From 1fc0fe1baf85866bbb8d9b731e7811e3f7cf25af Mon Sep 17 00:00:00 2001
From: Jude Taylor <me@jude.bio>
Date: Tue, 29 Sep 2015 10:08:33 -0700
Subject: remove sandbox defaults into a new file

---
 src/libstore/build.cc | 70 ++++-----------------------------------------------
 1 file changed, 5 insertions(+), 65 deletions(-)

(limited to 'src/libstore/build.cc')

diff --git a/src/libstore/build.cc b/src/libstore/build.cc
index 56835a418352..8167fcc726cf 100644
--- a/src/libstore/build.cc
+++ b/src/libstore/build.cc
@@ -2439,9 +2439,11 @@ void DerivationGoal::runChild()
             for (auto & i : inputPaths)
                 dirsInChroot[i] = i;
 
-            /* TODO: we should factor out the policy cleanly, so we don't have to repeat the constants every time... */
+            /* This has to appear before import statements */
             sandboxProfile += "(version 1)\n";
 
+            sandboxProfile += (format("(import \"%1%/share/nix/sandbox-defaults.sb\")\n") % NIX_PREFIX).str();
+
             /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */
             if (settings.get("darwin-log-sandbox-violations", false)) {
                 sandboxProfile += "(deny default)\n";
@@ -2449,56 +2451,6 @@ void DerivationGoal::runChild()
                 sandboxProfile += "(deny default (with no-log))\n";
             }
 
-            sandboxProfile += "(allow file-read* file-write-data (literal \"/dev/null\"))\n";
-
-            sandboxProfile += "(allow ipc-posix-shm* ipc-posix-sem)\n";
-
-            sandboxProfile += "(allow mach-lookup\n"
-                "\t(global-name \"com.apple.SecurityServer\")\n"
-                ")\n";
-
-            sandboxProfile += "(allow file-read*\n"
-                "\t(literal \"/dev/dtracehelper\")\n"
-                "\t(literal \"/dev/tty\")\n"
-                "\t(literal \"/dev/autofs_nowait\")\n"
-                "\t(literal \"/private/var/run/systemkeychaincheck.done\")\n"
-                "\t(literal \"/private/etc/protocols\")\n"
-                "\t(literal \"/private/var/tmp\")\n"
-                "\t(subpath \"/usr/share/locale\")\n"
-                "\t(subpath \"/usr/share/zoneinfo\")\n"
-                "\t(literal \"/private/var/db\")\n"
-                "\t(subpath \"/private/var/db/mds\")\n"
-                ")\n";
-
-            sandboxProfile += "(allow file-write*\n"
-                "\t(literal \"/dev/tty\")\n"
-                "\t(literal \"/dev/dtracehelper\")\n"
-                "\t(literal \"/mds\")\n"
-                ")\n";
-
-            sandboxProfile += "(allow file-ioctl\n"
-                "\t(literal \"/dev/dtracehelper\")\n"
-                ")\n";
-
-            sandboxProfile += "(allow file-read-metadata\n"
-                "\t(literal \"/var\")\n"
-                "\t(literal \"/tmp\")\n"
-                "\t(literal \"/etc\")\n"
-                "\t(literal \"/etc/nix\")\n"
-                "\t(literal \"/etc/nix/nix.conf\")\n"
-                "\t(literal \"/etc/resolv.conf\")\n"
-                "\t(literal \"/private/etc/resolv.conf\")\n"
-                ")\n";
-
-            sandboxProfile += "(allow file-read*\n"
-                "\t(literal \"/private/etc/nix/nix.conf\")\n"
-                "\t(literal \"/private/var/run/resolv.conf\")\n"
-                ")\n";
-
-            sandboxProfile += "(allow file-read* file-write*\n"
-                "\t(subpath \"/dev/fd\")\n"
-                ")\n";
-
             /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms
                to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */
             Path globalTmpDir = canonPath(getEnv("TMPDIR", "/tmp"), true);
@@ -2506,20 +2458,6 @@ void DerivationGoal::runChild()
             /* They don't like trailing slashes on subpath directives */
             if (globalTmpDir.back() == '/') globalTmpDir.pop_back();
 
-            /* This is where our temp folders are and where most of the building will happen, so we want rwx on it. */
-            sandboxProfile += (format("(allow file-read* file-write* process-exec (subpath \"%1%\") (subpath \"/private/tmp\"))\n") % globalTmpDir).str();
-
-            sandboxProfile += "(allow process-fork)\n";
-            sandboxProfile += "(allow sysctl-read)\n";
-            sandboxProfile += "(allow signal (target same-sandbox))\n";
-
-            /* Enables getpwuid (used by git and others) */
-            sandboxProfile += "(allow mach-lookup (global-name \"com.apple.system.notification_center\") (global-name \"com.apple.system.opendirectoryd.libinfo\"))\n";
-
-            /* Allow local networking operations, mostly because lots of test suites use it and it seems mostly harmless */
-            sandboxProfile += "(allow network* (local ip) (remote unix-socket))";
-
-
             /* Our rwx outputs */
             sandboxProfile += "(allow file-read* file-write* process-exec\n";
             for (auto & i : missingPaths) {
@@ -2564,6 +2502,8 @@ void DerivationGoal::runChild()
             args.push_back("sandbox-exec");
             args.push_back("-p");
             args.push_back(sandboxProfile);
+            args.push_back("-D");
+            args.push_back((format("_GLOBAL_TMP_DIR=%1%") % globalTmpDir).str());
             args.push_back(drv->builder);
         } else {
             builder = drv->builder.c_str();
-- 
cgit 1.4.1