postinstall: allow write access to cellars in repository.

If HOMEBREW_CELLAR (or HOMEBREW_PREFIX) are children of
HOMEBREW_REPOSITORY it’s important to deny write to the repository and
enable write to the Cellar/prefix afterwards.

1 files changed, 2 insertions, 2 deletions

diff --git a/Library/Homebrew/cmd/postinstall.rb b/Library/Homebrew/cmd/postinstall.rb
index 1e205e65d..e8855b09e 100644
--- a/Library/Homebrew/cmd/postinstall.rb
+++ b/Library/Homebrew/cmd/postinstall.rb
@@ -35,10 +35,10 @@ module Homebrew
         sandbox.record_log(formula.logs/"postinstall.sandbox.log")
         sandbox.allow_write_temp_and_cache
         sandbox.allow_write_log(formula)
-        sandbox.allow_write_cellar(formula)
         sandbox.allow_write_xcode
-        sandbox.allow_write_path HOMEBREW_PREFIX
         sandbox.deny_write_homebrew_repository
+        sandbox.allow_write_path HOMEBREW_PREFIX
+        sandbox.allow_write_cellar(formula)
         sandbox.exec(*args)
       else
         exec(*args)