Re: [gentoo-security] sandbox

[Kerin Millar]

On Tue, 6 Apr 2004 18:20:43 +0000
Dadi <thewalrus@××××××××××××××.org> wrote:

> Hello all,
> I am new to gentoo and I was wondering what is this 'sandbox(ing)'.
> I couldn't find anything valuable on google.
> I heard it has something to do with security(hopefully I send to the right group).

The entire build process for a given package is conducted within a sandbox. Typically, the build process would imply the classic ./configure, make, make install routine.

The actual notion is not dissimilar to that of a chroot. If (and _only_ if) the build process completes in its entirety are the resultant binaries/files "merged" into your main filesystem. If at any time the build process triggers an action which attempts to write outside of the sandbox, then that is considered to be an access violation, and will trigger an exception in Portage. The sandboxes are created under a directory following the name of the package, beneath /var/tmp/portage (by default).

The general idea is to stop a build process from being able to branch out and affect any part of your filesystem it so chooses, whether maliciously or otherwise. It also avoids the possible situation where your filesystem may end up being cluttered with redundant files after a failed or abortive build process.

Portage retains control over the merging process after a successful build to ensure that redundant files are removed where necessary (in the case of an upgrade) and that important files are not wantonly clobbered (notably, those under /etc or other directories which contain the file ".keep" if I recall correctly).

> All I know is when I have FEATURES="-sandbox", openoffice 1.1.1 compiles. Otherwise, not.

That should be directed toward bugs.gentoo.org with as much information as you are able to supply (having checked for a duplicate bug report first ;). Some Makefiles are really unpleasant and need to be patched to avoid silly behaviour.

--Kerin Millar

--
gentoo-security@g.o mailing list