| ;; Sandbox profile for try executions so they can only write/remove stuff |
| ;; within their workspace directory (TODO: Restrict reading too) |
| (version 1) |
| (allow default) |
| |
| (define (home-regex home-relative-regex) |
| (regex (string-append "^" (regex-quote (param "HOME")) home-relative-regex))) |
| (define (home-subpath home-relative-subpath) |
| (subpath (string-append (param "HOME") home-relative-subpath))) |
| (define (home-literal home-relative-literal) |
| (literal (string-append (param "HOME") home-relative-literal))) |
| |
| (deny file-write*) |
| (allow file-write* |
| (subpath (param "WORKSPACE")) |
| ; temp files/dirs |
| (subpath "/private/tmp") |
| (subpath "/private/var/folders") |
| (subpath "/private/var/tmp") |
| (home-subpath "/Library/Caches/pip") |
| ; for /dev/null, /dev/dtracehelper possibly others |
| (subpath "/dev") |
| ) |
| |
| ;; TODO: Restrict reading to a minimum. Something like: |
| ;;(deny file-read*) |
| ;;(allow file-read* |
| ;; (subpath "/bin") |
| ;; (subpath "/sbin") |
| ;; (subpath "/usr/bin") |
| ;; (subpath "/usr/local/bin") |
| ;; (subpath "/Applications/Xcode.app") |
| ;;) |
