commit: 001a95fb06aea725642397db09584a05c39246c9 Author: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org> AuthorDate: Fri Oct 23 07:07:55 2020 +0000 Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org> CommitDate: Thu Mar 11 08:02:21 2021 +0000 URL: https://gitweb.gentoo.org/proj/sandbox.git/commit/?id=001a95fb
etc/sandbox.conf: allow /usr/tmp/ for write In bug #737220 sandbox was denying write access to /usr/tmp (a symlink to /var/tmp) for statically linked binaries. It happens because erealpath() helper conservatively does not resolve any symlink for external traced processes (to avoid symlink confusion via /proc/ that could refer to tracer and not tracee). Instead of fixing erealpath() to handle more cases of symlinks let's just allow /usr/tmp as if it was /var/tmp. Reported-by: Kirill Chibisov Bug: https://bugs.gentoo.org/737220 Signed-off-by: Sergei Trofimovich <slyfox <AT> gentoo.org> etc/sandbox.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/sandbox.conf b/etc/sandbox.conf index 5f09ee4..2501e11 100644 --- a/etc/sandbox.conf +++ b/etc/sandbox.conf @@ -86,7 +86,7 @@ SANDBOX_WRITE="/dev/console:/dev/tty:/dev/vc/:/dev/pty:/dev/tts" # Device filesystems SANDBOX_WRITE="/dev/ptmx:/dev/pts/:/dev/shm" # Tempory storage -SANDBOX_WRITE="/tmp/:/var/tmp/" +SANDBOX_WRITE="/tmp/:/var/tmp/:/usr/tmp/" # Needed for shells SANDBOX_WRITE="${HOME}/.bash_history"
