbox/files/sandbox-2.6-desktop.patch | 30 +++
.../sandbox/files/sandbox-2.6-hardened-pch.patch | 88 +++++++++
sys-apps/sandbox/files/sandbox-2.6-log-var.patch | 51 ++++++
.../sandbox/files/sandbox-2.6-open-nofollow.patch | 54 ++++++
.../files/sandbox-2.6-static-close-fd.patch | 93 ++++++++++
.../sandbox/files/sandbox-2.6-trace-hppa.patch | 27 +++
sys-apps/sandbox/sandbox-2.6-r1.ebuild | 132 ++++++++++++++
10 files changed, 687 insertions(+)
diff --git a/sys-apps/sandbox/Manifest b/sys-apps/sandbox/Manifest
new file mode 100644
index 0000000..33c0d48
--- /dev/null
+++ b/sys-apps/sandbox/Manifest
@@ -0,0 +1,10 @@
+AUX 09sandbox 37 SHA256 73e9e9d12ba54f1c649813ec86107924050528852c890a8ba1e2853796781bbe SHA512 4e8a9c58debde6480224a45559c5f2db4765213d151e47937f9142f110cac3681bf6402acaf21249a37bb17398e7bc00ae7feee68ecdb5b9363c432eac1b052a WHIRLPOOL 80d55a34d3faf3314f2b9de2200d4b46a800128514be9e30eb59e5f03fb7a0a5197a9e5b5ab33d6b68d35bf83c86a1bd7ba734a33ccd382fe0af3b2c2a11d0bd
+AUX sandbox-2.6-check-empty-paths-at.patch 7454 SHA256 a48759a4d3e9a70713473b6fad59bdd750b5cd37e7d632c786205ff20004ae2c SHA512 5eba7915dedf57f44c37881e9c6b48db8733d1493779a33127d08bb9ea77056d788ec9ace72c13eb101f42f01c95309c7cebca6c76212a8c99a8655372c0b7d7 WHIRLPOOL 46eb3a8ef8f22030cd793f3b16adc190b5750019c0df83e161c6918f08555a8ad890c1425b03cbf7e53ebcd34a07a9dd9b594d0c0fe31834656ffce3d58fa284
+AUX sandbox-2.6-desktop.patch 875 SHA256 2eecf67790aeac210f9aa899a86f7664776ed65d9b55159e1b359162dfb9ff74 SHA512 b72ec7f414d19bf513dfb1aea10523fa5dc07a1375d8f08f664d204b64b23c891a79ca14987528c595936f441e1f595b366aabbc57313667c7639d73d089ed9a WHIRLPOOL 7f787b8be9b5712eb2b2a0cd2ff825df1045ebf1cc4e73a50f610e620d30752045690a5c28835465d0ab0c3c4a9eaf8b92a5c123cd741ad69dfedb31aa457fa0
+AUX sandbox-2.6-hardened-pch.patch 2615 SHA256 b24500876b595dcaee46e23dffedc50729ce7af1c7fbfce9cead2cd7a8566ff3 SHA512 439f78d0261996a648053f3b34a9fa34eb0d145862136769a3d448f5314be76046d02a0bcce8fd9cfb59d82fdafe79653c182d104f98c4b51be2c08ce835c8bd WHIRLPOOL 8221650ad746161af71a1b1f5f041a5696b4168d2c1fd3fb1997ba0464ef14de50592d9dd4ecc6981f812ae50e4d2c18c138a40bcdcce1b7f6d5b84f711211a6
+AUX sandbox-2.6-log-var.patch 2039 SHA256 f464a29cdd9de0c510277310f4febc8f96515ff2ff03fc92df1c75b9cbd75619 SHA512 cf6f900b4078eff5870b63b2bc7c81c5b00488e030d7e9ce3007693e9d1339ac6201ddacfaff552c6c9b99b6d32383229133c80190404b7e4fde06ad376b2050 WHIRLPOOL db99737a6567788194f7b37b12b92fcfb4c263df40f40aef9e0a3ef2b6a1523331313b791fffa2b26775b646795364ab1db1711eb4329cda3337df27aebfeffa
+AUX sandbox-2.6-open-nofollow.patch 2027 SHA256 c8816ae4e1991f9941abd43ec4bfdbf4e99cf36ee90694f77ab88754c53785ce SHA512 dd5222f32a40def38c9719363a24c48d5b112e3560b44c5f32afc3daa0614fe9bc5cb68ca8ac69032cc8d6299f09b25d4d7c72e16892188b42768ffb28c19f07 WHIRLPOOL 03cb5fb9df04a8d7f92855c292a6c431d01d330fecae198f2c4b95d824454f10ce1ad66db1a9d54d1bef5f74989cf6debb2d98de28ee0c2c6a09c1a0752b5519
+AUX sandbox-2.6-static-close-fd.patch 2945 SHA256 807eb4dc1ba6543c94a90a9a53bb89f42079ea20ed7c196f82d65f280e5de96a SHA512 e2f57c4d80816241f3ba4828c2b27c67d1d604b14b2d575888a978e5c4e8e47e60e3a609d81e59c615bc5b7cee6194cc362e255ae8508f632862a35180c30de8 WHIRLPOOL e08f60227fe954894d3a3a01297e9988f4d7722ea75ffbd2b0f3971d38c8ce00af230fcaecb1f53243a868d54f48bb680e2d547bbeb2ee3e5a11f8942d2084fd
+AUX sandbox-2.6-trace-hppa.patch 850 SHA256 20688b2f33162f95af4af5e3c7d3700f2e7776e454b785ac1398f0870f84efa9 SHA512 fb7bf2202f960e952edc1e52fe4b6b085042158223d96b9baa899e871abcdef711ede3122c971120f55f71cc1aad71496a6079222dbaaa6c14b0c6f7ea182454 WHIRLPOOL 80f7fb529b912d19d81b9d71ee4a648db7b217583f2e8f2054cc666839030ea7d0112d69d52a2bf35c4d3549ffbd81dbd0cd39d5993bfabbb43bcb6a4455ade4
+DIST sandbox-2.6.tar.xz 366356 SHA256 95615c5879dfc419713f22ba5506a2802a50ea0ce8a2f57c656354f2e50b1c4d SHA512 32ba7fb675c67fdc8bc52da1db7ed6878e5fea8753accb30d9aca00f708e0dde03287b5962caf5ef031bea6934d6ef3e18404b015c70ebd551d3fd8109ad2371 WHIRLPOOL bab2d015fb0de92a2266408ca7941c8fb66b599179040cfc727ffce5b2424a9722dc55ba89d198e3361044d8cb357314205488d2a980c7b8af063fd8940f0c03
+EBUILD sandbox-2.6-r1.ebuild 3161 SHA256 964556ee3f429cedbd54d4ea9c8c9a468b886199f390b909864e5c35a454bfa4 SHA512 25492535b1a623482c3bec466a3cfc8277ef5f82e3548085dc35a0ac24c5ab5cbedd32ad99c9da07dccd9c116b1c5a532908c5a3023aea6cdfb4dd94ec380c04 WHIRLPOOL 6fb8b8d1426bc8f6e0496bf6afe693bf544fdabacbdefdb310261e0d5dc0ba7548c26a8d26d4c29e8885805ebccc5e9852c3a2573cd6815960aa8f9ee2d21973
diff --git a/sys-apps/sandbox/files/09sandbox b/sys-apps/sandbox/files/09sandbox
new file mode 100644
index 0000000..9181eb0
--- /dev/null
+++ b/sys-apps/sandbox/files/09sandbox
@@ -0,0 +1 @@
+CONFIG_PROTECT_MASK="/etc/sandbox.d"
diff --git a/sys-apps/sandbox/files/sandbox-2.6-check-empty-paths-at.patch b/sys-apps/sandbox/files/sandbox-2.6-check-empty-paths-at.patch
new file mode 100644
index 0000000..e4dc529
--- /dev/null
+++ b/sys-apps/sandbox/files/sandbox-2.6-check-empty-paths-at.patch
@@ -0,0 +1,201 @@
+From dd726dcc6a95355d0e0cc949018d9c8aefc89a02 Mon Sep 17 00:00:00 2001
+From: Mike Frysinger <vapier@gentoo.org>
+Date: Mon, 24 Dec 2012 19:41:49 -0500
+Subject: [PATCH 1/2] libsandbox: reject "" paths with *at funcs before
+ checking the dirfd
+
+When it comes to processing errors, an empty path is checked before
+an invalid dirfd. Make sure sandbox matches that behavior for the
+random testsuites out there that look for this.
+
+URL: https://bugs.gentoo.org/346929
+Reported-by: Marien Zwart <marienz@gentoo.org>
+Signed-off-by: Mike Frysinger <vapier@gentoo.org>
+---
+ libsandbox/wrapper-funcs/__pre_check.c | 2 ++
+ libsandbox/wrapper-funcs/mkdirat_pre_check.c | 17 +++++------------
+ libsandbox/wrapper-funcs/openat_pre_check.c | 15 ++++-----------
+ libsandbox/wrapper-funcs/unlinkat_pre_check.c | 17 +++++------------
+ libsandbox/wrappers.h | 2 ++
+ tests/mkdirat-3.sh | 7 +++++++
+ tests/mkdirat.at | 1 +
+ tests/openat-2.sh | 9 +++++++++
+ tests/openat.at | 1 +
+ tests/unlinkat-4.sh | 7 +++++++
+ tests/unlinkat.at | 1 +
+ 11 files changed, 44 insertions(+), 35 deletions(-)
+ create mode 100755 tests/mkdirat-3.sh
+ create mode 100755 tests/openat-2.sh
+ create mode 100755 tests/unlinkat-4.sh
+
+diff --git a/libsandbox/wrapper-funcs/__pre_check.c b/libsandbox/wrapper-funcs/__pre_check.c
+index 2d5711f..28ad91f 100644
+--- a/libsandbox/wrapper-funcs/__pre_check.c
++++ b/libsandbox/wrapper-funcs/__pre_check.c
+@@ -20,3 +20,5 @@
+ #if SB_NR_UNLINK != SB_NR_UNDEF && SB_NR_UNLINKAT == SB_NR_UNDEF
+ # include "unlinkat_pre_check.c"
+ #endif
++
++#include "__pre_at_check.c"
+diff --git a/libsandbox/wrapper-funcs/mkdirat_pre_check.c b/libsandbox/wrapper-funcs/mkdirat_pre_check.c
+index 77a65df..0b48d1f 100644
+--- a/libsandbox/wrapper-funcs/mkdirat_pre_check.c
++++ b/libsandbox/wrapper-funcs/mkdirat_pre_check.c
+@@ -1,20 +1,13 @@
+ bool sb_mkdirat_pre_check(const char *func, const char *pathname, int dirfd)
+ {
+ char canonic[SB_PATH_MAX];
+- char dirfd_path[SB_PATH_MAX];
+
+ save_errno();
+
+- /* Expand the dirfd path first */
+- switch (resolve_dirfd_path(dirfd, pathname, dirfd_path, sizeof(dirfd_path))) {
+- case -1:
+- sb_debug_dyn("EARLY FAIL: %s(%s) @ resolve_dirfd_path: %s\n",
+- func, pathname, strerror(errno));
+- return false;
+- case 0:
+- pathname = dirfd_path;
+- break;
+- }
++ /* Check incoming args against common *at issues */
++ char dirfd_path[SB_PATH_MAX];
++ if (!sb_common_at_pre_check(func, &pathname, dirfd, dirfd_path, sizeof(dirfd_path)))
++ return false;
+
+ /* Then break down any relative/symlink paths */
+ if (-1 == canonicalize(pathname, canonic))
+diff --git a/libsandbox/wrapper-funcs/openat_pre_check.c b/libsandbox/wrapper-funcs/openat_pre_check.c
+index 0127708..5fd5eaa 100644
+--- a/libsandbox/wrapper-funcs/openat_pre_check.c
++++ b/libsandbox/wrapper-funcs/openat_pre_check.c
+@@ -15,17 +15,10 @@ bool sb_openat_pre_check(const char *func, const char *pathname, int dirfd, int
+
+ save_errno();
+
+- /* Expand the dirfd path first */
++ /* Check incoming args against common *at issues */
+ char dirfd_path[SB_PATH_MAX];
+- switch (resolve_dirfd_path(dirfd, pathname, dirfd_path, sizeof(dirfd_path))) {
+- case -1:
+- sb_debug_dyn("EARLY FAIL: %s(%s) @ resolve_dirfd_path: %s\n",
+- func, pathname, strerror(errno));
+- return false;
+- case 0:
+- pathname = dirfd_path;
+- break;
+- }
++ if (!sb_common_at_pre_check(func, &pathname, dirfd, dirfd_path, sizeof(dirfd_path)))
++ return false;
+
+ /* Doesn't exist -> skip permission checks */
+ struct stat st;
+diff --git a/libsandbox/wrapper-funcs/unlinkat_pre_check.c b/libsandbox/wrapper-funcs/unlinkat_pre_check.c
+index 9f5e7d7..c004d15 100644
+--- a/libsandbox/wrapper-funcs/unlinkat_pre_check.c
++++ b/libsandbox/wrapper-funcs/unlinkat_pre_check.c
+@@ -1,20 +1,13 @@
+ bool sb_unlinkat_pre_check(const char *func, const char *pathname, int dirfd)
+ {
+ char canonic[SB_PATH_MAX];
+- char dirfd_path[SB_PATH_MAX];
+
+ save_errno();
+
+- /* Expand the dirfd path first */
+- switch (resolve_dirfd_path(dirfd, pathname, dirfd_path, sizeof(dirfd_path))) {
+- case -1:
+- sb_debug_dyn("EARLY FAIL: %s(%s) @ resolve_dirfd_path: %s\n",
+- func, pathname, strerror(errno));
+- return false;
+- case 0:
+- pathname = dirfd_path;
+- break;
+- }
++ /* Check incoming args against common *at issues */
++ char dirfd_path[SB_PATH_MAX];
++ if (!sb_common_at_pre_check(func, &pathname, dirfd, dirfd_path, sizeof(dirfd_path)))
++ return false;
+
+ /* Then break down any relative/symlink paths */
+ if (-1 == canonicalize(pathname, canonic))
+diff --git a/libsandbox/wrappers.h b/libsandbox/wrappers.h
+index 5b97787..0aa58bb 100644
+--- a/libsandbox/wrappers.h
++++ b/libsandbox/wrappers.h
+@@ -28,5 +28,7 @@ attribute_hidden bool sb_mkdirat_pre_check (const char *func, const char *pathn
+ attribute_hidden bool sb_openat_pre_check (const char *func, const char *pathname, int dirfd, int flags);
+ attribute_hidden bool sb_openat64_pre_check (const char *func, const char *pathname, int dirfd, int flags);
+ attribute_hidden bool sb_unlinkat_pre_check (const char *func, const char *pathname, int dirfd);
++attribute_hidden bool sb_common_at_pre_check(const char *func, const char **pathname, int dirfd,
++ char *dirfd_path, size_t dirfd_path_len);
+
+ #endif
+--
+1.8.1.2
+
+From 0b8a6d9773cc0e6d86bf1187f46817d5716698fe Mon Sep 17 00:00:00 2001
+From: Mike Frysinger <vapier@gentoo.org>
+Date: Mon, 24 Dec 2012 19:41:49 -0500
+Subject: [PATCH 2/2] libsandbox: reject "" paths with *at funcs before
+ checking the dirfd [missing file]
+
+When it comes to processing errors, an empty path is checked before
+an invalid dirfd. Make sure sandbox matches that behavior for the
+random testsuites out there that look for this.
+
+Forgot to `git add` in the previous commit :/.
+
+URL: https://bugs.gentoo.org/346929
+Reported-by: Marien Zwart <marienz@gentoo.org>
+Signed-off-by: Mike Frysinger <vapier@gentoo.org>
+---
+ libsandbox/wrapper-funcs/__pre_at_check.c | 34 +++++++++++++++++++++++++++++++
+ 1 file changed, 34 insertions(+)
+ create mode 100644 libsandbox/wrapper-funcs/__pre_at_check.c
+
+diff --git a/libsandbox/wrapper-funcs/__pre_at_check.c b/libsandbox/wrapper-funcs/__pre_at_check.c
+new file mode 100644
+index 0000000..f72c40c
+--- /dev/null
++++ b/libsandbox/wrapper-funcs/__pre_at_check.c
+@@ -0,0 +1,34 @@
++/*
++ * common *at() pre-checks.
++ *
++ * Copyright 1999-2012 Gentoo Foundation
++ * Licensed under the GPL-2
++ */
++
++/* We assume the parent has nested use with save/restore errno */
++bool sb_common_at_pre_check(const char *func, const char **pathname, int dirfd,
++ char *dirfd_path, size_t dirfd_path_len)
++{
++ /* the empty path name should fail with ENOENT before any dirfd
++ * checks get a chance to run #346929
++ */
++ if (*pathname && *pathname[0] == '\0') {
++ errno = ENOENT;
++ sb_debug_dyn("EARLY FAIL: %s(%s): %s\n",
++ func, *pathname, strerror(errno));
++ return false;
++ }
++
++ /* Expand the dirfd path first */
++ switch (resolve_dirfd_path(dirfd, *pathname, dirfd_path, dirfd_path_len)) {
++ case -1:
++ sb_debug_dyn("EARLY FAIL: %s(%s) @ resolve_dirfd_path: %s\n",
++ func, *pathname, strerror(errno));
++ return false;
++ case 0:
++ *pathname = dirfd_path;
++ break;
++ }
++
++ return true;
++}
+--
+1.8.1.2
+
diff --git a/sys-apps/sandbox/files/sandbox-2.6-desktop.patch b/sys-apps/sandbox/files/sandbox-2.6-desktop.patch
new file mode 100644
index 0000000..fbecb07
--- /dev/null
+++ b/sys-apps/sandbox/files/sandbox-2.6-desktop.patch
@@ -0,0 +1,30 @@
+From 00044ab0c8aaaabf048b5ff0ec2da5b3d7d25752 Mon Sep 17 00:00:00 2001
+From: Mike Frysinger <vapier@gentoo.org>
+Date: Sat, 17 Nov 2012 14:14:26 -0500
+Subject: [PATCH] sandbox.desktop: drop .svg from Icon field
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+URL: http://bugs.gentoo.org/443672
+Reported-by: Petteri Räty <betelgeuse@gentoo.org>
+Signed-off-by: Mike Frysinger <vapier@gentoo.org>
+---
+ data/sandbox.desktop | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/data/sandbox.desktop b/data/sandbox.desktop
+index 5b5b576..27a887e 100644
+--- a/data/sandbox.desktop
++++ b/data/sandbox.desktop
+@@ -5,6 +5,6 @@ Type=Application
+ Comment=launch a sandboxed shell ... useful for debugging ebuilds
+ Exec=sandbox
+ TryExec=sandbox
+-Icon=sandbox.svg
++Icon=sandbox
+ Categories=Development;
+ Terminal=true
+--
+1.8.1.2
+
diff --git a/sys-apps/sandbox/files/sandbox-2.6-hardened-pch.patch b/sys-apps/sandbox/files/sandbox-2.6-hardened-pch.patch
new file mode 100644
index 0000000..611122a
--- /dev/null
+++ b/sys-apps/sandbox/files/sandbox-2.6-hardened-pch.patch
@@ -0,0 +1,88 @@
+From: Mike Frysinger <vapier@gentoo.org>
+Date: Tue, 28 Aug 2012 16:19:56 +0000 (-0400)
+Subject: add a configure option to control pch usage
+X-Git-Url: http://git.overlays.gentoo.org/gitweb/?p=proj%2Fsandbox.git;a=commitdiff_plain;h=f2500f5954611d110ac18e9990f42d5a915f8101
+
+add a configure option to control pch usage
+
+Mostly for testing purposes. This also tweaks the dependency to fix a
+warning when generating the headers.h.pch in subdirs when the toplevel
+headers.h.pch already exists.
+
+URL: http://bugs.gentoo.org/425524
+Signed-off-by: Mike Frysinger <vapier@gentoo.org>
+---
+
+diff --git a/Makefile.am b/Makefile.am
+index 475c8c0..eb54f42 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -11,9 +11,9 @@ SUBDIRS = \
+ src \
+ tests
+
++noinst_LTLIBRARIES =
++
+ SANDBOX_PCH = headers.h.gch libsandbox/headers.h.gch libsbutil/headers.h.gch
+-BUILT_SOURCES = $(SANDBOX_PCH)
+-noinst_LTLIBRARIES = libpch.la
+ nodist_libpch_la_SOURCES = $(SANDBOX_PCH)
+ GCH_CP = ( \
+ src=`dirname $@`/.libs/`basename $@`.o; \
+@@ -30,10 +30,23 @@ $(builddir)/libsandbox/headers.h.gch: headers.h
+ $(builddir)/headers.h.gch: headers.h
+ $(AM_V_GEN)$(COMPILE) -c -o $@.o $< && $(GCH_CP)
+
+-libsbutil: libsbutil/headers.h.gch
+-libsandbox: libsbutil libsandbox/headers.h.gch
+-src: libsbutil headers.h.gch
+-tests: src headers.h.gch
++if SB_BUILD_PCH
++BUILT_SOURCES = $(SANDBOX_PCH)
++noinst_LTLIBRARIES += libpch.la
++
++LIBSBUTIL_PCH = libsbutil/headers.h.gch
++LIBSANDBOX_PCH = libsandbox/headers.h.gch
++TOP_PCH = headers.h.gch
++
++# Make sure we build the subdirs before the top so they don't
++# try to use the top level headers.h.pch.
++$(TOP_PCH): $(LIBSBUTIL_PCH) $(LIBSANDBOX_PCH)
++endif
++
++libsbutil: $(LIBSBUTIL_PCH)
++libsandbox: libsbutil $(LIBSANDBOX_PCH)
++src: libsbutil $(TOP_PCH)
++tests: src $(TOP_PCH)
+
+ EXTRA_DIST = headers.h localdecls.h ChangeLog.0
+
+diff --git a/configure.ac b/configure.ac
+index 661b494..ca0d3ac 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -26,7 +26,7 @@ AC_ISC_POSIX
+ AC_USE_SYSTEM_EXTENSIONS
+
+ dnl Checks for programs.
+-AM_PROG_AR
++#AM_PROG_AR
+ AC_PROG_INSTALL
+ AC_PROG_MAKE_SET
+ AC_PROG_AWK
+@@ -38,6 +38,14 @@ LT_INIT([disable-static])
+
+ AC_PREFIX_DEFAULT([/usr])
+
++dnl allow pch to be controlled
++AC_MSG_CHECKING([whether to use pre-compiled sandbox headers])
++AC_ARG_ENABLE([pch],
++ [AS_HELP_STRING([--disable-pch],[Disable pre-compiled headers])],
++ [],[enable_pch="yes"])
++AM_CONDITIONAL([SB_BUILD_PCH], test "$enable_pch" = "yes")
++AC_MSG_RESULT($enable_pch)
++
+ dnl multiple personality support (x86 & x86_64: multilib)
+ AC_MSG_CHECKING([for multiple personalities])
+ AC_ARG_ENABLE([schizo],
+
diff --git a/sys-apps/sandbox/files/sandbox-2.6-log-var.patch b/sys-apps/sandbox/files/sandbox-2.6-log-var.patch
new file mode 100644
index 0000000..bfea9e5
--- /dev/null
+++ b/sys-apps/sandbox/files/sandbox-2.6-log-var.patch
@@ -0,0 +1,51 @@
+From 853b42c86432eefc6d4cfba86197fb37d446366d Mon Sep 17 00:00:00 2001
+From: Mike Frysinger <vapier@gentoo.org>
+Date: Sun, 3 Mar 2013 05:34:09 -0500
+Subject: [PATCH] sandbox: accept SANDBOX_LOG vars whatever their values
+
+Commit 40abb498ca4a24495fe34e133379382ce8c3eaca subtly broke the sandbox
+with portage. It changed how the sandbox log env var was accessed by
+moving from getenv() to get_sandbox_log(). The latter has path checking
+and will kick out values that contain a slash. That means every time a
+new process starts, a new sandbox log path will be generated, and when a
+program triggers a violation, it'll write to the new file. Meanwhile,
+portage itself watches the original one which never gets updated.
+
+This code has been around forever w/out documentation, and I can't think
+of a reason we need it. So punt it.
+
+Signed-off-by: Mike Frysinger <vapier@gentoo.org>
+---
+ libsbutil/get_sandbox_log.c | 14 +++++---------
+ 1 file changed, 5 insertions(+), 9 deletions(-)
+
+diff --git a/libsbutil/get_sandbox_log.c b/libsbutil/get_sandbox_log.c
+index a79b399..bdb4278 100644
+--- a/libsbutil/get_sandbox_log.c
++++ b/libsbutil/get_sandbox_log.c
+@@ -21,17 +21,13 @@ static void _get_sb_log(char *path, const char *tmpdir, const char *env, const c
+
+ sandbox_log_env = getenv(env);
+
+- if (sandbox_log_env && is_env_on(ENV_SANDBOX_TESTING)) {
+- /* When testing, just use what the env says to */
++ if (sandbox_log_env) {
++ /* If the env is viable, roll with it. We aren't really
++ * about people breaking the security of the sandbox by
++ * exporting SANDBOX_LOG=/dev/null.
++ */
+ strncpy(path, sandbox_log_env, SB_PATH_MAX);
+ } else {
+- /* THIS CHUNK BREAK THINGS BY DOING THIS:
+- * SANDBOX_LOG=/tmp/sandbox-app-admin/superadduser-1.0.7-11063.log
+- */
+- if ((NULL != sandbox_log_env) &&
+- (NULL != strchr(sandbox_log_env, '/')))
+- sandbox_log_env = NULL;
+-
+ snprintf(path, SB_PATH_MAX, "%s%s%s%s%d%s",
+ SANDBOX_LOG_LOCATION, prefix,
+ (sandbox_log_env == NULL ? "" : sandbox_log_env),
+--
+1.8.1.2
+
diff --git a/sys-apps/sandbox/files/sandbox-2.6-open-nofollow.patch b/sys-apps/sandbox/files/sandbox-2.6-open-nofollow.patch
new file mode 100644
index 0000000..0101ece
--- /dev/null
+++ b/sys-apps/sandbox/files/sandbox-2.6-open-nofollow.patch
@@ -0,0 +1,54 @@
+From 45fa8714a1d35e6555083d88a71851ada2aacac4 Mon Sep 17 00:00:00 2001
+From: Mike Frysinger <vapier@gentoo.org>
+Date: Mon, 24 Dec 2012 18:46:29 -0500
+Subject: [PATCH] libsandbox: handle open(O_NOFOLLOW)
+
+We don't check for O_NOFOLLOW in the open wrappers, so we end up
+returning the wrong error when operating on broken symlinks.
+
+URL: https://bugs.gentoo.org/413441
+Reported-by: Marien Zwart <marienz@gentoo.org>
+Signed-off-by: Mike Frysinger <vapier@gentoo.org>
+---
+ libsandbox/wrapper-funcs/__64_post.h | 1 +
+ libsandbox/wrapper-funcs/__64_pre.h | 1 +
+ libsandbox/wrapper-funcs/openat_pre_check.c | 2 +-
+ tests/open-2.sh | 10 ++++++++++
+ tests/open.at | 1 +
+ 5 files changed, 14 insertions(+), 1 deletion(-)
+ create mode 100755 tests/open-2.sh
+
+diff --git a/libsandbox/wrapper-funcs/__64_post.h b/libsandbox/wrapper-funcs/__64_post.h
+index 2fd2182..82d2a16 100644
+--- a/libsandbox/wrapper-funcs/__64_post.h
++++ b/libsandbox/wrapper-funcs/__64_post.h
+@@ -1,3 +1,4 @@
+ #undef SB64
+ #undef stat
++#undef lstat
+ #undef off_t
+diff --git a/libsandbox/wrapper-funcs/__64_pre.h b/libsandbox/wrapper-funcs/__64_pre.h
+index 2132110..0b34b25 100644
+--- a/libsandbox/wrapper-funcs/__64_pre.h
++++ b/libsandbox/wrapper-funcs/__64_pre.h
+@@ -1,3 +1,4 @@
+ #define SB64
+ #define stat stat64
++#define lstat lstat64
+ #define off_t off64_t
+diff --git a/libsandbox/wrapper-funcs/openat_pre_check.c b/libsandbox/wrapper-funcs/openat_pre_check.c
+index c827ee6..0127708 100644
+--- a/libsandbox/wrapper-funcs/openat_pre_check.c
++++ b/libsandbox/wrapper-funcs/openat_pre_check.c
+@@ -29,7 +29,7 @@ bool sb_openat_pre_check(const char *func, const char *pathname, int dirfd, int
+
+ /* Doesn't exist -> skip permission checks */
+ struct stat st;
+- if (-1 == stat(pathname, &st)) {
++ if (((flags & O_NOFOLLOW) ? lstat(pathname, &st) : stat(pathname, &st)) == -1) {
+ sb_debug_dyn("EARLY FAIL: %s(%s): %s\n",
+ func, pathname, strerror(errno));
+ return false;
+--
+1.8.1.2
+
diff --git a/sys-apps/sandbox/files/sandbox-2.6-static-close-fd.patch b/sys-apps/sandbox/files/sandbox-2.6-static-close-fd.patch
new file mode 100644
index 0000000..7fc0972
--- /dev/null
+++ b/sys-apps/sandbox/files/sandbox-2.6-static-close-fd.patch
@@ -0,0 +1,93 @@
+From a3ff1534945c3898332b2481c9fd355dfbd56e1f Mon Sep 17 00:00:00 2001
+From: Mike Frysinger <vapier@gentoo.org>
+Date: Sat, 23 Jun 2012 11:52:51 -0700
+Subject: [PATCH] libsandbox: clean up open file handles in parent tracing
+ process
+
+Currently, if a non-static app sets up a pipe (with cloexec enabled) and
+executes a static app, the handle to that pipe is left open in the parent
+process. This causes trouble when the parent is waiting for that to be
+closed immediately.
+
+Since none of the fds in the forked parent process matter to us, we can
+just go ahead and clean up all fds before we start tracing the child.
+
+URL: http://bugs.gentoo.org/364877
+Reported-by: Victor Stinner <victor.stinner@haypocalc.com>
+Signed-off-by: Mike Frysinger <vapier@gentoo.org>
+---
+ libsandbox/trace.c | 3 +-
+ libsbutil/sb_close.c | 26 +++++++++++-
+ libsbutil/sbutil.h | 1 +
+ tests/Makefile.am | 2 +
+ tests/pipe-fork_static_tst.c | 18 +++++++++
+ tests/pipe-fork_tst.c | 95 ++++++++++++++++++++++++++++++++++++++++++++
+ tests/script-9.sh | 5 +++
+ tests/script.at | 1 +
+ 8 files changed, 149 insertions(+), 2 deletions(-)
+ create mode 100644 tests/pipe-fork_static_tst.c
+ create mode 100644 tests/pipe-fork_tst.c
+ create mode 100755 tests/script-9.sh
+
+diff --git a/libsandbox/trace.c b/libsandbox/trace.c
+index 32ad2d6..dfbab18 100644
+--- a/libsandbox/trace.c
++++ b/libsandbox/trace.c
+@@ -504,8 +504,9 @@ void trace_main(const char *filename, char *const argv[])
+ /* Not all kernel versions support this, so ignore return */
+ ptrace(PTRACE_SETOPTIONS, trace_pid, NULL, (void *)PTRACE_O_TRACESYSGOOD);
+ #endif
++ sb_close_all_fds();
+ trace_loop();
+- return;
++ sb_ebort("ISE: child should have quit, as should we\n");
+ }
+
+ sb_debug("child setting up ...");
+diff --git a/libsbutil/sb_close.c b/libsbutil/sb_close.c
+index 17a4560..5379197 100644
+--- a/libsbutil/sb_close.c
++++ b/libsbutil/sb_close.c
+@@ -29,3 +29,27 @@ int sb_close(int fd)
+
+ return res;
+ }
++
++/* Quickly close all the open fds (good for daemonization) */
++void sb_close_all_fds(void)
++{
++ DIR *dirp;
++ struct dirent *de;
++ int dfd, fd;
++ const char *fd_dir = sb_get_fd_dir();
++
++ dirp = opendir(fd_dir);
++ if (!dirp)
++ sb_ebort("could not process %s\n", fd_dir);
++ dfd = dirfd(dirp);
++
++ while ((de = readdir(dirp)) != NULL) {
++ if (de->d_name[0] == '.')
++ continue;
++ fd = atoi(de->d_name);
++ if (fd != dfd)
++ close(fd);
++ }
++
++ closedir(dirp);
++}
+diff --git a/libsbutil/sbutil.h b/libsbutil/sbutil.h
+index 02b88cb..479734b 100644
+--- a/libsbutil/sbutil.h
++++ b/libsbutil/sbutil.h
+@@ -97,6 +97,7 @@ int sb_open(const char *path, int flags, mode_t mode);
+ size_t sb_read(int fd, void *buf, size_t count);
+ size_t sb_write(int fd, const void *buf, size_t count);
+ int sb_close(int fd);
++void sb_close_all_fds(void);
+ int sb_copy_file_to_fd(const char *file, int ofd);
+
+ /* Reliable output */
+--
+1.8.1.2
+
diff --git a/sys-apps/sandbox/files/sandbox-2.6-trace-hppa.patch b/sys-apps/sandbox/files/sandbox-2.6-trace-hppa.patch
new file mode 100644
index 0000000..7e73822
--- /dev/null
+++ b/sys-apps/sandbox/files/sandbox-2.6-trace-hppa.patch
@@ -0,0 +1,27 @@
+From 7b01f6103a9baddaf0252e7f850a4cef91a48b67 Mon Sep 17 00:00:00 2001
+From: Mike Frysinger <vapier@gentoo.org>
+Date: Fri, 6 Jul 2012 14:58:16 -0400
+Subject: [PATCH] libsandbox: fix hppa trace code
+
+URL: https://bugs.gentoo.org/425062
+Reported-by: Jeroen Roovers <jer@gentoo.org>
+Signed-off-by: Mike Frysinger <vapier@gentoo.org>
+---
+ libsandbox/trace/linux/hppa.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/libsandbox/trace/linux/hppa.c b/libsandbox/trace/linux/hppa.c
+index d23b0d1..5414354 100644
+--- a/libsandbox/trace/linux/hppa.c
++++ b/libsandbox/trace/linux/hppa.c
+@@ -1,5 +1,5 @@
+-#define trace_reg_sysnum (20 * 4) /* PT_GR20 */
+-#define trace_reg_ret (28 * 4) /* PT_GR28 */
++#define trace_reg_sysnum gr[20]
++#define trace_reg_ret gr[28]
+
+ static unsigned long trace_arg(void *vregs, int num)
+ {
+--
+1.7.9.7
+
diff --git a/sys-apps/sandbox/sandbox-2.6-r1.ebuild b/sys-apps/sandbox/sandbox-2.6-r1.ebuild
new file mode 100644
index 0000000..25130d2
--- /dev/null
+++ b/sys-apps/sandbox/sandbox-2.6-r1.ebuild
@@ -0,0 +1,132 @@
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sys-apps/sandbox/sandbox-2.6-r1.ebuild,v 1.12 2013/07/02 07:43:42 ago Exp $
+
+#
+# don't monkey with this ebuild unless contacting portage devs.
+# period.
+#
+
+inherit autotools eutils flag-o-matic toolchain-funcs multilib unpacker multiprocessing
+
+DESCRIPTION="sandbox'd LD_PRELOAD hack"
+HOMEPAGE="http://www.gentoo.org/"
+SRC_URI="mirror://gentoo/${P}.tar.xz
+ http://dev.gentoo.org/~vapier/dist/${P}.tar.xz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="alpha amd64 arm hppa ia64 ~m68k ~mips ppc ppc64 s390 sh sparc x86 ~sparc-fbsd -x86-fbsd"
+IUSE="multilib pch"
+
+DEPEND="app-arch/xz-utils
+ >=app-misc/pax-utils-0.1.19" #265376
+RDEPEND=""
+
+EMULTILIB_PKG="true"
+has sandbox_death_notice ${EBUILD_DEATH_HOOKS} || EBUILD_DEATH_HOOKS="${EBUILD_DEATH_HOOKS} sandbox_death_notice"
+
+sandbox_death_notice() {
+ ewarn "If configure failed with a 'cannot run C compiled programs' error, try this:"
+ ewarn "FEATURES=-sandbox emerge sandbox"
+}
+
+sb_get_install_abis() { use multilib && get_install_abis || echo ${ABI:-default} ; }
+
+sb_foreach_abi() {
+ local OABI=${ABI}
+ for ABI in $(sb_get_install_abis) ; do
+ cd "${WORKDIR}/build-${ABI}"
+ einfo "Running $1 for ABI=${ABI}..."
+ "$@"
+ done
+ ABI=${OABI}
+}
+
+src_unpack() {
+ unpacker
+ cd "${S}"
+ epatch "${FILESDIR}"/${P}-trace-hppa.patch #425062
+ epatch "${FILESDIR}"/${P}-log-var.patch
+ epatch "${FILESDIR}"/${P}-static-close-fd.patch #364877
+ epatch "${FILESDIR}"/${P}-desktop.patch #443672
+ epatch "${FILESDIR}"/${P}-open-nofollow.patch #413441
+ epatch "${FILESDIR}"/${P}-check-empty-paths-at.patch #346929
+ epatch "${FILESDIR}"/${P}-hardened-pch.patch #425524
+ epatch_user
+
+ eautoreconf
+}
+
+sb_configure() {
+ mkdir "${WORKDIR}/build-${ABI}"
+ cd "${WORKDIR}/build-${ABI}"
+
+ use multilib && multilib_toolchain_setup ${ABI}
+
+ einfo "Configuring sandbox for ABI=${ABI}..."
+ ECONF_SOURCE="../${P}/" \
+ econf $(use_enable pch) ${myconf} || die
+}
+
+sb_compile() {
+ emake || die
+}
+
+src_compile() {
+ filter-lfs-flags #90228
+
+ # Run configures in parallel!
+ multijob_init
+ local OABI=${ABI}
+ for ABI in $(sb_get_install_abis) ; do
+ multijob_child_init sb_configure
+ done
+ ABI=${OABI}
+ multijob_finish
+
+ sb_foreach_abi sb_compile
+}
+
+sb_test() {
+ emake check TESTSUITEFLAGS="--jobs=$(makeopts_jobs)" || die
+}
+
+src_test() {
+ sb_foreach_abi sb_test
+}
+
+sb_install() {
+ emake DESTDIR="${D}" install || die
+ insinto /etc/sandbox.d #333131
+ doins etc/sandbox.d/00default || die
+}
+
+src_install() {
+ sb_foreach_abi sb_install
+
+ doenvd "${FILESDIR}"/09sandbox
+
+ keepdir /var/log/sandbox
+ fowners root:portage /var/log/sandbox
+ fperms 0770 /var/log/sandbox
+
+ cd "${S}"
+ dodoc AUTHORS ChangeLog* NEWS README
+}
+
+pkg_preinst() {
+ chown root:portage "${D}"/var/log/sandbox
+ chmod 0770 "${D}"/var/log/sandbox
+
+ local old=$(find "${ROOT}"/lib* -maxdepth 1 -name 'libsandbox*')
+ if [[ -n ${old} ]] ; then
+ elog "Removing old sandbox libraries for you:"
+ elog ${old//${ROOT}}
+ find "${ROOT}"/lib* -maxdepth 1 -name 'libsandbox*' -exec rm -fv {} \;
+ fi
+}
+
+pkg_postinst() {
+ chmod 0755 "${ROOT}"/etc/sandbox.d #265376
+}
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [gentoo-commits] dev/anarchy:master commit in: sys-apps/sandbox/files/, sys-apps/sandbox/
@ 2015-08-29 3:49 Jory Pratt
0 siblings, 0 replies; 2+ messages in thread
From: Jory Pratt @ 2015-08-29 3:49 UTC (permalink / raw
To: gentoo-commits
commit: 543a9a0f3a27d387dbba0a92c2ac85e2dd71a73f
Author: Jory A. Pratt <anarchy <AT> gentoo <DOT> org>
AuthorDate: Sat Aug 29 03:49:30 2015 +0000
Commit: Jory Pratt <anarchy <AT> gentoo <DOT> org>
CommitDate: Sat Aug 29 03:49:30 2015 +0000
URL: https://gitweb.gentoo.org/dev/anarchy.git/commit/?id=543a9a0f
remove sandbox hacks
sys-apps/sandbox/Manifest | 10 -
sys-apps/sandbox/files/09sandbox | 1 -
.../files/sandbox-2.6-check-empty-paths-at.patch | 201 ---------------------
sys-apps/sandbox/files/sandbox-2.6-desktop.patch | 30 ---
.../sandbox/files/sandbox-2.6-hardened-pch.patch | 88 ---------
sys-apps/sandbox/files/sandbox-2.6-log-var.patch | 51 ------
.../sandbox/files/sandbox-2.6-open-nofollow.patch | 54 ------
.../files/sandbox-2.6-static-close-fd.patch | 93 ----------
.../sandbox/files/sandbox-2.6-trace-hppa.patch | 27 ---
sys-apps/sandbox/sandbox-2.6-r1.ebuild | 132 --------------
10 files changed, 687 deletions(-)
diff --git a/sys-apps/sandbox/Manifest b/sys-apps/sandbox/Manifest
deleted file mode 100644
index 33c0d48..0000000
--- a/sys-apps/sandbox/Manifest
+++ /dev/null
@@ -1,10 +0,0 @@
-AUX 09sandbox 37 SHA256 73e9e9d12ba54f1c649813ec86107924050528852c890a8ba1e2853796781bbe SHA512 4e8a9c58debde6480224a45559c5f2db4765213d151e47937f9142f110cac3681bf6402acaf21249a37bb17398e7bc00ae7feee68ecdb5b9363c432eac1b052a WHIRLPOOL 80d55a34d3faf3314f2b9de2200d4b46a800128514be9e30eb59e5f03fb7a0a5197a9e5b5ab33d6b68d35bf83c86a1bd7ba734a33ccd382fe0af3b2c2a11d0bd
-AUX sandbox-2.6-check-empty-paths-at.patch 7454 SHA256 a48759a4d3e9a70713473b6fad59bdd750b5cd37e7d632c786205ff20004ae2c SHA512 5eba7915dedf57f44c37881e9c6b48db8733d1493779a33127d08bb9ea77056d788ec9ace72c13eb101f42f01c95309c7cebca6c76212a8c99a8655372c0b7d7 WHIRLPOOL 46eb3a8ef8f22030cd793f3b16adc190b5750019c0df83e161c6918f08555a8ad890c1425b03cbf7e53ebcd34a07a9dd9b594d0c0fe31834656ffce3d58fa284
-AUX sandbox-2.6-desktop.patch 875 SHA256 2eecf67790aeac210f9aa899a86f7664776ed65d9b55159e1b359162dfb9ff74 SHA512 b72ec7f414d19bf513dfb1aea10523fa5dc07a1375d8f08f664d204b64b23c891a79ca14987528c595936f441e1f595b366aabbc57313667c7639d73d089ed9a WHIRLPOOL 7f787b8be9b5712eb2b2a0cd2ff825df1045ebf1cc4e73a50f610e620d30752045690a5c28835465d0ab0c3c4a9eaf8b92a5c123cd741ad69dfedb31aa457fa0
-AUX sandbox-2.6-hardened-pch.patch 2615 SHA256 b24500876b595dcaee46e23dffedc50729ce7af1c7fbfce9cead2cd7a8566ff3 SHA512 439f78d0261996a648053f3b34a9fa34eb0d145862136769a3d448f5314be76046d02a0bcce8fd9cfb59d82fdafe79653c182d104f98c4b51be2c08ce835c8bd WHIRLPOOL 8221650ad746161af71a1b1f5f041a5696b4168d2c1fd3fb1997ba0464ef14de50592d9dd4ecc6981f812ae50e4d2c18c138a40bcdcce1b7f6d5b84f711211a6
-AUX sandbox-2.6-log-var.patch 2039 SHA256 f464a29cdd9de0c510277310f4febc8f96515ff2ff03fc92df1c75b9cbd75619 SHA512 cf6f900b4078eff5870b63b2bc7c81c5b00488e030d7e9ce3007693e9d1339ac6201ddacfaff552c6c9b99b6d32383229133c80190404b7e4fde06ad376b2050 WHIRLPOOL db99737a6567788194f7b37b12b92fcfb4c263df40f40aef9e0a3ef2b6a1523331313b791fffa2b26775b646795364ab1db1711eb4329cda3337df27aebfeffa
-AUX sandbox-2.6-open-nofollow.patch 2027 SHA256 c8816ae4e1991f9941abd43ec4bfdbf4e99cf36ee90694f77ab88754c53785ce SHA512 dd5222f32a40def38c9719363a24c48d5b112e3560b44c5f32afc3daa0614fe9bc5cb68ca8ac69032cc8d6299f09b25d4d7c72e16892188b42768ffb28c19f07 WHIRLPOOL 03cb5fb9df04a8d7f92855c292a6c431d01d330fecae198f2c4b95d824454f10ce1ad66db1a9d54d1bef5f74989cf6debb2d98de28ee0c2c6a09c1a0752b5519
-AUX sandbox-2.6-static-close-fd.patch 2945 SHA256 807eb4dc1ba6543c94a90a9a53bb89f42079ea20ed7c196f82d65f280e5de96a SHA512 e2f57c4d80816241f3ba4828c2b27c67d1d604b14b2d575888a978e5c4e8e47e60e3a609d81e59c615bc5b7cee6194cc362e255ae8508f632862a35180c30de8 WHIRLPOOL e08f60227fe954894d3a3a01297e9988f4d7722ea75ffbd2b0f3971d38c8ce00af230fcaecb1f53243a868d54f48bb680e2d547bbeb2ee3e5a11f8942d2084fd
-AUX sandbox-2.6-trace-hppa.patch 850 SHA256 20688b2f33162f95af4af5e3c7d3700f2e7776e454b785ac1398f0870f84efa9 SHA512 fb7bf2202f960e952edc1e52fe4b6b085042158223d96b9baa899e871abcdef711ede3122c971120f55f71cc1aad71496a6079222dbaaa6c14b0c6f7ea182454 WHIRLPOOL 80f7fb529b912d19d81b9d71ee4a648db7b217583f2e8f2054cc666839030ea7d0112d69d52a2bf35c4d3549ffbd81dbd0cd39d5993bfabbb43bcb6a4455ade4
-DIST sandbox-2.6.tar.xz 366356 SHA256 95615c5879dfc419713f22ba5506a2802a50ea0ce8a2f57c656354f2e50b1c4d SHA512 32ba7fb675c67fdc8bc52da1db7ed6878e5fea8753accb30d9aca00f708e0dde03287b5962caf5ef031bea6934d6ef3e18404b015c70ebd551d3fd8109ad2371 WHIRLPOOL bab2d015fb0de92a2266408ca7941c8fb66b599179040cfc727ffce5b2424a9722dc55ba89d198e3361044d8cb357314205488d2a980c7b8af063fd8940f0c03
-EBUILD sandbox-2.6-r1.ebuild 3161 SHA256 964556ee3f429cedbd54d4ea9c8c9a468b886199f390b909864e5c35a454bfa4 SHA512 25492535b1a623482c3bec466a3cfc8277ef5f82e3548085dc35a0ac24c5ab5cbedd32ad99c9da07dccd9c116b1c5a532908c5a3023aea6cdfb4dd94ec380c04 WHIRLPOOL 6fb8b8d1426bc8f6e0496bf6afe693bf544fdabacbdefdb310261e0d5dc0ba7548c26a8d26d4c29e8885805ebccc5e9852c3a2573cd6815960aa8f9ee2d21973
diff --git a/sys-apps/sandbox/files/09sandbox b/sys-apps/sandbox/files/09sandbox
deleted file mode 100644
index 9181eb0..0000000
--- a/sys-apps/sandbox/files/09sandbox
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_PROTECT_MASK="/etc/sandbox.d"
diff --git a/sys-apps/sandbox/files/sandbox-2.6-check-empty-paths-at.patch b/sys-apps/sandbox/files/sandbox-2.6-check-empty-paths-at.patch
deleted file mode 100644
index e4dc529..0000000
--- a/sys-apps/sandbox/files/sandbox-2.6-check-empty-paths-at.patch
+++ /dev/null
@@ -1,201 +0,0 @@
-From dd726dcc6a95355d0e0cc949018d9c8aefc89a02 Mon Sep 17 00:00:00 2001
-From: Mike Frysinger <vapier@gentoo.org>
-Date: Mon, 24 Dec 2012 19:41:49 -0500
-Subject: [PATCH 1/2] libsandbox: reject "" paths with *at funcs before
- checking the dirfd
-
-When it comes to processing errors, an empty path is checked before
-an invalid dirfd. Make sure sandbox matches that behavior for the
-random testsuites out there that look for this.
-
-URL: https://bugs.gentoo.org/346929
-Reported-by: Marien Zwart <marienz@gentoo.org>
-Signed-off-by: Mike Frysinger <vapier@gentoo.org>
----
- libsandbox/wrapper-funcs/__pre_check.c | 2 ++
- libsandbox/wrapper-funcs/mkdirat_pre_check.c | 17 +++++------------
- libsandbox/wrapper-funcs/openat_pre_check.c | 15 ++++-----------
- libsandbox/wrapper-funcs/unlinkat_pre_check.c | 17 +++++------------
- libsandbox/wrappers.h | 2 ++
- tests/mkdirat-3.sh | 7 +++++++
- tests/mkdirat.at | 1 +
- tests/openat-2.sh | 9 +++++++++
- tests/openat.at | 1 +
- tests/unlinkat-4.sh | 7 +++++++
- tests/unlinkat.at | 1 +
- 11 files changed, 44 insertions(+), 35 deletions(-)
- create mode 100755 tests/mkdirat-3.sh
- create mode 100755 tests/openat-2.sh
- create mode 100755 tests/unlinkat-4.sh
-
-diff --git a/libsandbox/wrapper-funcs/__pre_check.c b/libsandbox/wrapper-funcs/__pre_check.c
-index 2d5711f..28ad91f 100644
---- a/libsandbox/wrapper-funcs/__pre_check.c
-+++ b/libsandbox/wrapper-funcs/__pre_check.c
-@@ -20,3 +20,5 @@
- #if SB_NR_UNLINK != SB_NR_UNDEF && SB_NR_UNLINKAT == SB_NR_UNDEF
- # include "unlinkat_pre_check.c"
- #endif
-+
-+#include "__pre_at_check.c"
-diff --git a/libsandbox/wrapper-funcs/mkdirat_pre_check.c b/libsandbox/wrapper-funcs/mkdirat_pre_check.c
-index 77a65df..0b48d1f 100644
---- a/libsandbox/wrapper-funcs/mkdirat_pre_check.c
-+++ b/libsandbox/wrapper-funcs/mkdirat_pre_check.c
-@@ -1,20 +1,13 @@
- bool sb_mkdirat_pre_check(const char *func, const char *pathname, int dirfd)
- {
- char canonic[SB_PATH_MAX];
-- char dirfd_path[SB_PATH_MAX];
-
- save_errno();
-
-- /* Expand the dirfd path first */
-- switch (resolve_dirfd_path(dirfd, pathname, dirfd_path, sizeof(dirfd_path))) {
-- case -1:
-- sb_debug_dyn("EARLY FAIL: %s(%s) @ resolve_dirfd_path: %s\n",
-- func, pathname, strerror(errno));
-- return false;
-- case 0:
-- pathname = dirfd_path;
-- break;
-- }
-+ /* Check incoming args against common *at issues */
-+ char dirfd_path[SB_PATH_MAX];
-+ if (!sb_common_at_pre_check(func, &pathname, dirfd, dirfd_path, sizeof(dirfd_path)))
-+ return false;
-
- /* Then break down any relative/symlink paths */
- if (-1 == canonicalize(pathname, canonic))
-diff --git a/libsandbox/wrapper-funcs/openat_pre_check.c b/libsandbox/wrapper-funcs/openat_pre_check.c
-index 0127708..5fd5eaa 100644
---- a/libsandbox/wrapper-funcs/openat_pre_check.c
-+++ b/libsandbox/wrapper-funcs/openat_pre_check.c
-@@ -15,17 +15,10 @@ bool sb_openat_pre_check(const char *func, const char *pathname, int dirfd, int
-
- save_errno();
-
-- /* Expand the dirfd path first */
-+ /* Check incoming args against common *at issues */
- char dirfd_path[SB_PATH_MAX];
-- switch (resolve_dirfd_path(dirfd, pathname, dirfd_path, sizeof(dirfd_path))) {
-- case -1:
-- sb_debug_dyn("EARLY FAIL: %s(%s) @ resolve_dirfd_path: %s\n",
-- func, pathname, strerror(errno));
-- return false;
-- case 0:
-- pathname = dirfd_path;
-- break;
-- }
-+ if (!sb_common_at_pre_check(func, &pathname, dirfd, dirfd_path, sizeof(dirfd_path)))
-+ return false;
-
- /* Doesn't exist -> skip permission checks */
- struct stat st;
-diff --git a/libsandbox/wrapper-funcs/unlinkat_pre_check.c b/libsandbox/wrapper-funcs/unlinkat_pre_check.c
-index 9f5e7d7..c004d15 100644
---- a/libsandbox/wrapper-funcs/unlinkat_pre_check.c
-+++ b/libsandbox/wrapper-funcs/unlinkat_pre_check.c
-@@ -1,20 +1,13 @@
- bool sb_unlinkat_pre_check(const char *func, const char *pathname, int dirfd)
- {
- char canonic[SB_PATH_MAX];
-- char dirfd_path[SB_PATH_MAX];
-
- save_errno();
-
-- /* Expand the dirfd path first */
-- switch (resolve_dirfd_path(dirfd, pathname, dirfd_path, sizeof(dirfd_path))) {
-- case -1:
-- sb_debug_dyn("EARLY FAIL: %s(%s) @ resolve_dirfd_path: %s\n",
-- func, pathname, strerror(errno));
-- return false;
-- case 0:
-- pathname = dirfd_path;
-- break;
-- }
-+ /* Check incoming args against common *at issues */
-+ char dirfd_path[SB_PATH_MAX];
-+ if (!sb_common_at_pre_check(func, &pathname, dirfd, dirfd_path, sizeof(dirfd_path)))
-+ return false;
-
- /* Then break down any relative/symlink paths */
- if (-1 == canonicalize(pathname, canonic))
-diff --git a/libsandbox/wrappers.h b/libsandbox/wrappers.h
-index 5b97787..0aa58bb 100644
---- a/libsandbox/wrappers.h
-+++ b/libsandbox/wrappers.h
-@@ -28,5 +28,7 @@ attribute_hidden bool sb_mkdirat_pre_check (const char *func, const char *pathn
- attribute_hidden bool sb_openat_pre_check (const char *func, const char *pathname, int dirfd, int flags);
- attribute_hidden bool sb_openat64_pre_check (const char *func, const char *pathname, int dirfd, int flags);
- attribute_hidden bool sb_unlinkat_pre_check (const char *func, const char *pathname, int dirfd);
-+attribute_hidden bool sb_common_at_pre_check(const char *func, const char **pathname, int dirfd,
-+ char *dirfd_path, size_t dirfd_path_len);
-
- #endif
---
-1.8.1.2
-
-From 0b8a6d9773cc0e6d86bf1187f46817d5716698fe Mon Sep 17 00:00:00 2001
-From: Mike Frysinger <vapier@gentoo.org>
-Date: Mon, 24 Dec 2012 19:41:49 -0500
-Subject: [PATCH 2/2] libsandbox: reject "" paths with *at funcs before
- checking the dirfd [missing file]
-
-When it comes to processing errors, an empty path is checked before
-an invalid dirfd. Make sure sandbox matches that behavior for the
-random testsuites out there that look for this.
-
-Forgot to `git add` in the previous commit :/.
-
-URL: https://bugs.gentoo.org/346929
-Reported-by: Marien Zwart <marienz@gentoo.org>
-Signed-off-by: Mike Frysinger <vapier@gentoo.org>
----
- libsandbox/wrapper-funcs/__pre_at_check.c | 34 +++++++++++++++++++++++++++++++
- 1 file changed, 34 insertions(+)
- create mode 100644 libsandbox/wrapper-funcs/__pre_at_check.c
-
-diff --git a/libsandbox/wrapper-funcs/__pre_at_check.c b/libsandbox/wrapper-funcs/__pre_at_check.c
-new file mode 100644
-index 0000000..f72c40c
---- /dev/null
-+++ b/libsandbox/wrapper-funcs/__pre_at_check.c
-@@ -0,0 +1,34 @@
-+/*
-+ * common *at() pre-checks.
-+ *
-+ * Copyright 1999-2012 Gentoo Foundation
-+ * Licensed under the GPL-2
-+ */
-+
-+/* We assume the parent has nested use with save/restore errno */
-+bool sb_common_at_pre_check(const char *func, const char **pathname, int dirfd,
-+ char *dirfd_path, size_t dirfd_path_len)
-+{
-+ /* the empty path name should fail with ENOENT before any dirfd
-+ * checks get a chance to run #346929
-+ */
-+ if (*pathname && *pathname[0] == '\0') {
-+ errno = ENOENT;
-+ sb_debug_dyn("EARLY FAIL: %s(%s): %s\n",
-+ func, *pathname, strerror(errno));
-+ return false;
-+ }
-+
-+ /* Expand the dirfd path first */
-+ switch (resolve_dirfd_path(dirfd, *pathname, dirfd_path, dirfd_path_len)) {
-+ case -1:
-+ sb_debug_dyn("EARLY FAIL: %s(%s) @ resolve_dirfd_path: %s\n",
-+ func, *pathname, strerror(errno));
-+ return false;
-+ case 0:
-+ *pathname = dirfd_path;
-+ break;
-+ }
-+
-+ return true;
-+}
---
-1.8.1.2
-
diff --git a/sys-apps/sandbox/files/sandbox-2.6-desktop.patch b/sys-apps/sandbox/files/sandbox-2.6-desktop.patch
deleted file mode 100644
index fbecb07..0000000
--- a/sys-apps/sandbox/files/sandbox-2.6-desktop.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 00044ab0c8aaaabf048b5ff0ec2da5b3d7d25752 Mon Sep 17 00:00:00 2001
-From: Mike Frysinger <vapier@gentoo.org>
-Date: Sat, 17 Nov 2012 14:14:26 -0500
-Subject: [PATCH] sandbox.desktop: drop .svg from Icon field
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-URL: http://bugs.gentoo.org/443672
-Reported-by: Petteri Räty <betelgeuse@gentoo.org>
-Signed-off-by: Mike Frysinger <vapier@gentoo.org>
----
- data/sandbox.desktop | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/data/sandbox.desktop b/data/sandbox.desktop
-index 5b5b576..27a887e 100644
---- a/data/sandbox.desktop
-+++ b/data/sandbox.desktop
-@@ -5,6 +5,6 @@ Type=Application
- Comment=launch a sandboxed shell ... useful for debugging ebuilds
- Exec=sandbox
- TryExec=sandbox
--Icon=sandbox.svg
-+Icon=sandbox
- Categories=Development;
- Terminal=true
---
-1.8.1.2
-
diff --git a/sys-apps/sandbox/files/sandbox-2.6-hardened-pch.patch b/sys-apps/sandbox/files/sandbox-2.6-hardened-pch.patch
deleted file mode 100644
index 611122a..0000000
--- a/sys-apps/sandbox/files/sandbox-2.6-hardened-pch.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-From: Mike Frysinger <vapier@gentoo.org>
-Date: Tue, 28 Aug 2012 16:19:56 +0000 (-0400)
-Subject: add a configure option to control pch usage
-X-Git-Url: http://git.overlays.gentoo.org/gitweb/?p=proj%2Fsandbox.git;a=commitdiff_plain;h=f2500f5954611d110ac18e9990f42d5a915f8101
-
-add a configure option to control pch usage
-
-Mostly for testing purposes. This also tweaks the dependency to fix a
-warning when generating the headers.h.pch in subdirs when the toplevel
-headers.h.pch already exists.
-
-URL: http://bugs.gentoo.org/425524
-Signed-off-by: Mike Frysinger <vapier@gentoo.org>
----
-
-diff --git a/Makefile.am b/Makefile.am
-index 475c8c0..eb54f42 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -11,9 +11,9 @@ SUBDIRS = \
- src \
- tests
-
-+noinst_LTLIBRARIES =
-+
- SANDBOX_PCH = headers.h.gch libsandbox/headers.h.gch libsbutil/headers.h.gch
--BUILT_SOURCES = $(SANDBOX_PCH)
--noinst_LTLIBRARIES = libpch.la
- nodist_libpch_la_SOURCES = $(SANDBOX_PCH)
- GCH_CP = ( \
- src=`dirname $@`/.libs/`basename $@`.o; \
-@@ -30,10 +30,23 @@ $(builddir)/libsandbox/headers.h.gch: headers.h
- $(builddir)/headers.h.gch: headers.h
- $(AM_V_GEN)$(COMPILE) -c -o $@.o $< && $(GCH_CP)
-
--libsbutil: libsbutil/headers.h.gch
--libsandbox: libsbutil libsandbox/headers.h.gch
--src: libsbutil headers.h.gch
--tests: src headers.h.gch
-+if SB_BUILD_PCH
-+BUILT_SOURCES = $(SANDBOX_PCH)
-+noinst_LTLIBRARIES += libpch.la
-+
-+LIBSBUTIL_PCH = libsbutil/headers.h.gch
-+LIBSANDBOX_PCH = libsandbox/headers.h.gch
-+TOP_PCH = headers.h.gch
-+
-+# Make sure we build the subdirs before the top so they don't
-+# try to use the top level headers.h.pch.
-+$(TOP_PCH): $(LIBSBUTIL_PCH) $(LIBSANDBOX_PCH)
-+endif
-+
-+libsbutil: $(LIBSBUTIL_PCH)
-+libsandbox: libsbutil $(LIBSANDBOX_PCH)
-+src: libsbutil $(TOP_PCH)
-+tests: src $(TOP_PCH)
-
- EXTRA_DIST = headers.h localdecls.h ChangeLog.0
-
-diff --git a/configure.ac b/configure.ac
-index 661b494..ca0d3ac 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -26,7 +26,7 @@ AC_ISC_POSIX
- AC_USE_SYSTEM_EXTENSIONS
-
- dnl Checks for programs.
--AM_PROG_AR
-+#AM_PROG_AR
- AC_PROG_INSTALL
- AC_PROG_MAKE_SET
- AC_PROG_AWK
-@@ -38,6 +38,14 @@ LT_INIT([disable-static])
-
- AC_PREFIX_DEFAULT([/usr])
-
-+dnl allow pch to be controlled
-+AC_MSG_CHECKING([whether to use pre-compiled sandbox headers])
-+AC_ARG_ENABLE([pch],
-+ [AS_HELP_STRING([--disable-pch],[Disable pre-compiled headers])],
-+ [],[enable_pch="yes"])
-+AM_CONDITIONAL([SB_BUILD_PCH], test "$enable_pch" = "yes")
-+AC_MSG_RESULT($enable_pch)
-+
- dnl multiple personality support (x86 & x86_64: multilib)
- AC_MSG_CHECKING([for multiple personalities])
- AC_ARG_ENABLE([schizo],
-
diff --git a/sys-apps/sandbox/files/sandbox-2.6-log-var.patch b/sys-apps/sandbox/files/sandbox-2.6-log-var.patch
deleted file mode 100644
index bfea9e5..0000000
--- a/sys-apps/sandbox/files/sandbox-2.6-log-var.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 853b42c86432eefc6d4cfba86197fb37d446366d Mon Sep 17 00:00:00 2001
-From: Mike Frysinger <vapier@gentoo.org>
-Date: Sun, 3 Mar 2013 05:34:09 -0500
-Subject: [PATCH] sandbox: accept SANDBOX_LOG vars whatever their values
-
-Commit 40abb498ca4a24495fe34e133379382ce8c3eaca subtly broke the sandbox
-with portage. It changed how the sandbox log env var was accessed by
-moving from getenv() to get_sandbox_log(). The latter has path checking
-and will kick out values that contain a slash. That means every time a
-new process starts, a new sandbox log path will be generated, and when a
-program triggers a violation, it'll write to the new file. Meanwhile,
-portage itself watches the original one which never gets updated.
-
-This code has been around forever w/out documentation, and I can't think
-of a reason we need it. So punt it.
-
-Signed-off-by: Mike Frysinger <vapier@gentoo.org>
----
- libsbutil/get_sandbox_log.c | 14 +++++---------
- 1 file changed, 5 insertions(+), 9 deletions(-)
-
-diff --git a/libsbutil/get_sandbox_log.c b/libsbutil/get_sandbox_log.c
-index a79b399..bdb4278 100644
---- a/libsbutil/get_sandbox_log.c
-+++ b/libsbutil/get_sandbox_log.c
-@@ -21,17 +21,13 @@ static void _get_sb_log(char *path, const char *tmpdir, const char *env, const c
-
- sandbox_log_env = getenv(env);
-
-- if (sandbox_log_env && is_env_on(ENV_SANDBOX_TESTING)) {
-- /* When testing, just use what the env says to */
-+ if (sandbox_log_env) {
-+ /* If the env is viable, roll with it. We aren't really
-+ * about people breaking the security of the sandbox by
-+ * exporting SANDBOX_LOG=/dev/null.
-+ */
- strncpy(path, sandbox_log_env, SB_PATH_MAX);
- } else {
-- /* THIS CHUNK BREAK THINGS BY DOING THIS:
-- * SANDBOX_LOG=/tmp/sandbox-app-admin/superadduser-1.0.7-11063.log
-- */
-- if ((NULL != sandbox_log_env) &&
-- (NULL != strchr(sandbox_log_env, '/')))
-- sandbox_log_env = NULL;
--
- snprintf(path, SB_PATH_MAX, "%s%s%s%s%d%s",
- SANDBOX_LOG_LOCATION, prefix,
- (sandbox_log_env == NULL ? "" : sandbox_log_env),
---
-1.8.1.2
-
diff --git a/sys-apps/sandbox/files/sandbox-2.6-open-nofollow.patch b/sys-apps/sandbox/files/sandbox-2.6-open-nofollow.patch
deleted file mode 100644
index 0101ece..0000000
--- a/sys-apps/sandbox/files/sandbox-2.6-open-nofollow.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From 45fa8714a1d35e6555083d88a71851ada2aacac4 Mon Sep 17 00:00:00 2001
-From: Mike Frysinger <vapier@gentoo.org>
-Date: Mon, 24 Dec 2012 18:46:29 -0500
-Subject: [PATCH] libsandbox: handle open(O_NOFOLLOW)
-
-We don't check for O_NOFOLLOW in the open wrappers, so we end up
-returning the wrong error when operating on broken symlinks.
-
-URL: https://bugs.gentoo.org/413441
-Reported-by: Marien Zwart <marienz@gentoo.org>
-Signed-off-by: Mike Frysinger <vapier@gentoo.org>
----
- libsandbox/wrapper-funcs/__64_post.h | 1 +
- libsandbox/wrapper-funcs/__64_pre.h | 1 +
- libsandbox/wrapper-funcs/openat_pre_check.c | 2 +-
- tests/open-2.sh | 10 ++++++++++
- tests/open.at | 1 +
- 5 files changed, 14 insertions(+), 1 deletion(-)
- create mode 100755 tests/open-2.sh
-
-diff --git a/libsandbox/wrapper-funcs/__64_post.h b/libsandbox/wrapper-funcs/__64_post.h
-index 2fd2182..82d2a16 100644
---- a/libsandbox/wrapper-funcs/__64_post.h
-+++ b/libsandbox/wrapper-funcs/__64_post.h
-@@ -1,3 +1,4 @@
- #undef SB64
- #undef stat
-+#undef lstat
- #undef off_t
-diff --git a/libsandbox/wrapper-funcs/__64_pre.h b/libsandbox/wrapper-funcs/__64_pre.h
-index 2132110..0b34b25 100644
---- a/libsandbox/wrapper-funcs/__64_pre.h
-+++ b/libsandbox/wrapper-funcs/__64_pre.h
-@@ -1,3 +1,4 @@
- #define SB64
- #define stat stat64
-+#define lstat lstat64
- #define off_t off64_t
-diff --git a/libsandbox/wrapper-funcs/openat_pre_check.c b/libsandbox/wrapper-funcs/openat_pre_check.c
-index c827ee6..0127708 100644
---- a/libsandbox/wrapper-funcs/openat_pre_check.c
-+++ b/libsandbox/wrapper-funcs/openat_pre_check.c
-@@ -29,7 +29,7 @@ bool sb_openat_pre_check(const char *func, const char *pathname, int dirfd, int
-
- /* Doesn't exist -> skip permission checks */
- struct stat st;
-- if (-1 == stat(pathname, &st)) {
-+ if (((flags & O_NOFOLLOW) ? lstat(pathname, &st) : stat(pathname, &st)) == -1) {
- sb_debug_dyn("EARLY FAIL: %s(%s): %s\n",
- func, pathname, strerror(errno));
- return false;
---
-1.8.1.2
-
diff --git a/sys-apps/sandbox/files/sandbox-2.6-static-close-fd.patch b/sys-apps/sandbox/files/sandbox-2.6-static-close-fd.patch
deleted file mode 100644
index 7fc0972..0000000
--- a/sys-apps/sandbox/files/sandbox-2.6-static-close-fd.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-From a3ff1534945c3898332b2481c9fd355dfbd56e1f Mon Sep 17 00:00:00 2001
-From: Mike Frysinger <vapier@gentoo.org>
-Date: Sat, 23 Jun 2012 11:52:51 -0700
-Subject: [PATCH] libsandbox: clean up open file handles in parent tracing
- process
-
-Currently, if a non-static app sets up a pipe (with cloexec enabled) and
-executes a static app, the handle to that pipe is left open in the parent
-process. This causes trouble when the parent is waiting for that to be
-closed immediately.
-
-Since none of the fds in the forked parent process matter to us, we can
-just go ahead and clean up all fds before we start tracing the child.
-
-URL: http://bugs.gentoo.org/364877
-Reported-by: Victor Stinner <victor.stinner@haypocalc.com>
-Signed-off-by: Mike Frysinger <vapier@gentoo.org>
----
- libsandbox/trace.c | 3 +-
- libsbutil/sb_close.c | 26 +++++++++++-
- libsbutil/sbutil.h | 1 +
- tests/Makefile.am | 2 +
- tests/pipe-fork_static_tst.c | 18 +++++++++
- tests/pipe-fork_tst.c | 95 ++++++++++++++++++++++++++++++++++++++++++++
- tests/script-9.sh | 5 +++
- tests/script.at | 1 +
- 8 files changed, 149 insertions(+), 2 deletions(-)
- create mode 100644 tests/pipe-fork_static_tst.c
- create mode 100644 tests/pipe-fork_tst.c
- create mode 100755 tests/script-9.sh
-
-diff --git a/libsandbox/trace.c b/libsandbox/trace.c
-index 32ad2d6..dfbab18 100644
---- a/libsandbox/trace.c
-+++ b/libsandbox/trace.c
-@@ -504,8 +504,9 @@ void trace_main(const char *filename, char *const argv[])
- /* Not all kernel versions support this, so ignore return */
- ptrace(PTRACE_SETOPTIONS, trace_pid, NULL, (void *)PTRACE_O_TRACESYSGOOD);
- #endif
-+ sb_close_all_fds();
- trace_loop();
-- return;
-+ sb_ebort("ISE: child should have quit, as should we\n");
- }
-
- sb_debug("child setting up ...");
-diff --git a/libsbutil/sb_close.c b/libsbutil/sb_close.c
-index 17a4560..5379197 100644
---- a/libsbutil/sb_close.c
-+++ b/libsbutil/sb_close.c
-@@ -29,3 +29,27 @@ int sb_close(int fd)
-
- return res;
- }
-+
-+/* Quickly close all the open fds (good for daemonization) */
-+void sb_close_all_fds(void)
-+{
-+ DIR *dirp;
-+ struct dirent *de;
-+ int dfd, fd;
-+ const char *fd_dir = sb_get_fd_dir();
-+
-+ dirp = opendir(fd_dir);
-+ if (!dirp)
-+ sb_ebort("could not process %s\n", fd_dir);
-+ dfd = dirfd(dirp);
-+
-+ while ((de = readdir(dirp)) != NULL) {
-+ if (de->d_name[0] == '.')
-+ continue;
-+ fd = atoi(de->d_name);
-+ if (fd != dfd)
-+ close(fd);
-+ }
-+
-+ closedir(dirp);
-+}
-diff --git a/libsbutil/sbutil.h b/libsbutil/sbutil.h
-index 02b88cb..479734b 100644
---- a/libsbutil/sbutil.h
-+++ b/libsbutil/sbutil.h
-@@ -97,6 +97,7 @@ int sb_open(const char *path, int flags, mode_t mode);
- size_t sb_read(int fd, void *buf, size_t count);
- size_t sb_write(int fd, const void *buf, size_t count);
- int sb_close(int fd);
-+void sb_close_all_fds(void);
- int sb_copy_file_to_fd(const char *file, int ofd);
-
- /* Reliable output */
---
-1.8.1.2
-
diff --git a/sys-apps/sandbox/files/sandbox-2.6-trace-hppa.patch b/sys-apps/sandbox/files/sandbox-2.6-trace-hppa.patch
deleted file mode 100644
index 7e73822..0000000
--- a/sys-apps/sandbox/files/sandbox-2.6-trace-hppa.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 7b01f6103a9baddaf0252e7f850a4cef91a48b67 Mon Sep 17 00:00:00 2001
-From: Mike Frysinger <vapier@gentoo.org>
-Date: Fri, 6 Jul 2012 14:58:16 -0400
-Subject: [PATCH] libsandbox: fix hppa trace code
-
-URL: https://bugs.gentoo.org/425062
-Reported-by: Jeroen Roovers <jer@gentoo.org>
-Signed-off-by: Mike Frysinger <vapier@gentoo.org>
----
- libsandbox/trace/linux/hppa.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/libsandbox/trace/linux/hppa.c b/libsandbox/trace/linux/hppa.c
-index d23b0d1..5414354 100644
---- a/libsandbox/trace/linux/hppa.c
-+++ b/libsandbox/trace/linux/hppa.c
-@@ -1,5 +1,5 @@
--#define trace_reg_sysnum (20 * 4) /* PT_GR20 */
--#define trace_reg_ret (28 * 4) /* PT_GR28 */
-+#define trace_reg_sysnum gr[20]
-+#define trace_reg_ret gr[28]
-
- static unsigned long trace_arg(void *vregs, int num)
- {
---
-1.7.9.7
-
diff --git a/sys-apps/sandbox/sandbox-2.6-r1.ebuild b/sys-apps/sandbox/sandbox-2.6-r1.ebuild
deleted file mode 100644
index 25130d2..0000000
--- a/sys-apps/sandbox/sandbox-2.6-r1.ebuild
+++ /dev/null
@@ -1,132 +0,0 @@
-# Copyright 1999-2013 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-apps/sandbox/sandbox-2.6-r1.ebuild,v 1.12 2013/07/02 07:43:42 ago Exp $
-
-#
-# don't monkey with this ebuild unless contacting portage devs.
-# period.
-#
-
-inherit autotools eutils flag-o-matic toolchain-funcs multilib unpacker multiprocessing
-
-DESCRIPTION="sandbox'd LD_PRELOAD hack"
-HOMEPAGE="http://www.gentoo.org/"
-SRC_URI="mirror://gentoo/${P}.tar.xz
- http://dev.gentoo.org/~vapier/dist/${P}.tar.xz"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="alpha amd64 arm hppa ia64 ~m68k ~mips ppc ppc64 s390 sh sparc x86 ~sparc-fbsd -x86-fbsd"
-IUSE="multilib pch"
-
-DEPEND="app-arch/xz-utils
- >=app-misc/pax-utils-0.1.19" #265376
-RDEPEND=""
-
-EMULTILIB_PKG="true"
-has sandbox_death_notice ${EBUILD_DEATH_HOOKS} || EBUILD_DEATH_HOOKS="${EBUILD_DEATH_HOOKS} sandbox_death_notice"
-
-sandbox_death_notice() {
- ewarn "If configure failed with a 'cannot run C compiled programs' error, try this:"
- ewarn "FEATURES=-sandbox emerge sandbox"
-}
-
-sb_get_install_abis() { use multilib && get_install_abis || echo ${ABI:-default} ; }
-
-sb_foreach_abi() {
- local OABI=${ABI}
- for ABI in $(sb_get_install_abis) ; do
- cd "${WORKDIR}/build-${ABI}"
- einfo "Running $1 for ABI=${ABI}..."
- "$@"
- done
- ABI=${OABI}
-}
-
-src_unpack() {
- unpacker
- cd "${S}"
- epatch "${FILESDIR}"/${P}-trace-hppa.patch #425062
- epatch "${FILESDIR}"/${P}-log-var.patch
- epatch "${FILESDIR}"/${P}-static-close-fd.patch #364877
- epatch "${FILESDIR}"/${P}-desktop.patch #443672
- epatch "${FILESDIR}"/${P}-open-nofollow.patch #413441
- epatch "${FILESDIR}"/${P}-check-empty-paths-at.patch #346929
- epatch "${FILESDIR}"/${P}-hardened-pch.patch #425524
- epatch_user
-
- eautoreconf
-}
-
-sb_configure() {
- mkdir "${WORKDIR}/build-${ABI}"
- cd "${WORKDIR}/build-${ABI}"
-
- use multilib && multilib_toolchain_setup ${ABI}
-
- einfo "Configuring sandbox for ABI=${ABI}..."
- ECONF_SOURCE="../${P}/" \
- econf $(use_enable pch) ${myconf} || die
-}
-
-sb_compile() {
- emake || die
-}
-
-src_compile() {
- filter-lfs-flags #90228
-
- # Run configures in parallel!
- multijob_init
- local OABI=${ABI}
- for ABI in $(sb_get_install_abis) ; do
- multijob_child_init sb_configure
- done
- ABI=${OABI}
- multijob_finish
-
- sb_foreach_abi sb_compile
-}
-
-sb_test() {
- emake check TESTSUITEFLAGS="--jobs=$(makeopts_jobs)" || die
-}
-
-src_test() {
- sb_foreach_abi sb_test
-}
-
-sb_install() {
- emake DESTDIR="${D}" install || die
- insinto /etc/sandbox.d #333131
- doins etc/sandbox.d/00default || die
-}
-
-src_install() {
- sb_foreach_abi sb_install
-
- doenvd "${FILESDIR}"/09sandbox
-
- keepdir /var/log/sandbox
- fowners root:portage /var/log/sandbox
- fperms 0770 /var/log/sandbox
-
- cd "${S}"
- dodoc AUTHORS ChangeLog* NEWS README
-}
-
-pkg_preinst() {
- chown root:portage "${D}"/var/log/sandbox
- chmod 0770 "${D}"/var/log/sandbox
-
- local old=$(find "${ROOT}"/lib* -maxdepth 1 -name 'libsandbox*')
- if [[ -n ${old} ]] ; then
- elog "Removing old sandbox libraries for you:"
- elog ${old//${ROOT}}
- find "${ROOT}"/lib* -maxdepth 1 -name 'libsandbox*' -exec rm -fv {} \;
- fi
-}
-
-pkg_postinst() {
- chmod 0755 "${ROOT}"/etc/sandbox.d #265376
-}
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-08-29 3:49 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-09-01 18:01 [gentoo-commits] dev/anarchy:master commit in: sys-apps/sandbox/files/, sys-apps/sandbox/ Jory Pratt
-- strict thread matches above, loose matches on Subject: below --
2015-08-29 3:49 Jory Pratt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox