Re: completed sandboxing support for fink

Daniel and Alexander,
    Just a heads up that I have found a proper solution to the FSF gcc
bootstrap and compiler failures under an Apple sandbox which denies
file access to /usr/local.

https://gcc.gnu.org/ml/gcc-patches/2016-11/msg00521.html

This approach avoids using --with-local--prefix while retains the
functionality of the compilers with regard to builds using /usr/local
outside of the sandbox.

I've updated the gcc5-5.4.0-3 and gcc6-6.2.0-3 sandbox friendly
packaging on tracker at
https://sourceforge.net/p/fink/package-submissions/4834/ to just use

 # make remove_duplicates() sandbox friendly
perl -pi.bak -e "s|if \(errno \!\= ENOENT\)|if \(\(errno \!\= ENOENT\)
\&\& \(errno \!\= EPERM\)\)|g" gcc/incpath.c

in the PatchScript.

I've also update the proposed lvm-gcc42-2336.11-8/18/28/38 on tracker
at https://sourceforge.net/p/fink/package-submissions/4835/ to just
use

# make remove_duplicates() sandbox friendly
perl -pi.bak -e "s|if \(errno \!\= ENOENT\)|if \(\(errno \!\= ENOENT\)
\&\& \(errno \!\= EPERM\)\)|g" %b/gcc/c-incpath.c

So the sandbox changes are pretty much ready to land. The only
remaining enhancement that I am still exploring (but isn't really a
blocker) is adding support for a BuildSandbox field to the fink Info
file syntax so the we can disable sandboxing at the info file level
rather than just with UseSandbox in %p/etc/fink.conf and
--build-in-sandbox/--no-build-in-sandbox.
               Jack


On Sat, Nov 5, 2016 at 2:33 PM, Jack Howarth <[email protected]> wrote:
> Daniel and Alexander,
>
>      An enhanced version of the previous patch which adds the installation
> of a fink.sb.5 man page.
>
>                  Jack
>
> On Sat, Nov 5, 2016 at 8:34 AM, Jack Howarth <[email protected]>
> wrote:
>>
>> Daniel and Alexander,
>>        The pull request to add sandboxing support is now completed on fink
>> git against master at https://github.com/fink/fink/pull/135/files, but
>> upstream master seem to have unrelated bootstrap issues. However, the
>> attached fink_sandboxing.diff applies these same changes onto the current
>> fink-0.41.0 and bootstraps cleanly.
>>        The current sandbox changes provides configuration of fink.conf to
>> add the desired state for the new UseSandbox setting in fink.conf. The
>> changes also provide runtime options of --build-in-sandbox and
>> --no-build-in-sandbox to override the UseSandbox setting in fink.conf.
>>         The sandboxing of fink can easily be verified with 'ps -le | grep
>> sandbox-exec' during a fink build. Which will show...
>>
>>    0  4232  4084     4106   0  31  0  2455672   3064 -      S+
>> 0 ttys027    0:00.01 sudo -u fink-bld sandbox-exec -p (version 1) ^J(allow
>> default) ^J(deny file* ^J^I(subpath "/usr/local")^J^I(subpath
>> "/opt/local")^J)^J env CCACHE_DIR=/sw/var/ccache
>> CFLAGS=-D_DARWIN_NO_64_BIT_INODE -O2 -g -Wall CPPFLAGS=-I/sw/include
>> HOME=/tmp/fink-build-HOME.RCOdx6VWFB
>> INFOPATH=/sw/share/info:/sw/info:/usr/share/info LDFLAGS=-L/sw/lib
>> MACOSX_DEPLOYMENT_TARGET=10.11 MAKEFLAGS=-j8
>> MANPATH=/sw/share/man:/usr/share/man:/Applications/Xcode.app/Contents/Developer/usr/share/man:/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/share/man:/sw/lib/perl5/5.18.2/man
>> PATH=/sw/var/lib/fink/path-prefix-libcxx:/sw/var/lib/fink/path-prefix-clang:/sw/bin:/sw/sbin:/bin:/usr/bin:/sbin:/usr/sbin:/opt/X11/bin
>> PERL5LIB=/sw/lib/perl5:/sw/lib/perl5/darwin
>> PWD=/sw/src/fink.build/cvs-1.12.13-18 SHLVL=2 TERM=xterm-256color
>> __CFPREFERENCES_AVOID_DAEMON=1 sh -c /tmp/fink.5o7aZ
>>
>>
>> for 'UseSandbox: true"' in fink.conf or --build-in-sandbox on the fink
>> command line. The usage of  sandbox-exec won't be seen for either
>> 'UseSandbox: false"' in fink.conf or --no-build-in-sandbox on the fink
>> command line.
>>                Jack
>
>

------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today. http://sdm.link/xeonphi
_______________________________________________
Fink-devel mailing list
[email protected]
List archive:
http://news.gmane.org/gmane.os.apple.fink.devel
Subscription management:
https://lists.sourceforge.net/lists/listinfo/fink-devel