Hi, On Thu, Sep 27, 2012 at 02:45:18PM -0400, Arno Hautala wrote: > What about other options like chroot? Would it be possible to build > within a chrooted environment? Maybe that would be too heavy in having > to copy all dependencies to the chroot.
chroot certainly is a way to solve this problem, but I think it's too heavyweight and slow for our needs. We could fix the way trace mode worked before, i.e., using an "overlay filesystem" using DYLD_INSERT_LIBRARIES (the eqivalent to Linux' LD_PRELOAD). Wrapping filesystem-related syscalls is a way to implement sandboxing. It's not impossible to escape from this poor man's sandbox, though. The downside of this method is the number of syscalls and userland-side configuration we need to support (32bit vs. 64bit syscalls, inodes, etc.). That being said, I already have most of the work done locally. I haven't commited this yet because I'm still hunting a bug where the socket connection to port(1) controlling the sandbox is lost (and the next call to send(2) fails with ENOTSOCK). -- Clemens Lang _______________________________________________ macports-dev mailing list [email protected] http://lists.macosforge.org/mailman/listinfo/macports-dev
