Menu
▾
▴
#160 add sandboxing support to fink
The attached patch uses a fink.sb file containing a list of directories to be black-listed in the Apple sandbox. This approach allows the end-user to customized this file if fink builds against /usr/local are desired.
diff -uNr fink-0.41.0/MANIFEST fink-0.41.0.sandbox/MANIFEST
--- fink-0.41.0/MANIFEST 2016-09-20 14:16:24.000000000 -0400
+++ fink-0.41.0.sandbox/MANIFEST 2016-11-03 13:35:33.000000000 -0400
@@ -24,6 +24,7 @@
fink.8.in
fink.conf.5.in
fink.csh
+fink.sb
fink.sh
images/finkDoneFailed.png
images/finkDonePassed.png
diff -uNr fink-0.41.0/fink.sb fink-0.41.0.sandbox/fink.sb
--- fink-0.41.0/fink.sb 1969-12-31 19:00:00.000000000 -0500
+++ fink-0.41.0.sandbox/fink.sb 2016-11-03 15:20:32.000000000 -0400
@@ -0,0 +1,2 @@
+/usr/local
+/opt/local
diff -uNr fink-0.41.0/install.sh fink-0.41.0.sandbox/install.sh
--- fink-0.41.0/install.sh 2016-09-20 14:16:24.000000000 -0400
+++ fink-0.41.0.sandbox/install.sh 2016-11-03 13:36:35.000000000 -0400
@@ -70,6 +70,7 @@
install -c -p -m 755 postinstall.pl "$basepath/lib/fink/"
install -c -p -m 644 shlibs.default "$basepath/etc/dpkg/"
+install -c -p -m 644 fink.sb "$basepath/etc/"
install -c -p -m 644 fink.8 "$basepath/share/man/man8/"
install -c -p -m 644 fink.conf.5 "$basepath/share/man/man5/"
install -c -p -m 644 images/*.png "$basepath/share/fink/images/"
diff -uNr fink-0.41.0/perlmod/Fink/Services.pm fink-0.41.0.sandbox/perlmod/Fink/Services.pm
--- fink-0.41.0/perlmod/Fink/Services.pm 2016-09-20 14:16:24.000000000 -0400
+++ fink-0.41.0.sandbox/perlmod/Fink/Services.pm 2016-11-03 15:51:47.000000000 -0400
@@ -594,6 +594,20 @@
@wrap = map "$_=$ENV{$_}", sort keys %ENV;
push @wrap, "__CFPREFERENCES_AVOID_DAEMON=1";
unshift @wrap, 'env' if @wrap;
+ my $sandbox = "$Fink::Config::basepath/etc/fink.sb";
+ if (open my $info, $sandbox) {
+ my $sandbox_profile = "(version 1) \n";
+ $sandbox_profile .= "(allow default) \n";
+ $sandbox_profile .= "(deny file* \n";
+ while( my $line = <$info>) {
+ chomp $line;
+ $sandbox_profile .= "\t(subpath \"".$line."\"\)\n";
+ }
+ $sandbox_profile .= "\)\n";
+ close $info;
+ print STDERR $sandbox_profile, "\n" if ($options{debug});
+ @wrap = (qw| sandbox-exec -p |, $sandbox_profile, @wrap) if -f $sandbox;
+ }
my $sudo_cmd = "sudo -u " . Fink::Config::build_as_user_group()->{'user'};
@wrap = (split(' ', $sudo_cmd), @wrap, qw/ sh -c /);
$wrap_token = "$sudo_cmd [ENV] sh -c ";
diff -uNr fink-0.41.0/t/Services/execute_nonroot_okay.t fink-0.41.0.sandbox/t/Services/execute_nonroot_okay.t
--- fink-0.41.0/t/Services/execute_nonroot_okay.t 2016-09-20 14:16:24.000000000 -0400
+++ fink-0.41.0.sandbox/t/Services/execute_nonroot_okay.t 2016-11-03 13:38:03.000000000 -0400
@@ -15,6 +15,8 @@
can_ok('Fink::Config','get_option'); # 4
can_ok('Fink::Config','set_options'); # 5
+my $config_obj = Fink::Config->new_with_path('basepath/etc/fink.conf');
+
# need a a safe place to create files
# OS X 10.2 comes with perl 5.6.0, but File::Temp isn't in core until 5.6.1
The default blacklisting in fink.sb includes /usr/local and /opt/local to avoid any possible interactions with MacPorts.
Patch to add sandboxing vis fink.sb file of blacklisted directories
This is also on https://github.com/fink/fink/pull/135.
Also note that the gcc5 and gcc6 packages now require...
and
to avoid a bootstrap failure when configure tries to access /usr/local/include. MacPorts uses this in their Portfiles.
Last edit: Jack Howarth 2016-11-05
The completed sandboxing support for the current fink-0.41.0 source base is below...
The current sandbox changes provides configuration of fink.conf to add the desired state for the new UseSandbox setting in fink.conf. The changes also provide runtime options of --build-in-sandbox and --no-build-in-sandbox to override the UseSandbox setting in fink.conf.
The sandboxing of fink can easily be verified with 'ps -le | grep sandbox-exec' during a fink build. Which will show...
0 4232 4084 4106 0 31 0 2455672 3064 - S+ 0 ttys027 0:00.01 sudo -u fink-bld sandbox-exec -p (version 1) ^J(allow default) ^J(deny file* ^J^I(subpath "/usr/local")^J^I(subpath "/opt/local")^J)^J env CCACHE_DIR=/sw/var/ccache CFLAGS=-D_DARWIN_NO_64_BIT_INODE -O2 -g -Wall CPPFLAGS=-I/sw/include HOME=/tmp/fink-build-HOME.RCOdx6VWFB INFOPATH=/sw/share/info:/sw/info:/usr/share/info LDFLAGS=-L/sw/lib MACOSX_DEPLOYMENT_TARGET=10.11 MAKEFLAGS=-j8 MANPATH=/sw/share/man:/usr/share/man:/Applications/Xcode.app/Contents/Developer/usr/share/man:/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/share/man:/sw/lib/perl5/5.18.2/man PATH=/sw/var/lib/fink/path-prefix-libcxx:/sw/var/lib/fink/path-prefix-clang:/sw/bin:/sw/sbin:/bin:/usr/bin:/sbin:/usr/sbin:/opt/X11/bin PERL5LIB=/sw/lib/perl5:/sw/lib/perl5/darwin PWD=/sw/src/fink.build/cvs-1.12.13-18 SHLVL=2 TERM=xterm-256color __CFPREFERENCES_AVOID_DAEMON=1 sh -c /tmp/fink.5o7aZ
for 'UseSandbox: true"' in fink.conf or --build-in-sandbox on the fink command line. The usage of sandbox-exec won't be seen for either 'UseSandbox: false"' in fink.conf or --no-build-in-sandbox on the fink command line.
Last edit: Jack Howarth 2016-11-05
This patch has been supplanted by the newly proposed one on https://sourceforge.net/p/fink/patches/161/.