[gentoo-commits] proj/sandbox:master commit in: etc/

["Sergei Trofimovich" <slyfox@gentoo.org>]

commit:     001a95fb06aea725642397db09584a05c39246c9
Author:     Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
AuthorDate: Fri Oct 23 07:07:55 2020 +0000
Commit:     Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Thu Mar 11 08:02:21 2021 +0000
URL:        https://gitweb.gentoo.org/proj/sandbox.git/commit/?id=001a95fb

etc/sandbox.conf: allow /usr/tmp/ for write

In bug #737220 sandbox was denying write access to /usr/tmp
(a symlink to /var/tmp) for statically linked binaries.

It happens because erealpath() helper conservatively does not
resolve any symlink for external traced processes (to avoid
symlink confusion via /proc/ that could refer to tracer and not
tracee).

Instead of fixing erealpath() to handle more cases of symlinks
let's just allow /usr/tmp as if it was /var/tmp.

Reported-by: Kirill Chibisov
Bug: https://bugs.gentoo.org/737220
Signed-off-by: Sergei Trofimovich <slyfox <AT> gentoo.org>

 etc/sandbox.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/etc/sandbox.conf b/etc/sandbox.conf
index 5f09ee4..2501e11 100644
--- a/etc/sandbox.conf
+++ b/etc/sandbox.conf
@@ -86,7 +86,7 @@ SANDBOX_WRITE="/dev/console:/dev/tty:/dev/vc/:/dev/pty:/dev/tts"
 # Device filesystems
 SANDBOX_WRITE="/dev/ptmx:/dev/pts/:/dev/shm"
 # Tempory storage
-SANDBOX_WRITE="/tmp/:/var/tmp/"
+SANDBOX_WRITE="/tmp/:/var/tmp/:/usr/tmp/"
 # Needed for shells
 SANDBOX_WRITE="${HOME}/.bash_history"