Class: Sandbox

Inherits:
Object
  • Object
show all
Defined in:
brew/Library/Homebrew/sandbox.rb

Defined Under Namespace

Classes: SandboxProfile

Constant Summary collapse

SANDBOX_EXEC = 
"/usr/bin/sandbox-exec"

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize ⇒ Sandbox

Returns a new instance of Sandbox



25
26
27
 
# File 'brew/Library/Homebrew/sandbox.rb', line 25

def initialize
  @profile = SandboxProfile.new
end

Class Method Details

.available? ⇒ Boolean

Returns:

  • (Boolean) 


9
10
11
 
# File 'brew/Library/Homebrew/sandbox.rb', line 9

def self.available?
  OS.mac? && File.executable?(SANDBOX_EXEC)
end

.formula?(_formula) ⇒ Boolean

Returns:

  • (Boolean) 


13
14
15
16
17
 
# File 'brew/Library/Homebrew/sandbox.rb', line 13

def self.formula?(_formula)
  return false unless available?

  !ARGV.no_sandbox?
end

.test? ⇒ Boolean

Returns:

  • (Boolean) 


19
20
21
22
23
 
# File 'brew/Library/Homebrew/sandbox.rb', line 19

def self.test?
  return false unless available?

  !ARGV.no_sandbox?
end

Instance Method Details

#add_rule(rule) ⇒ Object 



33
34
35
 
# File 'brew/Library/Homebrew/sandbox.rb', line 33

def add_rule(rule)
  @profile.add_rule(rule)
end

#allow_cvs ⇒ Object 



61
62
63
 
# File 'brew/Library/Homebrew/sandbox.rb', line 61

def allow_cvs
  allow_write_path "/Users/#{ENV["USER"]}/.cvspass"
end

#allow_fossil ⇒ Object 



65
66
67
68
 
# File 'brew/Library/Homebrew/sandbox.rb', line 65

def allow_fossil
  allow_write_path "/Users/#{ENV["USER"]}/.fossil"
  allow_write_path "/Users/#{ENV["USER"]}/.fossil-journal"
end

#allow_write(path, options = {}) ⇒ Object 



37
38
39
 
# File 'brew/Library/Homebrew/sandbox.rb', line 37

def allow_write(path, options = {})
  add_rule allow: true, operation: "file-write*", filter: path_filter(path, options[:type])
end

#allow_write_cellar(formula) ⇒ Object 



70
71
72
73
74
 
# File 'brew/Library/Homebrew/sandbox.rb', line 70

def allow_write_cellar(formula)
  allow_write_path formula.rack
  allow_write_path formula.etc
  allow_write_path formula.var
end

#allow_write_log(formula) ⇒ Object 



81
82
83
 
# File 'brew/Library/Homebrew/sandbox.rb', line 81

def allow_write_log(formula)
  allow_write_path formula.logs
end

#allow_write_path(path) ⇒ Object 



45
46
47
 
# File 'brew/Library/Homebrew/sandbox.rb', line 45

def allow_write_path(path)
  allow_write path, type: :subpath
end

#allow_write_temp_and_cache ⇒ Object 



53
54
55
56
57
58
59
 
# File 'brew/Library/Homebrew/sandbox.rb', line 53

def allow_write_temp_and_cache
  allow_write_path "/private/tmp"
  allow_write_path "/private/var/tmp"
  allow_write "^/private/var/folders/[^/]+/[^/]+/[C,T]/", type: :regex
  allow_write_path HOMEBREW_TEMP
  allow_write_path HOMEBREW_CACHE
end

#allow_write_xcode ⇒ Object

Xcode projects expect access to certain cache/archive dirs.



77
78
79
 
# File 'brew/Library/Homebrew/sandbox.rb', line 77

def allow_write_xcode
  allow_write_path "/Users/#{ENV["USER"]}/Library/Developer"
end

#deny_write(path, options = {}) ⇒ Object 



41
42
43
 
# File 'brew/Library/Homebrew/sandbox.rb', line 41

def deny_write(path, options = {})
  add_rule allow: false, operation: "file-write*", filter: path_filter(path, options[:type])
end

#deny_write_homebrew_repository ⇒ Object 



85
86
87
88
89
90
91
92
93
 
# File 'brew/Library/Homebrew/sandbox.rb', line 85

def deny_write_homebrew_repository
  deny_write HOMEBREW_BREW_FILE
  if HOMEBREW_PREFIX.to_s != HOMEBREW_REPOSITORY.to_s
    deny_write_path HOMEBREW_REPOSITORY
  else
    deny_write_path HOMEBREW_LIBRARY
    deny_write_path HOMEBREW_REPOSITORY/".git"
  end
end

#deny_write_path(path) ⇒ Object 



49
50
51
 
# File 'brew/Library/Homebrew/sandbox.rb', line 49

def deny_write_path(path)
  deny_write path, type: :subpath
end

#exec(*args) ⇒ Object 



95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
 
# File 'brew/Library/Homebrew/sandbox.rb', line 95

def exec(*args)
  seatbelt = Tempfile.new(["homebrew", ".sb"], HOMEBREW_TEMP)
  seatbelt.write(@profile.dump)
  seatbelt.close
  @start = Time.now
  safe_system SANDBOX_EXEC, "-f", seatbelt.path, *args
rescue
  @failed = true
  raise
ensure
  seatbelt.unlink
  sleep 0.1 # wait for a bit to let syslog catch up the latest events.
  syslog_args = %W[
    -F $((Time)(local))\ $(Sender)[$(PID)]:\ $(Message)
    -k Time ge #{@start.to_i}
    -k Message S deny
    -k Sender kernel
    -o
    -k Time ge #{@start.to_i}
    -k Message S deny
    -k Sender sandboxd
  ]
  logs = Utils.popen_read("syslog", *syslog_args)

  # These messages are confusing and non-fatal, so don't report them.
  logs = logs.lines.reject { |l| l.match(/^.*Python\(\d+\) deny file-write.*pyc$/) }.join

  unless logs.empty?
    if @logfile
      File.open(@logfile, "w") do |log|
        log.write logs
        log.write "\nWe use time to filter sandbox log. Therefore, unrelated logs may be recorded.\n"
      end
    end

    if @failed && ARGV.verbose?
      ohai "Sandbox log"
      puts logs
      $stdout.flush # without it, brew test-bot would fail to catch the log
    end
  end
end

#record_log(file) ⇒ Object 



29
30
31
 
# File 'brew/Library/Homebrew/sandbox.rb', line 29

def record_log(file)
  @logfile = file
end