Add deny_signal method

Homebrew · Jul 15, 2024 · 1e38b8c · 1e38b8c
1 parent 7bf5b70
commit 1e38b8c
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 1 deletion.
diff --git a/Library/Homebrew/formula.rb b/Library/Homebrew/formula.rb
@@ -33,6 +33,7 @@
 require "extend/on_system"
 require "api"
 require "extend/api_hashable"
+require "sandbox"
 
 # A formula provides instructions and metadata for Homebrew to install a piece
 # of software. Every Homebrew formula is a {Formula}.

diff --git a/Library/Homebrew/formula_installer.rb b/Library/Homebrew/formula_installer.rb
@@ -943,6 +943,7 @@ def build
         sandbox.allow_fossil
         sandbox.allow_write_xcode
         sandbox.allow_write_cellar(formula)
+        sandbox.deny_signal(formula)
         sandbox.deny_all_network_except_pipe(error_pipe) unless formula.network_access_allowed?(:build)
         sandbox.exec(*args)
       else

diff --git a/Library/Homebrew/sandbox.rb b/Library/Homebrew/sandbox.rb
@@ -11,7 +11,7 @@ class Sandbox
   SANDBOX_EXEC = "/usr/bin/sandbox-exec"
   private_constant :SANDBOX_EXEC
 
-  SANDBOX_REDUCTIONS = [:allow_write_to_temp].freeze
+  SANDBOX_REDUCTIONS = [:allow_write_to_temp, :allow_signal].freeze
 
   sig { returns(T::Boolean) }
   def self.available?
@@ -68,6 +68,14 @@ def allow_write_temp_and_cache(formula = nil)
     allow_write_path HOMEBREW_CACHE
   end
 
+  sig { params(formula: T.nilable(Formula)).void }
+  def deny_signal(formula = nil)
+    puts "deny_signal:  #{formula&.reduced_sandbox&.include?(:allow_signal)}"
+    unless formula&.reduced_sandbox&.include?(:allow_signal)
+      add_rule allow: false, operation: "signal", filter: "target others"
+    end
+  end
+
   sig { void }
   def allow_cvs
     allow_write_path "#{Dir.home(ENV.fetch("USER"))}/.cvspass"