Improve flexibility of sandbox path rules, and make sandbox profile a struct that's easier to manage

Turn the stateless `Sandbox` enum into a `SandboxProfile` struct that's a bit more flexible: - there is a list of path rules allowing a mixed order of `writable`, `readonly`, and `noaccess` rules; this addresses an issue where writable directories were always applied after readable directories, preventing arrangements where, for example, a source directory inside the temporary directory was properly made readonly - the defaults are built into the initializer rather than a separate `strictness` parameter — this means that they can be queried once the SandboxProfile has been created and are expressed in terms of the choices available to all sandbox profiles - it's a bit more ergonomic (as a struct, it can be copied, mutated, and carried around in a property before being used), and an optional `SandboxProfile` can be used to indicate both whether or not to apply a profile and if so what to apply. Having the sandbox profile be a struct that generates the platform specifics as needed also could also provide a place with which to associate any cached/compiled representation for profiles that are largely static, for any platform that supports that. As cleanup, this commit also removes the pre-SwiftPM 5.3 specialities which were specific to running the package manifest in an interpreter rather than compiling and executing it. This functionality is no longer relevant since it isn't possible to run any manifest in the interpreter, no matter what tools version the package specifies. In this commit, the call sites have been adjusted so that they use the modified SandboxProfile API, but they still construct the profiles on-the-fly as before. A future change will make them instead be configured at an early point and then applied later when the sandboxed process is actually launched. Another future change could add the sandbox profile to `Process` as a property so that there is no API assumption that applying a sandbox necessarily involves just modifying the command line.

Author: abertelrud

Sources/Basics/CMakeLists.txt

@@ -1,6 +1,6 @@
 # This source file is part of the Swift open source project
 #
-# Copyright (c) 2014 - 2021 Apple Inc. and the Swift project authors
+# Copyright (c) 2014 - 2022 Apple Inc. and the Swift project authors
 # Licensed under Apache License v2.0 with Runtime Library Exception
 #
 # See http://swift.org/LICENSE.txt for license information
@@ -26,7 +26,7 @@ add_library(Basics
  NSLock+Extensions.swift
  Observability.swift
  SQLite.swift
- Sandbox.swift
+ SandboxProfile.swift
  String+Extensions.swift
  Triple+Extensions.swift
  SwiftVersion.swift

Sources/Basics/Sandbox.swift

@@ -0,0 +1,95 @@
+/*
+ This source file is part of the Swift.org open source project
+
+ Copyright (c) 2021 - 2022 Apple Inc. and the Swift project authors
+ Licensed under Apache License v2.0 with Runtime Library Exception
+
+ See http://swift.org/LICENSE.txt for license information
+ See http://swift.org/CONTRIBUTORS.txt for Swift project authors
+ */
+
+import Foundation
+import TSCBasic
+
+/// A sandbox profile representing the desired restrictions. The implementation can vary between platforms. Currently
+/// the only control a client has is in the path rules, but in the future there should also be options for controlling
+/// blocking of network access and process launching.
+public struct SandboxProfile: Equatable {
+ /// An ordered list of path rules, where the last rule to cover a particular path "wins". These will be resolved
+ /// to absolute paths at the time the profile is applied. They are applied after any of the implicit directories
+ /// referenced by other sandbox profile settings.
+ public var pathAccessRules: [PathAccessRule]
+
+ /// Represents a rule for access to a path and everything under it.
+ public enum PathAccessRule: Equatable {
+ case noaccess(AbsolutePath)
+ case readonly(AbsolutePath)
+ case writable(AbsolutePath)
+ }
+
+ /// Configures a SandboxProfile for blocking network access and writing to the file system except to specifically
+ /// permitted locations.
+ public init(_ pathAccessRules: [PathAccessRule] = []) {
+ self.pathAccessRules = pathAccessRules
+ }
+}
+
+extension SandboxProfile {
+ /// Applies the sandbox profile to the given command line (if the platform supports it), and returns the modified
+ /// command line. On platforms that don't support sandboxing, the unmodified command line is returned.
+ public func apply(to command: [String]) throws -> [String] {
+ #if os(macOS)
+ return ["/usr/bin/sandbox-exec", "-p", try self.generateMacOSSandboxProfileString()] + command
+ #else
+ // rdar://40235432, rdar://75636874 tracks implementing sandboxes for other platforms.
+ return command
+ #endif
+ }
+}
+
+// MARK: - macOS
+
+#if os(macOS)
+fileprivate extension SandboxProfile {
+ /// Private function that generates a Darwin sandbox profile suitable for passing to `sandbox-exec(1)`.
+ func generateMacOSSandboxProfileString() throws -> String {
+ var contents = "(version 1)\n"
+
+ // Deny everything by default.
+ contents += "(deny default)\n"
+
+ // Import the system sandbox profile.
+ contents += "(import \"system.sb\")\n"
+
+ // Allow operations on subprocesses.
+ contents += "(allow process*)\n"
+
+ // Allow reading any file that isn't protected by TCC or permissions (ideally we'd only allow a specific set
+ // of readable locations, and can maybe tighten this in the future).
+ contents += "(allow file-read*)\n"
+
+ // Apply customized rules for specific file system locations. Everything is readonly by default, so we just
+ // either allow or deny writing, in order. Later rules have precedence over earlier rules.
+ for rule in pathAccessRules {
+ switch rule {
+ case .noaccess(let path):
+ contents += "(deny file-* (subpath \(try resolveSymlinksAndQuotePath(path))))\n"
+ case .readonly(let path):
+ contents += "(deny file-write* (subpath \(try resolveSymlinksAndQuotePath(path))))\n"
+ case .writable(let path):
+ contents += "(allow file-write* (subpath \(try resolveSymlinksAndQuotePath(path))))\n"
+ }
+ }
+ return contents
+ }
+
+ /// Private helper function that resolves an AbsolutePath and returns it as a string quoted for use as a subpath
+ /// in a .sb sandbox profile.
+ func resolveSymlinksAndQuotePath(_ path: AbsolutePath) throws -> String {
+ return try "\"" + resolveSymlinks(path).pathString
+ .replacingOccurrences(of: "\\", with: "\\\\")
+ .replacingOccurrences(of: "\"", with: "\\\"")
+ + "\""
+ }
+}
+#endif

Sources/Basics/SandboxProfile.swift

@@ -554,7 +554,11 @@ public final class BuildOperation: PackageStructureDelegate, SPMBuildCore.BuildS
  // TODO: We need to also use any working directory, but that support isn't yet available on all platforms at a lower level.
  var commandLine = [command.configuration.executable.pathString] + command.configuration.arguments
  if !self.disableSandboxForPluginCommands {
- commandLine = try Sandbox.apply(command: commandLine, strictness: .writableTemporaryDirectory, writableDirectories: [pluginResult.pluginOutputDirectory])
+ // Allow access to the plugin's output directory as well as to the local temporary directory.
+ let sandboxProfile = SandboxProfile([
+ .writable(pluginResult.pluginOutputDirectory),
+ .writable(try self.fileSystem.tempDirectory)])
+ commandLine = try sandboxProfile.apply(to: commandLine)
  }
  let processResult = try TSCBasic.Process.popen(arguments: commandLine, environment: command.configuration.environment)
  let output = try processResult.utf8Output() + processResult.utf8stderrOutput()

Sources/Build/BuildOperation.swift

@@ -621,8 +621,13 @@ extension LLBuildManifestBuilder {
  let uniquedName = ([execPath.pathString] + command.configuration.arguments).joined(separator: "|")
  let displayName = command.configuration.displayName ?? execPath.basename
  var commandLine = [execPath.pathString] + command.configuration.arguments
+
+ // Apply the sandbox, if appropriate.
  if !self.disableSandboxForPluginCommands {
- commandLine = try Sandbox.apply(command: commandLine, strictness: .writableTemporaryDirectory, writableDirectories: [result.pluginOutputDirectory])
+ let sandboxProfile = SandboxProfile([
+ .writable(result.pluginOutputDirectory),
+ .writable(try self.fileSystem.tempDirectory)])
+ commandLine = try sandboxProfile.apply(to: commandLine)
  }
  manifest.addShellCmd(
  name: displayName + "-" + ByteString(encodingAsUTF8: uniquedName).sha256Checksum,

Sources/Build/LLBuildManifestBuilder.swift

@@ -635,10 +635,28 @@ public final class ManifestLoader: ManifestLoaderProtocol {
  // This provides some safety against arbitrary code execution when parsing manifest files.
  // We only allow the permissions which are absolutely necessary.
  if self.isManifestSandboxEnabled {
- let cacheDirectories = [self.databaseCacheDir, moduleCachePath].compactMap{ $0 }
- let strictness: Sandbox.Strictness = toolsVersion < .v5_3 ? .manifest_pre_53 : .default
  do {
- cmd = try Sandbox.apply(command: cmd, strictness: strictness, writableDirectories: cacheDirectories)
+ var sandbox = SandboxProfile()
+
+ // Allow writing inside the temporary directory.
+ try sandbox.pathAccessRules.append(.writable(localFileSystem.tempDirectory))
+
+ // Allow writing in the database cache directory, if we have one.
+ if let databaseCacheDir = self.databaseCacheDir {
+ sandbox.pathAccessRules.append(.writable(databaseCacheDir))
+ }
+
+ // Allow writing in the module cache path, if there is one.
+ if let moduleCachePath = moduleCachePath {
+ sandbox.pathAccessRules.append(.writable(moduleCachePath))
+ }
+
+ // But do not allow writing in the directory that contains the manifest, even if it is
+ // inside one of the otherwise writable directories.
+ sandbox.pathAccessRules.append(.readonly(manifestPath.parentDirectory))
+
+ // Finally apply the sandbox.
+ cmd = try sandbox.apply(to: cmd)
  } catch {
  return completion(.failure(error))
  }

Sources/PackageLoading/ManifestLoader.swift

@@ -423,7 +423,22 @@ public struct DefaultPluginScriptRunner: PluginScriptRunner, Cancellable {
  // Optionally wrap the command in a sandbox, which places some limits on what it can do. In particular, it blocks network access and restricts the paths to which the plugin can make file system changes. It does allow writing to temporary directories.
  if self.enableSandbox {
  do {
- command = try Sandbox.apply(command: command, strictness: .writableTemporaryDirectory, writableDirectories: writableDirectories + [self.cacheDir], readOnlyDirectories: readOnlyDirectories)
+ var sandbox = SandboxProfile()
+
+ // Allow writing in the temporary directory (whether or not it's overridden by TMPDIR).
+ sandbox.pathAccessRules.append(.writable(try self.fileSystem.tempDirectory))
+
+ // But prevent writing in any read-only directories.
+ sandbox.pathAccessRules.append(contentsOf: readOnlyDirectories.map{ .readonly($0) })
+
+ // But allow writing in any writable directories.
+ sandbox.pathAccessRules.append(contentsOf: writableDirectories.map{ .writable($0) })
+
+ // And always allow writing to the cache directory, even if it is inside one of the readonly directories.
+ sandbox.pathAccessRules.append(.writable(self.cacheDir))
+
+ // Apply the sandbox to the command.
+ command = try sandbox.apply(to: command)
  } catch {
  return callbackQueue.async {
  completion(.failure(error))