[gentoo-dev] emerge system through sandbox

[Geert Bevin]

Hi,

I performed an entire 'emerge system' on a freshly installed machine
with the sandbox installed beforehand. This made it possible to check
all system packages for accedental writes outside the allowed dirs.
Below is the list of packages that failed and the details :

fileutils
mkdir:     /usr/tmp/cf19190
mkdir:     /usr/lib/cf19190

findutils
mkdir:     /var/spool/locate

gpm
mkdir:     /etc/gpm

ncurses
open_wr:   /usr/tmp/conftest9012345
open_wr:   /usr/tmp/conftest9012346

patch
open_wr:   /usr/tmp/conftest9012345
open_wr:   /usr/tmp/conftest9012346

pwdb
open_wr:   /usr/portage/sys-libs/pwdb/files/.

sh-utils
mkdir:     /usr/tmp/cf8115
mkdir:     /usr/lib/cf8115

tar
open_wr:   /usr/tmp/conftest9012345
open_wr:   /usr/tmp/conftest9012346

textutils
mkdir:     /usr/tmp/cf27156
mkdir:     /usr/lib/cf27156

Out of this I conclude that it might be a good idea to open up
'/usr/tmp' for writing too. Anyway, it's linked to /var/tmp and ormally
the dirs that are created in /usr/tmp by these packages are deleted
immediately afterwards.

I'm currently building an entire gnome desktop through the sandbox.
There's already one problem which I've discussed with Hallski. Quite
some packages need to write to '/var/log/scrollkeeper.log' during their
installation. Hallski is going to investigate how this could be helped,
but in the meantime I've opened up my local sadbox for this file
temporarely.

Best regards,

Geert

-- 
Geert Bevin
the Leaf sprl/bvba
"Use what you need"           Pierre Theunisstraat 1/47
http://www.theleaf.be         1030 Brussels
gbevin@×××××××.be             Tel & Fax [phone]