From 2b547583a3d147ad06ae26bbc1bcbaf8ce0ce9fb Mon Sep 17 00:00:00 2001
From: Mike McQuaid <mike@mikemcquaid.com>
Date: Tue, 13 Dec 2016 00:13:20 +0000
Subject: [PATCH] postinstall: don't allow writes to prefix itself.

Only the top-level directories inside it. We don't want formulae writing
random junk in e.g. `/usr/local` even in `postinstall`.
---
 Library/Homebrew/cmd/postinstall.rb | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Library/Homebrew/cmd/postinstall.rb b/Library/Homebrew/cmd/postinstall.rb
index e8855b09e5..8808a2602d 100644
--- a/Library/Homebrew/cmd/postinstall.rb
+++ b/Library/Homebrew/cmd/postinstall.rb
@@ -37,8 +37,10 @@ module Homebrew
         sandbox.allow_write_log(formula)
         sandbox.allow_write_xcode
         sandbox.deny_write_homebrew_repository
-        sandbox.allow_write_path HOMEBREW_PREFIX
         sandbox.allow_write_cellar(formula)
+        Keg::TOP_LEVEL_DIRECTORIES.each do |dir|
+          sandbox.allow_write_path "#{HOMEBREW_PREFIX}/#{dir}"
+        end
         sandbox.exec(*args)
       else
         exec(*args)