From fed96385acc2ee10909870997950f2e48a86026f Mon Sep 17 00:00:00 2001 From: Mike McQuaid Date: Sun, 14 Aug 2016 17:33:05 +0100 Subject: sandbox: add test? method. Simplify checking if we’re going to sandbox a test with `Sandbox.test?`. --- Library/Homebrew/sandbox.rb | 5 +++++ Library/Homebrew/test/test_sandbox.rb | 6 ++++++ 2 files changed, 11 insertions(+) (limited to 'Library') diff --git a/Library/Homebrew/sandbox.rb b/Library/Homebrew/sandbox.rb index 4823baf7f..c299d2f45 100644 --- a/Library/Homebrew/sandbox.rb +++ b/Library/Homebrew/sandbox.rb @@ -8,6 +8,11 @@ class Sandbox OS.mac? && File.executable?(SANDBOX_EXEC) end + def self.test? + return false unless available? + !ARGV.no_sandbox? + end + def self.print_sandbox_message unless @printed_sandbox_message ohai "Using the sandbox" diff --git a/Library/Homebrew/test/test_sandbox.rb b/Library/Homebrew/test/test_sandbox.rb index dc907d428..de60551d1 100644 --- a/Library/Homebrew/test/test_sandbox.rb +++ b/Library/Homebrew/test/test_sandbox.rb @@ -13,6 +13,12 @@ class SandboxTest < Homebrew::TestCase @dir.rmtree end + def test_test? + ARGV.stubs(:no_sandbox?).returns false + assert Sandbox.test?, + "Tests should be sandboxed unless --no-sandbox was passed." + end + def test_allow_write @sandbox.allow_write @file @sandbox.exec "touch", @file -- cgit v1.2.3 From ca3e4fcc1de70be7d540142b186b312968e22a1a Mon Sep 17 00:00:00 2001 From: Mike McQuaid Date: Sun, 14 Aug 2016 17:33:17 +0100 Subject: cmd/test: use Sandbox.test? --- Library/Homebrew/cmd/test.rb | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) (limited to 'Library') diff --git a/Library/Homebrew/cmd/test.rb b/Library/Homebrew/cmd/test.rb index 0218e1c80..495ea8ec8 100644 --- a/Library/Homebrew/cmd/test.rb +++ b/Library/Homebrew/cmd/test.rb @@ -57,12 +57,10 @@ module Homebrew args << "--devel" end - if Sandbox.available? && !ARGV.no_sandbox? - Sandbox.print_sandbox_message - end + Sandbox.print_sandbox_message if Sandbox.test? Utils.safe_fork do - if Sandbox.available? && !ARGV.no_sandbox? + if Sandbox.test? sandbox = Sandbox.new f.logs.mkpath sandbox.record_log(f.logs/"sandbox.test.log") -- cgit v1.2.3 From 6e887fbf5ac5bc1fb551a3e4222ad1804b490def Mon Sep 17 00:00:00 2001 From: Mike McQuaid Date: Sun, 14 Aug 2016 17:34:54 +0100 Subject: sandbox: add formula? method and sandbox core. Add a new `Sandbox.formula?` method to see if a given formula should be sandboxed. Use the formula to check its tap against a list of pre-approved taps where we know every formula builds under the sandbox (currently just homebrew/core). --- Library/Homebrew/sandbox.rb | 8 ++++++++ Library/Homebrew/test/test_sandbox.rb | 16 ++++++++++++++++ 2 files changed, 24 insertions(+) (limited to 'Library') diff --git a/Library/Homebrew/sandbox.rb b/Library/Homebrew/sandbox.rb index c299d2f45..133bdb83c 100644 --- a/Library/Homebrew/sandbox.rb +++ b/Library/Homebrew/sandbox.rb @@ -3,11 +3,19 @@ require "tempfile" class Sandbox SANDBOX_EXEC = "/usr/bin/sandbox-exec".freeze + SANDBOXED_TAPS = [ + "homebrew/core", + ].freeze def self.available? OS.mac? && File.executable?(SANDBOX_EXEC) end + def self.formula?(formula) + return false unless available? + ARGV.sandbox? || SANDBOXED_TAPS.include?(formula.tap.to_s) + end + def self.test? return false unless available? !ARGV.no_sandbox? diff --git a/Library/Homebrew/test/test_sandbox.rb b/Library/Homebrew/test/test_sandbox.rb index de60551d1..cb33c3ffa 100644 --- a/Library/Homebrew/test/test_sandbox.rb +++ b/Library/Homebrew/test/test_sandbox.rb @@ -13,6 +13,22 @@ class SandboxTest < Homebrew::TestCase @dir.rmtree end + def test_formula? + f = formula { url "foo-1.0" } + f2 = formula { url "bar-1.0" } + f2.stubs(:tap).returns(Tap.fetch("test/tap")) + + ARGV.stubs(:sandbox?).returns true + assert Sandbox.formula?(f), + "Formulae should be sandboxed if --sandbox was passed." + + ARGV.stubs(:sandbox?).returns false + assert Sandbox.formula?(f), + "Formulae should be sandboxed if in a sandboxed tap." + refute Sandbox.formula?(f2), + "Formulae should not be sandboxed if not in a sandboxed tap." + end + def test_test? ARGV.stubs(:no_sandbox?).returns false assert Sandbox.test?, -- cgit v1.2.3 From 6375adc0ff00073740b49973aacfe81d4cd1099e Mon Sep 17 00:00:00 2001 From: Mike McQuaid Date: Sun, 14 Aug 2016 17:35:06 +0100 Subject: formula_installer: use Sandbox.formula? method. --- Library/Homebrew/formula_installer.rb | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) (limited to 'Library') diff --git a/Library/Homebrew/formula_installer.rb b/Library/Homebrew/formula_installer.rb index 54581b232..03c9f8314 100644 --- a/Library/Homebrew/formula_installer.rb +++ b/Library/Homebrew/formula_installer.rb @@ -588,15 +588,13 @@ class FormulaInstaller #{formula.path} ].concat(build_argv) - if Sandbox.available? && ARGV.sandbox? - Sandbox.print_sandbox_message - end + Sandbox.print_sandbox_message if Sandbox.formula?(formula) Utils.safe_fork do # Invalidate the current sudo timestamp in case a build script calls sudo system "/usr/bin/sudo", "-k" - if Sandbox.available? && ARGV.sandbox? + if Sandbox.formula?(formula) sandbox = Sandbox.new formula.logs.mkpath sandbox.record_log(formula.logs/"sandbox.build.log") -- cgit v1.2.3 From c6151951d6b685936adb8819db3957b12c95f5c9 Mon Sep 17 00:00:00 2001 From: Mike McQuaid Date: Sun, 14 Aug 2016 17:35:14 +0100 Subject: cmd/postinstall: use Sandbox.formula? method. --- Library/Homebrew/cmd/postinstall.rb | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) (limited to 'Library') diff --git a/Library/Homebrew/cmd/postinstall.rb b/Library/Homebrew/cmd/postinstall.rb index 95bd3f8ef..798907339 100644 --- a/Library/Homebrew/cmd/postinstall.rb +++ b/Library/Homebrew/cmd/postinstall.rb @@ -21,12 +21,10 @@ module Homebrew args << "--devel" end - if Sandbox.available? && ARGV.sandbox? - Sandbox.print_sandbox_message - end + Sandbox.print_sandbox_message if Sandbox.formula?(formula) Utils.safe_fork do - if Sandbox.available? && ARGV.sandbox? + if Sandbox.formula?(formula) sandbox = Sandbox.new formula.logs.mkpath sandbox.record_log(formula.logs/"sandbox.postinstall.log") -- cgit v1.2.3