hermit-build/sandbox.sb at master · cashapp/hermit-build · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
(version 1)
(deny default)
(import "/System/Library/Sandbox/Profiles/bsd.sb")

;(allow network* (local ip "localhost:*"))
;(allow network* (remote ip "localhost:*"))
(allow network* (remote unix-socket))

(system-network)

(allow mach-lookup
  (global-name "com.apple.diagnosticd")
  (global-name "com.apple.system.logger"))

(allow file-read*)
(deny file-read*
  (subpath "/opt/")
  (subpath "/usr/local/")
)

(deny file-write*)
(allow file-write*
  (subpath "/dev/")
  (subpath "/tmp/")
  (subpath (param "HERMIT_STATE_DIR"))
  (subpath (param "TMPDIR"))
  (subpath (param "BUILD_DIR"))
)

(allow process-exec*)
(deny process-exec*
  (subpath "/opt/")
  (subpath "/usr/local/")
)

;; Allow brew installed `make`
(allow file-read*
  (subpath "/opt/homebrew/opt/make/")
  (subpath "/opt/homebrew/Cellar/make/")
  (subpath "/usr/local/opt/make/")
  (subpath "/usr/local/Cellar/make/")
)
(allow process-exec*
  (subpath "/opt/homebrew/opt/make/")
  (subpath "/opt/homebrew/Cellar/make/")
  (subpath "/usr/local/opt/make/")
  (subpath "/usr/local/Cellar/make/")
)

(allow process-fork)