sandbox: fix the rules
1. `script` (used to fake the tty) requires write access to /dev/ptmx and /dev/ttys* 2. sandbox profile only accepts `[0-9]` instead of `\d`.
This commit is contained in:
		
							parent
							
								
									a80c2ae06f
								
							
						
					
					
						commit
						64c0927087
					
				@ -110,10 +110,11 @@ class Sandbox
 | 
			
		||||
      (debug deny) ; log all denied operations to /var/log/system.log
 | 
			
		||||
      <%= rules.join("\n") %>
 | 
			
		||||
      (allow file-write*
 | 
			
		||||
          (literal "/dev/ptmx")
 | 
			
		||||
          (literal "/dev/dtracehelper")
 | 
			
		||||
          (literal "/dev/null")
 | 
			
		||||
          (regex #"^/dev/fd/\\d+$")
 | 
			
		||||
          (regex #"^/dev/tty\\d*$")
 | 
			
		||||
          (regex #"^/dev/fd/[0-9]+$")
 | 
			
		||||
          (regex #"^/dev/ttys?[0-9]*$")
 | 
			
		||||
          )
 | 
			
		||||
      (deny file-write*) ; deny non-whitelist file write operations
 | 
			
		||||
      (allow default) ; allow everything else
 | 
			
		||||
 | 
			
		||||
		Loading…
	
	
			
			x
			
			
		
	
		Reference in New Issue
	
	Block a user