public inbox for gentoo-dev@lists.gentoo.org
 help / color / mirror / Atom feed
From: Geert Bevin <gbevin@theleaf.be>
To: gentoo-dev@gentoo.org
Subject: [gentoo-dev] sandbox v0.2
Date: 10 Dec 2001 12:28:11 +0100	[thread overview]
Message-ID: <1007983691.967.0.camel@willow.theleaf.office> (raw)

[-- Attachment #1: Type: text/plain, Size: 2936 bytes --]

Hi all,

this is the next release of the sandbox. It now integrates seamlessly
into most ebuilds. The following features have been added :

* Added an ebuild to install the correct dynamic bash executable. It
supports safe unmerging, restoring the original static bash which is
otherwise accessible as /bin/sbash.

* Added env vars for customizing sandbox log labeling, number of beeps
after failure report, forcebly disabling of the sandbox before running
ebuild to make it possible to install a misbehaving package. The env
vars are SANDBOX_LOG, SANDBOX_BEEP and SANDBOX_DISABLED. SANDBOX_LOG is
automatically set to the full name of the package by portage.

* Bumped up to version 0.2. Added support for path prefix predictions.
This means that write is not allowed, but the request to do so is not
considered an error. The ebuild.sh now also contains support functions
which allows easy dynamic configuration of the sandbox inside an ebuild.
The added functions are : "addread, addwrite, adddeny, addprediction'.

Below is a short usage summary:
==============================

1. To have full sandbox protection, the dynbash-2.04.ebuild should be
merged.

2. When a package misbehaves and you don't feel like fixing it but still
want to install it, set the SANDBOX_DISABLED to something and remerge.
The previous error report will be in /tmp/sandbox-[package]-[pid].log.
Please submit this file to gentoo-dev@gentoo.org.

3. When you don't want to hear beeps when a package fails, add
SANDBOX_BEEP to /etc/make.conf and set it to 0. Setting it to another
positive number configures the number of beeps that will sound.

4. The default writable path prefixes are now :
"/dev/null:/dev/pts/:/dev/tty:/tmp/:/var/log/scrollkeeper.log: \
~/.gconfd/lock:~/.bash_history:[$PORTAGE_TMP]"

5. The default predicted path prefixes are : 
"~/.:/usr/tmp/conftest:/usr/lib/conftest"

6. The above prefixes are now hardcoded into the sandbox executable but
should in time migrate to '/etc/make.globals'.

7. If your package needs other permissions you have three options :

    a. try to figure out why it writes outside the image dir and fix 
       the makefile,

    b. question yourself if it's a general path that should be 
       integrated into the default settings, if this is the case send
       it together with your motivation to this mailinglist,

    c. configure the sandbox with the new ebuild functions. Generally 
       you only need to use 'addwrite path' or 'addpredict path'. Note 
       that these change the sandbox for the current ebuild execution 
       and are thus not presistant across emerge stages 
       (download,compile, install).


That's it,

Have fun and don't hesitate to contact me when questions arise,

Geert

-- 
Geert Bevin
the Leaf sprl/bvba
"Use what you need"           Pierre Theunisstraat 1/47
http://www.theleaf.be         1030 Brussels
gbevin@theleaf.be             Tel & Fax +32 2 241 19 98

[-- Attachment #2: sandbox-0.2-ebuild.tar.bz2 --]
[-- Type: application/x-bzip, Size: 10186 bytes --]

                 reply	other threads:[~2001-12-10 11:29 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1007983691.967.0.camel@willow.theleaf.office \
    --to=gbevin@theleaf.be \
    --cc=gentoo-dev@gentoo.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox