diff options
| author | Daiderd Jordan <daiderd@gmail.com> | 2020-03-20 22:12:30 +0100 |
|---|---|---|
| committer | Daiderd Jordan <daiderd@gmail.com> | 2020-03-20 22:12:30 +0100 |
| commit | 2e9bc1245c125f96ce53210751940067d4cf3f1c (patch) | |
| tree | d560d5eeeabc2cd09e3f7992eb67b3960db8b0ec | |
| parent | f6c122aaeb08cc3d9e89465b440b25c7e0c87d9e (diff) | |
sandbox: fix /bin/sh on catalina
Sadly 10.15 changed /bin/sh to a shim which executes bash, this means it
can't be used anymore without also opening up the sandbox to allow bash.
Failed to exec /bin/bash as variant for /bin/sh (1: Operation not permitted).
| -rw-r--r-- | src/libstore/globals.cc | 2 | ||||
| -rw-r--r-- | src/libstore/sandbox-defaults.sb | 4 |
2 files changed, 5 insertions, 1 deletions
diff --git a/src/libstore/globals.cc b/src/libstore/globals.cc index 1a2fcbe22..7e97f3c22 100644 --- a/src/libstore/globals.cc +++ b/src/libstore/globals.cc @@ -64,7 +64,7 @@ Settings::Settings() /* chroot-like behavior from Apple's sandbox */ #if __APPLE__ - sandboxPaths = tokenizeString<StringSet>("/System/Library/Frameworks /System/Library/PrivateFrameworks /bin/sh /private/tmp /private/var/tmp /usr/lib"); + sandboxPaths = tokenizeString<StringSet>("/System/Library/Frameworks /System/Library/PrivateFrameworks /bin/sh /bin/bash /private/tmp /private/var/tmp /usr/lib"); allowedImpureHostPrefixes = tokenizeString<StringSet>("/System/Library /usr/lib /dev /bin/sh"); #endif } diff --git a/src/libstore/sandbox-defaults.sb b/src/libstore/sandbox-defaults.sb index c09ce1729..351037822 100644 --- a/src/libstore/sandbox-defaults.sb +++ b/src/libstore/sandbox-defaults.sb @@ -91,3 +91,7 @@ (literal "/etc") (literal "/var") (literal "/private/var/tmp")) + +; This is used by /bin/sh on macOS 10.15 and later. +(allow file* + (literal "/private/var/select/sh")) |