On Tuesday 31 March 2009 07:52:24 Mike Frysinger wrote: > partly because the QA notices about untraceable static binaries that > sandbox-1.6 emits, but mostly because i wanted to bust solar's balls, i did > a mini hack fest the other nite and added ptrace() support into sandbox for > static binaries. seems to work for me, but if someone notices something > new and freaky, you've been warned!
some notes from the wild: - some packages might fail now that didnt before due to /etc/ld.so.* violations. no, this isnt a bug in sandbox. it was a bug that older sandboxes didnt catch it. every case ive seen so far means the package is wrongly running `ldconfig` on the entire tree during src_install(). this is a pointless waste of cpu time, i/o time, hawaii time, and other crap. disable it in your package. - tracing of multilib is supported (so 32bit x86 on 64bit x86_64 host) - parisc and blackfin are now supported - static binaries that violate sandbox are killed immediately. this is different from normal sandbox where the application is returned an error and it keeps on running. this is due to ptrace limitations where there is no way for the parent doing the tracing to tell the traced child to skip execution of the next syscall. our choices as the tracer are (1) let it happen and modify the syscall return or (2) kill it immediately. since (1) allows the syscall to occur (say something like unlink(/foo/bar), that clearly isnt acceptable. unless i missed something in ptrace in which case people should point it out to me. > side note, i think sandbox-1.6-r1 should be good for stable. only one > minor compliant about 1.6, and that's fixed in 1.6-r1. and this is in the process so if people found something wrong, please post it: https://bugs.gentoo.org/265376 -mike
signature.asc
Description: This is a digitally signed message part.
