Re: [gentoo-dev] sandbox-1.7 and static binaries

[Mike Frysinger]

On Tuesday 31 March 2009 07:52:24 Mike Frysinger wrote:
> partly because the QA notices about untraceable static binaries that
> sandbox-1.6 emits, but mostly because i wanted to bust solar's balls, i did
> a mini hack fest the other nite and added ptrace() support into sandbox for
> static binaries.  seems to work for me, but if someone notices something
> new and freaky, you've been warned!

some notes from the wild:
 - some packages might fail now that didnt before due to /etc/ld.so.* 
violations.  no, this isnt a bug in sandbox.  it was a bug that older 
sandboxes didnt catch it.  every case ive seen so far means the package is 
wrongly running `ldconfig` on the entire tree during src_install().  this is a 
pointless waste of cpu time, i/o time, hawaii time, and other crap.  disable 
it in your package.
 - tracing of multilib is supported (so 32bit x86 on 64bit x86_64 host)
 - parisc and blackfin are now supported
 - static binaries that violate sandbox are killed immediately.  this is 
different from normal sandbox where the application is returned an error and 
it keeps on running.  this is due to ptrace limitations where there is no way 
for the parent doing the tracing to tell the traced child to skip execution of 
the next syscall.  our choices as the tracer are (1) let it happen and modify 
the syscall return or (2) kill it immediately.  since (1) allows the syscall 
to occur (say something like unlink(/foo/bar), that clearly isnt acceptable.  
unless i missed something in ptrace in which case people should point it out 
to me.

> side note, i think sandbox-1.6-r1 should be good for stable.  only one
> minor compliant about 1.6, and that's fixed in 1.6-r1.

and this is in the process so if people found something wrong, please post it:
https://bugs.gentoo.org/265376
-mike