{"action":"created","issue":{"url":"https://api.github.com/repos/Homebrew/homebrew/issues/37552","labels_url":"https://api.github.com/repos/Homebrew/homebrew/issues/37552/labels{/name}","comments_url":"https://api.github.com/repos/Homebrew/homebrew/issues/37552/comments","events_url":"https://api.github.com/repos/Homebrew/homebrew/issues/37552/events","html_url":"https://github.com/Homebrew/homebrew/issues/37552","id":60457951,"number":37552,"title":"[idea] install formula inside real sandbox","user":{"login":"xu-cheng","id":3105373,"avatar_url":"https://avatars.githubusercontent.com/u/3105373?v=3","gravatar_id":"","url":"https://api.github.com/users/xu-cheng","html_url":"https://github.com/xu-cheng","followers_url":"https://api.github.com/users/xu-cheng/followers","following_url":"https://api.github.com/users/xu-cheng/following{/other_user}","gists_url":"https://api.github.com/users/xu-cheng/gists{/gist_id}","starred_url":"https://api.github.com/users/xu-cheng/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xu-cheng/subscriptions","organizations_url":"https://api.github.com/users/xu-cheng/orgs","repos_url":"https://api.github.com/users/xu-cheng/repos","events_url":"https://api.github.com/users/xu-cheng/events{/privacy}","received_events_url":"https://api.github.com/users/xu-cheng/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Homebrew/homebrew/labels/features","name":"features","color":"DDDDDD"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2015-03-10T06:45:51Z","updated_at":"2015-03-10T12:31:15Z","closed_at":null,"body":"Pre Script: I create this issue mainly for keeping the note.\r\n\r\nAs we all know, Homebrew allows arbitrary code execution. Also, we sometimes find some formulae fail to keep all installation files inside `prefix`. This is because our sandbox model is just a simple `--prefix`.\r\n\r\nI hope we can improve Homebrew security significantly. (This is the same reason I raised the issue [to let Homebrew offer GPG key](https://github.com/Homebrew/homebrew/issues/37074)). And the solution is obviously. We need a **real** sandbox.\r\n\r\nI didn't know how to implement it for long time. Util Now. I find Apple does offer a way to use OS X's sandbox. Namely `sandbox-exec` command. [Here](https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/sandbox-exec.1.html) is the manual page. Using it, we can control what a formula can read and write during the installation. All we need to do is to define a sandbox profile file which looks like [this](https://github.com/pansen/macos-sandbox-profiles/blob/master/skype.sb).\r\n\r\nI still know little about this tool and will gather more information which eventually leads to implementation. \r\n"},"comment":{"url":"https://api.github.com/repos/Homebrew/homebrew/issues/comments/78044009","html_url":"https://github.com/Homebrew/homebrew/issues/37552#issuecomment-78044009","issue_url":"https://api.github.com/repos/Homebrew/homebrew/issues/37552","id":78044009,"user":{"login":"xu-cheng","id":3105373,"avatar_url":"https://avatars.githubusercontent.com/u/3105373?v=3","gravatar_id":"","url":"https://api.github.com/users/xu-cheng","html_url":"https://github.com/xu-cheng","followers_url":"https://api.github.com/users/xu-cheng/followers","following_url":"https://api.github.com/users/xu-cheng/following{/other_user}","gists_url":"https://api.github.com/users/xu-cheng/gists{/gist_id}","starred_url":"https://api.github.com/users/xu-cheng/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xu-cheng/subscriptions","organizations_url":"https://api.github.com/users/xu-cheng/orgs","repos_url":"https://api.github.com/users/xu-cheng/repos","events_url":"https://api.github.com/users/xu-cheng/events{/privacy}","received_events_url":"https://api.github.com/users/xu-cheng/received_events","type":"User","site_admin":false},"created_at":"2015-03-10T12:31:15Z","updated_at":"2015-03-10T12:31:15Z","body":"A document I found about the sandbox profile file syntax: http://reverse.put.as/wp-content/uploads/2011/09/Apple-Sandbox-Guide-v1.0.pdf"}}