{"action":"created","issue":{"url":"https://api.github.com/repos/Homebrew/homebrew/issues/37552","labels_url":"https://api.github.com/repos/Homebrew/homebrew/issues/37552/labels{/name}","comments_url":"https://api.github.com/repos/Homebrew/homebrew/issues/37552/comments","events_url":"https://api.github.com/repos/Homebrew/homebrew/issues/37552/events","html_url":"https://github.com/Homebrew/homebrew/issues/37552","id":60457951,"number":37552,"title":"[idea] install formula inside real sandbox","user":{"login":"xu-cheng","id":3105373,"avatar_url":"https://avatars.githubusercontent.com/u/3105373?v=3","gravatar_id":"","url":"https://api.github.com/users/xu-cheng","html_url":"https://github.com/xu-cheng","followers_url":"https://api.github.com/users/xu-cheng/followers","following_url":"https://api.github.com/users/xu-cheng/following{/other_user}","gists_url":"https://api.github.com/users/xu-cheng/gists{/gist_id}","starred_url":"https://api.github.com/users/xu-cheng/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xu-cheng/subscriptions","organizations_url":"https://api.github.com/users/xu-cheng/orgs","repos_url":"https://api.github.com/users/xu-cheng/repos","events_url":"https://api.github.com/users/xu-cheng/events{/privacy}","received_events_url":"https://api.github.com/users/xu-cheng/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Homebrew/homebrew/labels/features","name":"features","color":"DDDDDD"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-03-10T06:45:51Z","updated_at":"2015-03-10T11:45:59Z","closed_at":null,"body":"Pre Script: I create this issue mainly for keeping the note.\r\n\r\nAs we all know, Homebrew allows arbitrary code execution. Also, we sometimes find some formulae fail to keep all installation files inside `prefix`. This is because our sandbox model is just a simple `--prefix`.\r\n\r\nI hope we can improve Homebrew security significantly. (This is the same reason I raised the issue [to let Homebrew offer GPG key](https://github.com/Homebrew/homebrew/issues/37074)). And the solution is obviously. We need a **real** sandbox.\r\n\r\nI didn't know how to implement it for long time. Util Now. I find Apple does offer a way to use OS X's sandbox. Namely `sandbox-exec` command. [Here](https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/sandbox-exec.1.html) is the manual page. Using it, we can control what a formula can read and write during the installation. All we need to do is to define a sandbox profile file which looks like [this](https://github.com/pansen/macos-sandbox-profiles/blob/master/skype.sb).\r\n\r\nI still know little about this tool and will gather more information which eventually leads to implementation. \r\n"},"comment":{"url":"https://api.github.com/repos/Homebrew/homebrew/issues/comments/78038519","html_url":"https://github.com/Homebrew/homebrew/issues/37552#issuecomment-78038519","issue_url":"https://api.github.com/repos/Homebrew/homebrew/issues/37552","id":78038519,"user":{"login":"DomT4","id":6998367,"avatar_url":"https://avatars.githubusercontent.com/u/6998367?v=3","gravatar_id":"","url":"https://api.github.com/users/DomT4","html_url":"https://github.com/DomT4","followers_url":"https://api.github.com/users/DomT4/followers","following_url":"https://api.github.com/users/DomT4/following{/other_user}","gists_url":"https://api.github.com/users/DomT4/gists{/gist_id}","starred_url":"https://api.github.com/users/DomT4/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DomT4/subscriptions","organizations_url":"https://api.github.com/users/DomT4/orgs","repos_url":"https://api.github.com/users/DomT4/repos","events_url":"https://api.github.com/users/DomT4/events{/privacy}","received_events_url":"https://api.github.com/users/DomT4/received_events","type":"User","site_admin":false},"created_at":"2015-03-10T11:45:58Z","updated_at":"2015-03-10T11:45:58Z","body":"Yeah, big thumbs up from me. I've played around with ` sandbox-exec ` a bit in the past, and it can be a little temperamental, but with enough TLC it should be workable.\r\n\r\nOne thing I would like to do, which could tie into this, is to set ` ENV[\"HOME] ` to our buildpath for *all* build processes similar to how we do the ` test do ` blocks. This would eradicate a lot of the problems we've had with ` curlrc ` files, ` npm ` config files in the home directory, and other various things. The flipside of that is we'd need to ensure anything installed the temporary home directory is put back into the actual ` HOME ` after compile - Some stuff installs important configuration files in the ` $HOME ` during the compile process.\r\n\r\nA 'proper' sandbox certainly gets a :+1: from me, and I'll help anywhere I can."}}