diff options
Diffstat (limited to 'sys-apps/sandbox')
| -rw-r--r-- | sys-apps/sandbox/Manifest | 13 | ||||
| -rw-r--r-- | sys-apps/sandbox/files/09sandbox | 1 | ||||
| -rw-r--r-- | sys-apps/sandbox/files/sandbox-2.10-disable-same.patch | 77 | ||||
| -rw-r--r-- | sys-apps/sandbox/files/sandbox-2.10-fix-opendir.patch | 79 | ||||
| -rw-r--r-- | sys-apps/sandbox/files/sandbox-2.10-memory-corruption.patch | 42 | ||||
| -rw-r--r-- | sys-apps/sandbox/files/sandbox-2.11-symlinkat-renameat.patch | 124 | ||||
| -rw-r--r-- | sys-apps/sandbox/metadata.xml | 8 | ||||
| -rw-r--r-- | sys-apps/sandbox/sandbox-2.10-r3.ebuild | 84 | ||||
| -rw-r--r-- | sys-apps/sandbox/sandbox-2.10-r4.ebuild | 85 | ||||
| -rw-r--r-- | sys-apps/sandbox/sandbox-2.12.ebuild | 76 |
10 files changed, 589 insertions, 0 deletions
diff --git a/sys-apps/sandbox/Manifest b/sys-apps/sandbox/Manifest new file mode 100644 index 000000000000..645910f90b53 --- /dev/null +++ b/sys-apps/sandbox/Manifest @@ -0,0 +1,13 @@ +AUX 09sandbox 37 SHA256 73e9e9d12ba54f1c649813ec86107924050528852c890a8ba1e2853796781bbe SHA512 4e8a9c58debde6480224a45559c5f2db4765213d151e47937f9142f110cac3681bf6402acaf21249a37bb17398e7bc00ae7feee68ecdb5b9363c432eac1b052a WHIRLPOOL 80d55a34d3faf3314f2b9de2200d4b46a800128514be9e30eb59e5f03fb7a0a5197a9e5b5ab33d6b68d35bf83c86a1bd7ba734a33ccd382fe0af3b2c2a11d0bd +AUX sandbox-2.10-disable-same.patch 2547 SHA256 09a11cf077ae69684080d1f0fd8fe83683fdf5f061e0a7a5261ca03463fd554a SHA512 bf005fbde7b6ba88df36bb75064658764e488dd2f3c96a6f92c69ad3f2e8d2db12ba2c7bafa9656326b7fde73301c330f68bd064efa0fce2a7eb28fff6ce0a1e WHIRLPOOL 27f0df961dcedc70819ecd1d0f105fb7176ecd77127ab187025d9aa52df9faa43941314c71a998dd72658105dfec4c5c6d3341dbae18e18b409af7dc6d9c31d6 +AUX sandbox-2.10-fix-opendir.patch 3311 SHA256 33e31a0331d75985e6fb254001d657988fbe7d0ff2f79128316530636391c76d SHA512 5c0650d6838b8171a87409ebd8565a90a42603874893708c2cdee5b50535e637f145fa2e51142db857c35a9bc11713b45b7e50c31f96f9ecd6ba342ce8d87928 WHIRLPOOL fbac85063c77b26af76761f0d377fac7c7a54e1f465fe0247b7ed90b98e077b75697ce127fa6c509fd28ff6af8313d7d65a0f34ecd969a6143af8b7246687602 +AUX sandbox-2.10-memory-corruption.patch 1515 SHA256 4876cc9962d56d3c5fc5418fe12ef1a399e34ff0272f12640c4a5c5b775e8888 SHA512 1eb650824cc7a876fabef382cafb451a507326a8422fb7bb5014699046b64ea8f4cf2bba9efcb75d7a2eac4eff493d06153422f85c119f49635ac0840071660c WHIRLPOOL db2c834119c7887ed746154e73e88cc09bf2a31184b3cda2732b70cb43dd8bc7f59f1072a4cc56ebcf593ba67330b9888832dc186ee55e009428d607f62293ab +AUX sandbox-2.11-symlinkat-renameat.patch 3418 SHA256 74036803fd8cc07e903abdc2202167cff5e03a82d0db64ad8969b642201a993e SHA512 cbefae8aa9c289db0bfe7b2429f64aa4c437be0e269eaa657eb3b22a3086db1fca45a624cb181978b4157f0cb9b475b4ece2eb9337285bf8bede709ad4431c52 WHIRLPOOL d8943c3f4cda8428c7ab1a75decd67c5e743e5ca998d7e0ae8ba8828923b1c9dc4429c293af4dc9655d3a45e189020fd754f8152471f1626b113a50f69886c9b +DIST sandbox-2.10.tar.xz 417068 SHA256 019d6a2646b3a5f9b6fc3fcb6ff99332901017eb845442bec8573b9901506fa6 SHA512 178b3b8fcb54e6ff67df1c8101866739b49e4d31a66717c21ef502dd2ab609fca70f1a0c662b913e207bfc1ba6994cefdcf5c92ff32add9dd98bd9707f301305 WHIRLPOOL 5d6cffa7317cafeba02af75de9ae914d4365a62b54d3dfcc14cb272e621f2f76a60a945591ccb57dd59d6750152087cb2f21e43ded3ec181d6b42df173147192 +DIST sandbox-2.12.tar.xz 424252 SHA256 265a490a8c528237c55ad26dfd7f62336fa5727c82358fc9cfbaa2e52c47fc50 SHA512 98bd2ee8807d81e65ee0c9f11cfaf2b37da2ee4d8763c68d18c0ff6b14f3cc847ae2d3a0aa30cbe86063a2108ed4d4dcf7cc3fc4f37cb7549d266d4c1989c2a9 WHIRLPOOL 4f3089746a11616c60057165f387122b74e8d2f30a2d77db296405a2b6f401fc625645bca73092436162f5d98a88bfb2a3b42909b0eceb9a59ab810d803441b0 +EBUILD sandbox-2.10-r3.ebuild 2168 SHA256 a76055435a8059b56c6079481c021cbaa9f42efc321d4e67069c6397e23c35d5 SHA512 13daa106179f4203616524cda931e3c79ecc510c09a0991f8165eedbb2e612569f648881183679941a75ee280757fcb3e6176cb61a0c2f2096573ac7a3110dfc WHIRLPOOL 12709e670cb48f463352ff3f6756f3f5193f21ac138b39d27171d97fe11950170c8c664d48c6e25e6187476d932652275f8656d596607d81c4b01f479fb21912 +EBUILD sandbox-2.10-r4.ebuild 2247 SHA256 bb8bafd4ad2c8ae8afb494354a836bb4127290796a2f29d2f9672caa25113af1 SHA512 6780124638eca9bdbf06289bd79129b44e5494c96bea8fe209bc865e2577796a0966e6f8b1bcd73012620f9020449ce65bc0f9e6c5cf083e539d6329decb67e6 WHIRLPOOL 209cf384f9941baaf42a4d510d28dbef1991de41dae7f2ca97e1fd4161f8bd85a664ff3667e7f11fe7a108ed8cc2459bf5ec05cf306fbe9f9b4fa5cdfdf53d04 +EBUILD sandbox-2.12.ebuild 1950 SHA256 51a702c9e6232003be3c10345e1be943b057211eeb4f6f07fd27b9edef866b22 SHA512 f0d3e1707225171c280902e612a5109ed78703d4bcd658a827c61e48ffbbb71c3ed86d2a2ae00289d07e46b264b10fbf48a962cf8e35c4709046c9263a473da0 WHIRLPOOL 968d03aafb5a859dfd0a2720dab7db20ce4e6d055adde0dd744021047e979464a2fb48a262dadb1e99ce799cf07204086dffce32764d173b731c7280df7023aa +MISC ChangeLog 6831 SHA256 eb110ced56d7e173fa1fabd434fdec445259453c13ccb48a554947f9b5b359b6 SHA512 879732fd45e678aa041c18148f44db585bf077ed6ad237725dffd16be0cf4abc37ecf1aa683864b89a547e835927e6a05f0b6c24aec3f034d9a8d671d39cf3bf WHIRLPOOL a9786489a8235518c08350ad190563b8a782de07221cdf44a54bced7f7b4df51867a7a2ee6f0bfa015c514cac07f75d36bdb6d17e3942ab4ec1a5b1a55cf4093 +MISC ChangeLog-2015 25325 SHA256 9e1e3512cb2dceb07f7f480661aa00528d23e41765893244a6dae27bf039f0f6 SHA512 6c714a72b2d1848381543031478dca397fd8150a8ac82febdf4017a339ebdc0dfca8adac95aef4682311e2ada9742aaf9b86d49c9bb6768ca9c802af00744a53 WHIRLPOOL ebffa03ba18522039481fcdf1bfccc2ab5936e0fd4e0d081ae56eca0c784a8e250850855635e7a20025cb38e99e8f7dd80e448bf9e1ba70e6b8295f9aa502312 +MISC metadata.xml 266 SHA256 1681f248b3477c19f9d1228ea18ff9ebfba5415d691db4c90b9debbbec9b5a3d SHA512 8dcc34d3a08407d6807bc5e30b23c6696dbfc63c19106338780d4e2a61be360e17faeb54af993c962f347ada5d24cb314de866506484b04de4c619d6a88787e3 WHIRLPOOL 6c33192203bfded051b0003a2bd7cdb9b94d1167cd33bf2068222a1101c287c636e9e50a38a0af6b51fbd0ed0ec6452e006c4e25b47c6d8f8e160b4dd2755545 diff --git a/sys-apps/sandbox/files/09sandbox b/sys-apps/sandbox/files/09sandbox new file mode 100644 index 000000000000..9181eb068caf --- /dev/null +++ b/sys-apps/sandbox/files/09sandbox @@ -0,0 +1 @@ +CONFIG_PROTECT_MASK="/etc/sandbox.d" diff --git a/sys-apps/sandbox/files/sandbox-2.10-disable-same.patch b/sys-apps/sandbox/files/sandbox-2.10-disable-same.patch new file mode 100644 index 000000000000..296b322b0c50 --- /dev/null +++ b/sys-apps/sandbox/files/sandbox-2.10-disable-same.patch @@ -0,0 +1,77 @@ +From 7a923f646ce10b7dec3c7ae5fe2079c10aa21752 Mon Sep 17 00:00:00 2001 +From: Mike Frysinger <vapier@gentoo.org> +Date: Sun, 20 Dec 2015 16:08:16 -0500 +Subject: [PATCH] libsbutil: gnulib: hand disable same_name usage + +We don't provide same_name because the one caller we don't use, but it +relies on gc-sections to avoid link errors. That flag doesn't work on +ia64 though, so we need to hand delete the one caller. Ugh. + +Signed-off-by: Mike Frysinger <vapier@gentoo.org> +--- + libsbutil/gnulib/hash-triple.c | 9 --------- + libsbutil/gnulib/same.h | 25 ------------------------- + 2 files changed, 34 deletions(-) + delete mode 100644 libsbutil/gnulib/same.h + +diff --git a/libsbutil/gnulib/hash-triple.c b/libsbutil/gnulib/hash-triple.c +index c3b6d9f..06cfbdf 100644 +--- a/libsbutil/gnulib/hash-triple.c ++++ b/libsbutil/gnulib/hash-triple.c +@@ -24,7 +24,6 @@ + #include <string.h> + + #include "hash-pjw.h" +-#include "same.h" + #include "same-inode.h" + + #define STREQ(a, b) (strcmp (a, b) == 0) +@@ -52,14 +51,6 @@ triple_hash_no_name (void const *x, size_t table_size) + + /* Compare two F_triple structs. */ + bool +-triple_compare (void const *x, void const *y) +-{ +- struct F_triple const *a = x; +- struct F_triple const *b = y; +- return (SAME_INODE (*a, *b) && same_name (a->name, b->name)) ? true : false; +-} +- +-bool + triple_compare_ino_str (void const *x, void const *y) + { + struct F_triple const *a = x; +diff --git a/libsbutil/gnulib/same.h b/libsbutil/gnulib/same.h +deleted file mode 100644 +index ee313c5..0000000 +--- a/libsbutil/gnulib/same.h ++++ /dev/null +@@ -1,25 +0,0 @@ +-/* Determine whether two file names refer to the same file. +- +- Copyright (C) 1997-2000, 2003-2004, 2009-2015 Free Software Foundation, Inc. +- +- This program is free software: you can redistribute it and/or modify +- it under the terms of the GNU General Public License as published by +- the Free Software Foundation; either version 3 of the License, or +- (at your option) any later version. +- +- This program is distributed in the hope that it will be useful, +- but WITHOUT ANY WARRANTY; without even the implied warranty of +- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +- GNU General Public License for more details. +- +- You should have received a copy of the GNU General Public License +- along with this program. If not, see <http://www.gnu.org/licenses/>. */ +- +-#ifndef SAME_H_ +-# define SAME_H_ 1 +- +-# include <stdbool.h> +- +-bool same_name (const char *source, const char *dest); +- +-#endif /* SAME_H_ */ +-- +2.6.2 + diff --git a/sys-apps/sandbox/files/sandbox-2.10-fix-opendir.patch b/sys-apps/sandbox/files/sandbox-2.10-fix-opendir.patch new file mode 100644 index 000000000000..2ff89bcdfcba --- /dev/null +++ b/sys-apps/sandbox/files/sandbox-2.10-fix-opendir.patch @@ -0,0 +1,79 @@ +From 3f668dc6ba1910085e61b3a24167ab1352c60d92 Mon Sep 17 00:00:00 2001 +From: Mart Raudsepp <leio@gentoo.org> +Date: Fri, 11 Nov 2016 12:34:48 +0200 +Subject: [PATCH] libsandbox: do not abort with a long name to opendir + +Add a pre-check for opendir that catches too long name arguments +given to opendir, as it would get messed up and abort before it +even gets to the open*() syscall (which would handle it correctly), +due to opendir going through before_syscall/check_syscall, even +though it isn't a true syscall and it getting cut to SB_PATH_MAX +inbetween and getting confused somewhere. + +URL: https://bugs.gentoo.org/553092 +Signed-off-by: Mart Raudsepp <leio@gentoo.org> +--- + libsandbox/wrapper-funcs/opendir.c | 2 ++ + libsandbox/wrapper-funcs/opendir_pre_check.c | 26 ++++++++++++++++++++++++++ + libsandbox/wrappers.h | 1 + + 3 files changed, 29 insertions(+) + create mode 100644 libsandbox/wrapper-funcs/opendir_pre_check.c + +diff --git a/libsandbox/wrapper-funcs/opendir.c b/libsandbox/wrapper-funcs/opendir.c +index 7670775..70c2692 100644 +--- a/libsandbox/wrapper-funcs/opendir.c ++++ b/libsandbox/wrapper-funcs/opendir.c +@@ -10,4 +10,6 @@ + #define WRAPPER_SAFE() SB_SAFE(name) + #define WRAPPER_RET_TYPE DIR * + #define WRAPPER_RET_DEFAULT NULL ++#define WRAPPER_PRE_CHECKS() sb_opendir_pre_check(STRING_NAME, name) ++ + #include "__wrapper_simple.c" +diff --git a/libsandbox/wrapper-funcs/opendir_pre_check.c b/libsandbox/wrapper-funcs/opendir_pre_check.c +new file mode 100644 +index 0000000..60c869f +--- /dev/null ++++ b/libsandbox/wrapper-funcs/opendir_pre_check.c +@@ -0,0 +1,26 @@ ++/* ++ * opendir() pre-check. ++ * ++ * Copyright 1999-2016 Gentoo Foundation ++ * Licensed under the GPL-2 ++ */ ++ ++bool sb_opendir_pre_check(const char *func, const char *name) ++{ ++ /* If length of name is larger than PATH_MAX, we would mess it up ++ * before it reaches the open syscall, which would cleanly error out ++ * via sandbox as well (actually with much smaller lengths than even ++ * PATH_MAX). ++ * So error out early in this case, in order to avoid an abort in ++ * check_syscall later on, which gets ran for opendir, despite it not ++ * being a syscall. ++ */ ++ if (strnlen(name, PATH_MAX) == PATH_MAX) { ++ errno = ENAMETOOLONG; ++ sb_debug_dyn("EARLY FAIL: %s(%s): %s\n", ++ func, name, strerror(errno)); ++ return false; ++ } ++ ++ return true; ++} +diff --git a/libsandbox/wrappers.h b/libsandbox/wrappers.h +index 0aa58bb..bf5bf64 100644 +--- a/libsandbox/wrappers.h ++++ b/libsandbox/wrappers.h +@@ -27,6 +27,7 @@ attribute_hidden bool sb_fopen64_pre_check (const char *func, const char *pathn + attribute_hidden bool sb_mkdirat_pre_check (const char *func, const char *pathname, int dirfd); + attribute_hidden bool sb_openat_pre_check (const char *func, const char *pathname, int dirfd, int flags); + attribute_hidden bool sb_openat64_pre_check (const char *func, const char *pathname, int dirfd, int flags); ++attribute_hidden bool sb_opendir_pre_check (const char *func, const char *name); + attribute_hidden bool sb_unlinkat_pre_check (const char *func, const char *pathname, int dirfd); + attribute_hidden bool sb_common_at_pre_check(const char *func, const char **pathname, int dirfd, + char *dirfd_path, size_t dirfd_path_len); +-- +2.9.0 + diff --git a/sys-apps/sandbox/files/sandbox-2.10-memory-corruption.patch b/sys-apps/sandbox/files/sandbox-2.10-memory-corruption.patch new file mode 100644 index 000000000000..7dd27c9d2246 --- /dev/null +++ b/sys-apps/sandbox/files/sandbox-2.10-memory-corruption.patch @@ -0,0 +1,42 @@ +From 529a388ebb1b4e9d6ad8a1bb61dd8211833a5976 Mon Sep 17 00:00:00 2001 +From: Denis Lisov <dennis.lissov@gmail.com> +Date: Sat, 19 Dec 2015 19:13:58 +0300 +Subject: [PATCH] libsandbox: fix old_malloc_size check on realloc + +Realloc uses SB_MALLOC_TO_SIZE assuming it returns the usable size, +while it is really the mmap size, which is greater. Thus it may fail +to reallocate even if required. + +URL: https://bugs.gentoo.org/568714 +Signed-off-by: Denis Lisov <dennis.lissov@gmail.com> +Signed-off-by: Mike Frysinger <vapier@gentoo.org> +--- + libsandbox/memory.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/libsandbox/memory.c b/libsandbox/memory.c +index 8581128..a2d69a2 100644 +--- a/libsandbox/memory.c ++++ b/libsandbox/memory.c +@@ -40,7 +40,8 @@ static int sb_munmap(void *addr, size_t length) + + #define SB_MALLOC_TO_MMAP(ptr) ((void*)((uintptr_t)(ptr) - MIN_ALIGN)) + #define SB_MMAP_TO_MALLOC(ptr) ((void*)((uintptr_t)(ptr) + MIN_ALIGN)) +-#define SB_MALLOC_TO_SIZE(ptr) (*((size_t*)SB_MALLOC_TO_MMAP(ptr))) ++#define SB_MALLOC_TO_MMAP_SIZE(ptr) (*((size_t*)SB_MALLOC_TO_MMAP(ptr))) ++#define SB_MALLOC_TO_SIZE(ptr) (SB_MALLOC_TO_MMAP_SIZE(ptr) - MIN_ALIGN) + + void *malloc(size_t size) + { +@@ -57,7 +58,7 @@ void free(void *ptr) + { + if (ptr == NULL) + return; +- if (munmap(SB_MALLOC_TO_MMAP(ptr), SB_MALLOC_TO_SIZE(ptr))) ++ if (munmap(SB_MALLOC_TO_MMAP(ptr), SB_MALLOC_TO_MMAP_SIZE(ptr))) + sb_ebort("sandbox memory corruption with free(%p): %s\n", + ptr, strerror(errno)); + } +-- +2.6.2 + diff --git a/sys-apps/sandbox/files/sandbox-2.11-symlinkat-renameat.patch b/sys-apps/sandbox/files/sandbox-2.11-symlinkat-renameat.patch new file mode 100644 index 000000000000..e33011f74959 --- /dev/null +++ b/sys-apps/sandbox/files/sandbox-2.11-symlinkat-renameat.patch @@ -0,0 +1,124 @@ +From 4c47cfa22802fd8201586bef233d8161df4ff61b Mon Sep 17 00:00:00 2001 +From: Mike Frysinger <vapier@gentoo.org> +Date: Fri, 10 Mar 2017 10:15:50 -0800 +Subject: [PATCH] libsandbox: whitelist renameat/symlinkat as symlink funcs + +These funcs don't deref their path args, so flag them as such. + +URL: https://bugs.gentoo.org/612202 +Signed-off-by: Mike Frysinger <vapier@gentoo.org> +--- + libsandbox/libsandbox.c | 4 +++- + tests/renameat-2.sh | 12 ++++++++++++ + tests/renameat-3.sh | 11 +++++++++++ + tests/renameat.at | 2 ++ + tests/symlinkat-2.sh | 10 ++++++++++ + tests/symlinkat-3.sh | 9 +++++++++ + tests/symlinkat.at | 2 ++ + 7 files changed, 49 insertions(+), 1 deletion(-) + create mode 100755 tests/renameat-2.sh + create mode 100755 tests/renameat-3.sh + create mode 100755 tests/symlinkat-2.sh + create mode 100755 tests/symlinkat-3.sh + +diff --git a/libsandbox/libsandbox.c b/libsandbox/libsandbox.c +index e809308d717d..de48bd79ba53 100644 +--- a/libsandbox/libsandbox.c ++++ b/libsandbox/libsandbox.c +@@ -650,8 +650,10 @@ static bool symlink_func(int sb_nr, int flags, const char *abs_path) + sb_nr == SB_NR_LCHOWN || + sb_nr == SB_NR_REMOVE || + sb_nr == SB_NR_RENAME || ++ sb_nr == SB_NR_RENAMEAT || + sb_nr == SB_NR_RMDIR || +- sb_nr == SB_NR_SYMLINK)) ++ sb_nr == SB_NR_SYMLINK || ++ sb_nr == SB_NR_SYMLINKAT)) + { + /* These funcs sometimes operate on symlinks */ + if (!((sb_nr == SB_NR_FCHOWNAT || +diff --git a/tests/renameat-2.sh b/tests/renameat-2.sh +new file mode 100755 +index 000000000000..d0fbe8ae4574 +--- /dev/null ++++ b/tests/renameat-2.sh +@@ -0,0 +1,12 @@ ++#!/bin/sh ++# make sure we can clobber symlinks #612202 ++ ++addwrite $PWD ++ ++ln -s /asdf sym || exit 1 ++touch file ++renameat-0 0 AT_FDCWD file AT_FDCWD sym || exit 1 ++[ ! -e file ] ++[ ! -L sym ] ++[ -e sym ] ++test ! -s "${SANDBOX_LOG}" +diff --git a/tests/renameat-3.sh b/tests/renameat-3.sh +new file mode 100755 +index 000000000000..9ae5c9a6511a +--- /dev/null ++++ b/tests/renameat-3.sh +@@ -0,0 +1,11 @@ ++#!/bin/sh ++# make sure we reject bad renames #612202 ++ ++addwrite $PWD ++mkdir deny ++adddeny $PWD/deny ++ ++touch file ++renameat-0 -1,EACCES AT_FDCWD file AT_FDCWD deny/file || exit 1 ++[ -e file ] ++test -s "${SANDBOX_LOG}" +diff --git a/tests/renameat.at b/tests/renameat.at +index 081d7d20277e..eec4638deeaa 100644 +--- a/tests/renameat.at ++++ b/tests/renameat.at +@@ -1 +1,3 @@ + SB_CHECK(1) ++SB_CHECK(2) ++SB_CHECK(3) +diff --git a/tests/symlinkat-2.sh b/tests/symlinkat-2.sh +new file mode 100755 +index 000000000000..168362e8806f +--- /dev/null ++++ b/tests/symlinkat-2.sh +@@ -0,0 +1,10 @@ ++#!/bin/sh ++# make sure we can clobber symlinks #612202 ++ ++addwrite $PWD ++ ++symlinkat-0 0 /asdf AT_FDCWD ./sym || exit 1 ++[ -L sym ] ++symlinkat-0 -1,EEXIST /asdf AT_FDCWD ./sym || exit 1 ++[ -L sym ] ++test ! -s "${SANDBOX_LOG}" +diff --git a/tests/symlinkat-3.sh b/tests/symlinkat-3.sh +new file mode 100755 +index 000000000000..a01c750dd2b6 +--- /dev/null ++++ b/tests/symlinkat-3.sh +@@ -0,0 +1,9 @@ ++#!/bin/sh ++# make sure we reject bad symlinks #612202 ++ ++addwrite $PWD ++mkdir deny ++adddeny $PWD/deny ++ ++symlinkat-0 -1,EACCES ./ AT_FDCWD deny/sym || exit 1 ++test -s "${SANDBOX_LOG}" +diff --git a/tests/symlinkat.at b/tests/symlinkat.at +index 081d7d20277e..eec4638deeaa 100644 +--- a/tests/symlinkat.at ++++ b/tests/symlinkat.at +@@ -1 +1,3 @@ + SB_CHECK(1) ++SB_CHECK(2) ++SB_CHECK(3) +-- +2.12.0 + diff --git a/sys-apps/sandbox/metadata.xml b/sys-apps/sandbox/metadata.xml new file mode 100644 index 000000000000..24b5738cbeb0 --- /dev/null +++ b/sys-apps/sandbox/metadata.xml @@ -0,0 +1,8 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd"> +<pkgmetadata> +<maintainer type="project"> + <email>sandbox@gentoo.org</email> + <description>Sandbox Maintainers</description> +</maintainer> +</pkgmetadata> diff --git a/sys-apps/sandbox/sandbox-2.10-r3.ebuild b/sys-apps/sandbox/sandbox-2.10-r3.ebuild new file mode 100644 index 000000000000..0f7d12d168dd --- /dev/null +++ b/sys-apps/sandbox/sandbox-2.10-r3.ebuild @@ -0,0 +1,84 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# +# don't monkey with this ebuild unless contacting portage devs. +# period. +# + +EAPI="5" + +inherit eutils flag-o-matic multilib-minimal multiprocessing pax-utils + +DESCRIPTION="sandbox'd LD_PRELOAD hack" +HOMEPAGE="https://www.gentoo.org/proj/en/portage/sandbox/" +SRC_URI="mirror://gentoo/${P}.tar.xz + https://dev.gentoo.org/~vapier/dist/${P}.tar.xz" + +LICENSE="GPL-2" +SLOT="0" +KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~sparc-fbsd ~x86-fbsd" +IUSE="" + +DEPEND="app-arch/xz-utils + >=app-misc/pax-utils-0.1.19" #265376 +RDEPEND="" + +has sandbox_death_notice ${EBUILD_DEATH_HOOKS} || EBUILD_DEATH_HOOKS="${EBUILD_DEATH_HOOKS} sandbox_death_notice" + +sandbox_death_notice() { + ewarn "If configure failed with a 'cannot run C compiled programs' error, try this:" + ewarn "FEATURES='-sandbox -usersandbox' emerge sandbox" +} + +src_prepare() { + epatch "${FILESDIR}"/${P}-memory-corruption.patch #568714 + epatch "${FILESDIR}"/${P}-disable-same.patch + epatch "${FILESDIR}"/${P}-fix-opendir.patch #553092 + epatch_user +} + +multilib_src_configure() { + filter-lfs-flags #90228 + + local myconf=() + host-is-pax && myconf+=( --disable-pch ) #301299 #425524 #572092 + + ECONF_SOURCE="${S}" \ + econf "${myconf[@]}" +} + +multilib_src_test() { + # Default sandbox build will run with --jobs set to # cpus. + emake check TESTSUITEFLAGS="--jobs=$(makeopts_jobs)" +} + +multilib_src_install_all() { + doenvd "${FILESDIR}"/09sandbox + + keepdir /var/log/sandbox + fowners root:portage /var/log/sandbox + fperms 0770 /var/log/sandbox + + cd "${S}" + dodoc AUTHORS ChangeLog* NEWS README +} + +pkg_preinst() { + chown root:portage "${ED}"/var/log/sandbox + chmod 0770 "${ED}"/var/log/sandbox + + if [[ ${REPLACING_VERSIONS} == 1.* ]] ; then + local old=$(find "${EROOT}"/lib* -maxdepth 1 -name 'libsandbox*') + if [[ -n ${old} ]] ; then + elog "Removing old sandbox libraries for you:" + find "${EROOT}"/lib* -maxdepth 1 -name 'libsandbox*' -print -delete + fi + fi +} + +pkg_postinst() { + if [[ ${REPLACING_VERSIONS} == 1.* ]] ; then + chmod 0755 "${EROOT}"/etc/sandbox.d #265376 + fi +} diff --git a/sys-apps/sandbox/sandbox-2.10-r4.ebuild b/sys-apps/sandbox/sandbox-2.10-r4.ebuild new file mode 100644 index 000000000000..0f7929102049 --- /dev/null +++ b/sys-apps/sandbox/sandbox-2.10-r4.ebuild @@ -0,0 +1,85 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# +# don't monkey with this ebuild unless contacting portage devs. +# period. +# + +EAPI="5" + +inherit eutils flag-o-matic multilib-minimal multiprocessing pax-utils + +DESCRIPTION="sandbox'd LD_PRELOAD hack" +HOMEPAGE="https://www.gentoo.org/proj/en/portage/sandbox/" +SRC_URI="mirror://gentoo/${P}.tar.xz + https://dev.gentoo.org/~vapier/dist/${P}.tar.xz" + +LICENSE="GPL-2" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~sparc-fbsd ~x86-fbsd" +IUSE="" + +DEPEND="app-arch/xz-utils + >=app-misc/pax-utils-0.1.19" #265376 +RDEPEND="" + +has sandbox_death_notice ${EBUILD_DEATH_HOOKS} || EBUILD_DEATH_HOOKS="${EBUILD_DEATH_HOOKS} sandbox_death_notice" + +sandbox_death_notice() { + ewarn "If configure failed with a 'cannot run C compiled programs' error, try this:" + ewarn "FEATURES='-sandbox -usersandbox' emerge sandbox" +} + +src_prepare() { + epatch "${FILESDIR}"/${P}-memory-corruption.patch #568714 + epatch "${FILESDIR}"/${P}-disable-same.patch + epatch "${FILESDIR}"/${P}-fix-opendir.patch #553092 + epatch "${FILESDIR}"/${PN}-2.11-symlinkat-renameat.patch #612202 + epatch_user +} + +multilib_src_configure() { + filter-lfs-flags #90228 + + local myconf=() + host-is-pax && myconf+=( --disable-pch ) #301299 #425524 #572092 + + ECONF_SOURCE="${S}" \ + econf "${myconf[@]}" +} + +multilib_src_test() { + # Default sandbox build will run with --jobs set to # cpus. + emake check TESTSUITEFLAGS="--jobs=$(makeopts_jobs)" +} + +multilib_src_install_all() { + doenvd "${FILESDIR}"/09sandbox + + keepdir /var/log/sandbox + fowners root:portage /var/log/sandbox + fperms 0770 /var/log/sandbox + + cd "${S}" + dodoc AUTHORS ChangeLog* NEWS README +} + +pkg_preinst() { + chown root:portage "${ED}"/var/log/sandbox + chmod 0770 "${ED}"/var/log/sandbox + + if [[ ${REPLACING_VERSIONS} == 1.* ]] ; then + local old=$(find "${EROOT}"/lib* -maxdepth 1 -name 'libsandbox*') + if [[ -n ${old} ]] ; then + elog "Removing old sandbox libraries for you:" + find "${EROOT}"/lib* -maxdepth 1 -name 'libsandbox*' -print -delete + fi + fi +} + +pkg_postinst() { + if [[ ${REPLACING_VERSIONS} == 1.* ]] ; then + chmod 0755 "${EROOT}"/etc/sandbox.d #265376 + fi +} diff --git a/sys-apps/sandbox/sandbox-2.12.ebuild b/sys-apps/sandbox/sandbox-2.12.ebuild new file mode 100644 index 000000000000..6bea9b719117 --- /dev/null +++ b/sys-apps/sandbox/sandbox-2.12.ebuild @@ -0,0 +1,76 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +EAPI="6" + +inherit eutils flag-o-matic multilib-minimal multiprocessing pax-utils + +DESCRIPTION="sandbox'd LD_PRELOAD hack" +HOMEPAGE="https://www.gentoo.org/proj/en/portage/sandbox/" +SRC_URI="https://dev.gentoo.org/~mgorny/dist/${P}.tar.xz" + +LICENSE="GPL-2" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~sparc-fbsd ~x86-fbsd" +IUSE="" + +DEPEND="app-arch/xz-utils + >=app-misc/pax-utils-0.1.19" #265376 +RDEPEND="" + +has sandbox_death_notice ${EBUILD_DEATH_HOOKS} || EBUILD_DEATH_HOOKS="${EBUILD_DEATH_HOOKS} sandbox_death_notice" + +sandbox_death_notice() { + ewarn "If configure failed with a 'cannot run C compiled programs' error, try this:" + ewarn "FEATURES='-sandbox -usersandbox' emerge sandbox" +} + +multilib_src_configure() { + filter-lfs-flags #90228 + + local myconf=() + host-is-pax && myconf+=( --disable-pch ) #301299 #425524 #572092 + + ECONF_SOURCE="${S}" \ + econf "${myconf[@]}" +} + +multilib_src_test() { + # Default sandbox build will run with --jobs set to # cpus. + emake check TESTSUITEFLAGS="--jobs=$(makeopts_jobs)" +} + +multilib_src_install_all() { + doenvd "${FILESDIR}"/09sandbox + + keepdir /var/log/sandbox + fowners root:portage /var/log/sandbox + fperms 0770 /var/log/sandbox + + dodoc AUTHORS ChangeLog* NEWS README +} + +pkg_preinst() { + chown root:portage "${ED}"/var/log/sandbox + chmod 0770 "${ED}"/var/log/sandbox + + local v + for v in ${REPLACING_VERSIONS}; do + if [[ ${v} == 1.* ]] ; then + local old=$(find "${EROOT}"/lib* -maxdepth 1 -name 'libsandbox*') + if [[ -n ${old} ]] ; then + elog "Removing old sandbox libraries for you:" + find "${EROOT}"/lib* -maxdepth 1 -name 'libsandbox*' -print -delete + fi + fi + done +} + +pkg_postinst() { + local v + for v in ${REPLACING_VERSIONS}; do + if [[ ${v} == 1.* ]] ; then + chmod 0755 "${EROOT}"/etc/sandbox.d #265376 + fi + done +} |