From: Geert Bevin <gbevin@theleaf.be>
To: gentoo-dev@gentoo.org
Subject: [gentoo-dev] sandbox v0.2
Date: 10 Dec 2001 12:28:11 +0100 [thread overview]
Message-ID: <1007983691.967.0.camel@willow.theleaf.office> (raw)
[-- Attachment #1: Type: text/plain, Size: 2936 bytes --]
Hi all,
this is the next release of the sandbox. It now integrates seamlessly
into most ebuilds. The following features have been added :
* Added an ebuild to install the correct dynamic bash executable. It
supports safe unmerging, restoring the original static bash which is
otherwise accessible as /bin/sbash.
* Added env vars for customizing sandbox log labeling, number of beeps
after failure report, forcebly disabling of the sandbox before running
ebuild to make it possible to install a misbehaving package. The env
vars are SANDBOX_LOG, SANDBOX_BEEP and SANDBOX_DISABLED. SANDBOX_LOG is
automatically set to the full name of the package by portage.
* Bumped up to version 0.2. Added support for path prefix predictions.
This means that write is not allowed, but the request to do so is not
considered an error. The ebuild.sh now also contains support functions
which allows easy dynamic configuration of the sandbox inside an ebuild.
The added functions are : "addread, addwrite, adddeny, addprediction'.
Below is a short usage summary:
==============================
1. To have full sandbox protection, the dynbash-2.04.ebuild should be
merged.
2. When a package misbehaves and you don't feel like fixing it but still
want to install it, set the SANDBOX_DISABLED to something and remerge.
The previous error report will be in /tmp/sandbox-[package]-[pid].log.
Please submit this file to gentoo-dev@gentoo.org.
3. When you don't want to hear beeps when a package fails, add
SANDBOX_BEEP to /etc/make.conf and set it to 0. Setting it to another
positive number configures the number of beeps that will sound.
4. The default writable path prefixes are now :
"/dev/null:/dev/pts/:/dev/tty:/tmp/:/var/log/scrollkeeper.log: \
~/.gconfd/lock:~/.bash_history:[$PORTAGE_TMP]"
5. The default predicted path prefixes are :
"~/.:/usr/tmp/conftest:/usr/lib/conftest"
6. The above prefixes are now hardcoded into the sandbox executable but
should in time migrate to '/etc/make.globals'.
7. If your package needs other permissions you have three options :
a. try to figure out why it writes outside the image dir and fix
the makefile,
b. question yourself if it's a general path that should be
integrated into the default settings, if this is the case send
it together with your motivation to this mailinglist,
c. configure the sandbox with the new ebuild functions. Generally
you only need to use 'addwrite path' or 'addpredict path'. Note
that these change the sandbox for the current ebuild execution
and are thus not presistant across emerge stages
(download,compile, install).
That's it,
Have fun and don't hesitate to contact me when questions arise,
Geert
--
Geert Bevin
the Leaf sprl/bvba
"Use what you need" Pierre Theunisstraat 1/47
http://www.theleaf.be 1030 Brussels
gbevin@theleaf.be Tel & Fax +32 2 241 19 98
[-- Attachment #2: sandbox-0.2-ebuild.tar.bz2 --]
[-- Type: application/x-bzip, Size: 10186 bytes --]
reply other threads:[~2001-12-10 11:29 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1007983691.967.0.camel@willow.theleaf.office \
--to=gbevin@theleaf.be \
--cc=gentoo-dev@gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox