bug#45198: 28.0.50; Sandbox mode

["Mattias Engdegård" <mattiase@acm.org>]

[-- Attachment #1: Type: text/plain, Size: 279 bytes --]

Here is a bare-bones macOS sandbox implementation. In practice, it would probably be called in an --eval argument to guard anything executed later. It should be sufficient for the typical untrusted flymake checker running in an Emacs subprocess and printing to stdout/stderr.


[-- Attachment #2: macos-sandbox.diff --]
[-- Type: application/octet-stream, Size: 1986 bytes --]

diff --git a/lisp/subr.el b/lisp/subr.el
index ed0d6978d0..729c4ac70b 100644
--- a/lisp/subr.el
+++ b/lisp/subr.el
@@ -6036,4 +6036,18 @@ internal--format-docstring-line
 This is intended for internal use only."
   (internal--fill-string-single-line (apply #'format string objects)))
 
+(defun sandbox-enter (dirs)
+  "Enter a sandbox only permitting reading files under DIRS.
+DIRS is a list of directory names.  Most other operations such as
+writing files and network access are disallowed.
+Existing open descriptors can still be used freely."
+  (unless (eq system-type 'darwin)
+    (error "not implemented on this platform"))
+  (macos-sandbox-init
+   (concat "(version 1)\n"
+           "(deny default)\n"
+           (mapconcat (lambda (dir)
+                        (format "(allow file-read* (subpath %S))\n" dir))
+                      dirs ""))))
+
 ;;; subr.el ends here
diff --git a/src/sysdep.c b/src/sysdep.c
index eeb9d18494..3b2da8c637 100644
--- a/src/sysdep.c
+++ b/src/sysdep.c
@@ -4054,8 +4054,33 @@ str_collate (Lisp_Object s1, Lisp_Object s2,
 }
 #endif	/* WINDOWSNT */
 
+#ifdef DARWIN_OS
+
+/* This call is not in the platform header files.  You just Have to Know. */
+int sandbox_init_with_parameters(const char *profile,
+                                 uint64_t flags,
+                                 const char *const parameters[],
+                                 char **errorbuf);
+
+DEFUN ("macos-sandbox-init", Fmacos_sandbox_init, Smacos_sandbox_init,
+       1, 1, 0,
+       doc: /* Enter a sandbox whose permitted access is curtailed by PROFILE.
+Already open descriptors can be used freely. */)
+  (Lisp_Object profile)
+{
+  char *err = NULL;
+  if (sandbox_init_with_parameters (SSDATA (profile), 0, NULL, &err) != 0)
+    error ("sandbox error: %s", err);
+  return Qnil;
+}
+
+#endif	/* DARWIN_OS */
+
 void
 syms_of_sysdep (void)
 {
   defsubr (&Sget_internal_run_time);
+#ifdef DARWIN_OS
+  defsubr (&Smacos_sandbox_init);
+#endif
 }