Add a simple Servo sandbox profile for Mac.

This does not yet enter the sandbox.
This commit is contained in:
Patrick Walton 2012-08-21 17:12:27 -07:00
parent 46f47e7a73
commit 90b59b1f50

29
src/etc/servo.sb Normal file
View file

@ -0,0 +1,29 @@
(version 1)
(deny default)
(allow file*
(literal "/dev/dtracehelper")
(literal "/dev/urandom")
(literal "/dev/null"))
(allow file-read*
(subpath ""))
(allow file-write*
(regex #"^/Users/[^/]+/Library/Autosave Information")
(subpath "/private/var"))
; This is unfortunate...
(allow process-exec
(regex #"/servo$"))
(allow sysctl-read)
(allow sysctl-write)
(allow ipc-posix-shm)
(allow process-fork)
(allow mach-lookup)
(allow network-outbound)
(debug deny)