Set default values via a config file. Also support sandbox.d

config directory for package specific configuration files.

Signed-off-by: Martin Schlemmer <azarah@gentoo.org>

3 files changed, 115 insertions, 0 deletions

diff --git a/etc/00default b/etc/00default
new file mode 100644
index 0000000..6bae212
--- /dev/null
+++ b/etc/00default
@@ -0,0 +1,29 @@
+# Default configuration for non-set values
+#
+# As stated in sandbox.conf, any value in here do not get used if the variable
+# is already present in the environment.  All rules of the ACCESS Section
+# applies here.
+
+# Normally the whole filesystem should be readable
+SANDBOX_READ="/"
+
+# Finally add current directory if interactive
+SANDBOX_WRITE="${SANDBOX_WORKDIR}"
+# Needed for configure tests
+SANDBOX_WRITE="/usr/tmp/conftest:/usr/lib/conftest:/usr/lib32/conftest:/usr/lib64/conftest:/usr/tmp/cf:/usr/lib/cf:/usr/lib32/cf:/usr/lib64/cf"
+
+
+#
+# The following should be moved to respective packages
+#
+
+# This should be handled by gnome-base/gconf
+SANDBOX_WRITE="${HOME}/.gconfd/lock"
+# This should be handled by app-text/scrollkeeper
+SANDBOX_WRITE="/var/log/scrollkeeper.log"
+
+# These should be handled by dev-lang/python or sys-apps/portage
+SANDBOX_PREDICT="/usr/lib/python2.0/:/usr/lib/python2.1/:/usr/lib/python2.2/:/usr/lib/python2.3/:/usr/lib/python2.4/:/usr/lib/python2.5/:/usr/lib/python3.0/"
+# These should be handled by sys-libs/nss-db
+SANDBOX_PREDICT="/var/db/aliases.db:/var/db/netgroup.db:/var/db/netmasks.db:/var/db/ethers.db:/var/db/rpc.db:/var/db/protocols.db:/var/db/services.db:/var/db/networks.db:/var/db/hosts.db:/var/db/group.db:/var/db/passwd.db"
+
diff --git a/etc/Makefile.am b/etc/Makefile.am
new file mode 100644
index 0000000..3425f1b
--- /dev/null
+++ b/etc/Makefile.am
@@ -0,0 +1,6 @@
+confdir = $(sysconfdir)
+dist_conf_DATA  = sandbox.conf
+
+confddir = $(sysconfdir)/sandbox.d
+dist_confd_DATA = 00default
+
diff --git a/etc/sandbox.conf b/etc/sandbox.conf
new file mode 100644
index 0000000..d6ae4bf
--- /dev/null
+++ b/etc/sandbox.conf
@@ -0,0 +1,80 @@
+# Sandbox main configuration file
+
+# Note that configuration parser is fairly basic, so try to keep things simple.
+
+#
+# BASIC Section
+#
+
+# Basic sandbox configuration. Sandbox will use values here if not already set
+# in the environment.  Assignment works like bash variable assignment (ie, last
+# value assigned to the variable is used).
+
+# SANDBOX_VERBOSE
+#
+#  Determine if sandbox print access violations, or if debugging is enabled,
+#  it will also print allowed operations.  Default is "yes"
+#SANDBOX_VERBOSE="yes"
+
+# SANDBOX_DEBUG
+#
+#  In addition to the normal log, a debug log is also written containing all
+#  operations caught by sandbox.  Default is "no"
+#SANDBOX_DEBUG="no"
+
+# SANDBOX_BEEP
+#
+#  The amount of beeps sandbox will issue when it exits with access violations
+#  after printing the normal log.  Default is "3"
+#SANDBOX_BEEP=3
+
+# NOCOLOR
+#
+#  Determine the use of color in the output.  Default is "false" (ie, use color)
+#NOCOLOR="false"
+
+
+#
+# ACCESS Section
+#
+
+# The next section contain rules for access.  It works a bit different from the
+# previous section in that values assigned to variables stack.  Also since these
+# do NOT get overridded by values already set in the environment, but rather
+# those get added.
+#
+# If you want values that only get set if one of the variables are not already
+# present in the environment, place a file in /etc/sandbox.d/ (replace /etc
+# with what sysconfdir was configured to).
+#
+# Another difference from above, is that these support simple variable name
+# substitution.  Variable names must be in the form of '${variable}' (without
+# the '').  It is very basic, so no command substitution, etc is supported.
+#
+# The values consists of the respective paths seperated by a colon (:)
+#
+# SANDBOX_DENY - all access to respective paths are denied
+#
+# SANDBOX_READ - can read respective paths
+#
+# SANDBOX_WRITE - can write to respective paths
+#
+# SANDBOX_PREDICT - respective paths are not writable, but no access violation
+#                   will be issued in the case of a write
+#
+
+# Needed for stdout, stdin and stderr
+SANDBOX_WRITE="/dev/fd:/proc/self/fd"
+# Common device nodes
+SANDBOX_WRITE="/dev/zero:/dev/null:/dev/full"
+# Console device nodes
+SANDBOX_WRITE="/dev/console:/dev/tty:/dev/vc/:/dev/pty:/dev/tts"
+# Device filesystems
+SANDBOX_WRITE="/dev/pts/:/dev/shm"
+# Tempory storage
+SANDBOX_WRITE="/tmp/:/var/tmp/"
+# Needed for shells
+SANDBOX_WRITE="${HOME}/.bash_history"
+
+# Usually writes in /home should not cause violations
+SANDBOX_PREDICT="${HOME}"