From 880e2ef3c4f9b09e69d1e7164e5ef09c026da833 Mon Sep 17 00:00:00 2001 From: Zac Medico Date: Fri, 28 Dec 2007 23:12:24 +0000 Subject: [PATCH] Bug #202697 - Add / to the default initial SANDBOX_READ in order to avoid a situation where attempts to read arbitrary files trigger sandbox violations. svn path=/main/trunk/; revision=9085 --- bin/ebuild.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/ebuild.sh b/bin/ebuild.sh index d65ff69e9..51b0b5f2f 100755 --- a/bin/ebuild.sh +++ b/bin/ebuild.sh @@ -9,7 +9,7 @@ PORTAGE_PYM_PATH="${PORTAGE_PYM_PATH:-/usr/lib/portage/pym}" SANDBOX_PREDICT="${SANDBOX_PREDICT}:/proc/self/maps:/dev/console:/dev/random" export SANDBOX_PREDICT="${SANDBOX_PREDICT}:${PORTAGE_PYM_PATH}:${PORTAGE_DEPCACHEDIR}" export SANDBOX_WRITE="${SANDBOX_WRITE}:/dev/shm:/dev/stdout:/dev/stderr:${PORTAGE_TMPDIR}" -export SANDBOX_READ="${SANDBOX_READ}:/dev/shm:/dev/stdin:${PORTAGE_TMPDIR}" +export SANDBOX_READ="${SANDBOX_READ}:/:/dev/shm:/dev/stdin:${PORTAGE_TMPDIR}" # Don't use sandbox's BASH_ENV for new shells because it does # 'source /etc/profile' which can interfere with the build # environment by modifying our PATH. -- 2.26.2