astil_forth/sandbox.sb at main · mitranim/astil_forth · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
; Relevant:
;
;   https://developer.apple.com/documentation/apple-silicon/porting-just-in-time-compilers-to-apple-silicon

(version 1)
(deny default)
(allow process-exec (literal (param "MAIN")))
(allow file-read*)
(allow file-write* (literal "/dev/null"))
(allow file-map-executable)
(allow dynamic-code-generation)
(allow sysctl-read)
(allow network* (remote ip "localhost:*"))
(allow network* (local ip "localhost:*"))

; Allow creation of one executable file. Used in testing.
(allow file-write-create (literal (param "OUT")))
(allow file-write-data (literal (param "OUT")))
(allow file-write-mode (literal (param "OUT")))

; Fixed executables used by debugging and tests.
(allow process-fork)
(allow signal (target children))
(allow process-exec (literal (param "LLVM_MC")))
(allow process-exec (literal (param "LLVM_SYMBOLIZER")))
(allow process-exec (literal (param "ATOS")))
(allow process-exec (literal (param "TEST_CAT")))
(allow process-exec (literal (param "TEST_ECHO")))
(allow process-exec (literal (param "TEST_FALSE")))
(allow process-exec (literal (param "TEST_GREP")))
(allow process-exec (literal (param "TEST_SLEEP")))

; Bots like to use this for scratch; also `/tmp` symlinks to this.
(allow file-read* (subpath "/private/tmp"))
(allow file-write* (subpath "/private/tmp"))
; (allow file-map-executable (subpath "/private/tmp"))
; (allow process-exec (subpath "/private/tmp"))