Improve flexibility of sandbox path rules, and make sandbox profile a struct that's easier to manage

Turn the stateless `Sandbox` enum into a `SandboxProfile` struct that's a bit more flexible:

- there is a list of path rules allowing a mixed order of `writable`, `readonly`, and `noaccess` rules; this addresses an issue where writable directories were always applied after readable directories, preventing arrangements where, for example, a source directory inside the temporary directory was properly made readonly

- the defaults are built into the initializer rather than a separate `strictness` parameter — this means that they can be queried once the SandboxProfile has been created and are expressed in terms of the choices available to all sandbox profiles

- it's a bit more ergonomic (as a struct, it can be copied, mutated, and carried around in a property before being used), and an optional `SandboxProfile` can be used to indicate both whether or not to apply a profile and if so what to apply.

Having the sandbox profile be a struct that generates the platform specifics as needed also could also provide a place with which to associate any cached/compiled representation for profiles that are largely static, for any platform that supports that.

As cleanup, this commit also removes the pre-SwiftPM 5.3 specialities which were specific to running the package manifest in an interpreter rather than compiling and executing it.  This functionality is no longer relevant since it isn't possible to run any manifest in the interpreter, no matter what tools version the package specifies.

In this commit, the call sites have been adjusted so that they use the modified SandboxProfile API, but they still construct the profiles on-the-fly as before.  A future change will make them instead be configured at an early point and then applied later when the sandboxed process is actually launched.

Note also that the existing call sites still pass `/tmp` because that it was the sandbox has allowed up until now.  A separate PR will deal with whether or not allowing writes to `/tmp` is apprporiate.

Another future change could add the sandbox profile to `Process` as a property so that there is no API assumption that applying a sandbox necessarily involves just modifying the command line.

Author: abertelrud

CHANGELOG.md

@@ -11,6 +11,10 @@ Swift 5.8
 
   In packages that specify resources using tools version 5.8 or later, the generated resource bundle accessor will import `Foundation.Bundle` for its own implementation only. _Clients_ of such packages therefore no longer silently import `Foundation`, preventing inadvertent use of Foundation extensions to standard library APIs, which helps to avoid unexpected code size increases.
 
+* [#5857]
+
+  When running a compiler package manifest, the sandbox on Darwin platforms no longer allows writing to the compiler's module cache directories. These directories were originally writable when running Swift package manifests in the interpreter, but the Swift interpreter has not been used for package manifests (regardless of tools version) for several releases now, so this should have no noticeable impact on existing packages.
+
 Swift 5.7
 -----------
 

Sources/Basics/CMakeLists.txt

@@ -27,7 +27,7 @@ add_library(Basics
   NSLock+Extensions.swift
   Observability.swift
   SQLite.swift
-  Sandbox.swift
+  SandboxProfile.swift
   String+Extensions.swift
   Triple+Extensions.swift
   SwiftVersion.swift

Sources/Basics/Sandbox.swift

@@ -0,0 +1,95 @@
+/*
+ This source file is part of the Swift.org open source project
+
+ Copyright (c) 2021 - 2022 Apple Inc. and the Swift project authors
+ Licensed under Apache License v2.0 with Runtime Library Exception
+
+ See http://swift.org/LICENSE.txt for license information
+ See http://swift.org/CONTRIBUTORS.txt for Swift project authors
+ */
+
+import Foundation
+import TSCBasic
+
+/// A sandbox profile representing the desired restrictions. The implementation can vary between platforms. Currently
+/// the only control a client has is in the path rules, but in the future there should also be options for controlling
+/// blocking of network access and process launching.
+public struct SandboxProfile: Equatable {
+    /// An ordered list of path rules, where the last rule to cover a particular path "wins". These will be resolved
+    /// to absolute paths at the time the profile is applied. They are applied after any of the implicit directories
+    /// referenced by other sandbox profile settings.
+    public var pathAccessRules: [PathAccessRule]
+
+    /// Represents a rule for access to a path and everything under it.
+    public enum PathAccessRule: Equatable {
+        case noaccess(AbsolutePath)
+        case readonly(AbsolutePath)
+        case writable(AbsolutePath)
+    }
+
+    /// Configures a SandboxProfile for blocking network access and writing to the file system except to specifically
+    /// permitted locations.
+    public init(_ pathAccessRules: [PathAccessRule] = []) {
+        self.pathAccessRules = pathAccessRules
+    }
+}
+
+extension SandboxProfile {
+    /// Applies the sandbox profile to the given command line (if the platform supports it), and returns the modified
+    /// command line. On platforms that don't support sandboxing, the unmodified command line is returned.
+    public func apply(to command: [String]) throws -> [String] {
+        #if os(macOS)
+        return ["/usr/bin/sandbox-exec", "-p", try self.generateMacOSSandboxProfileString()] + command
+        #else
+        // rdar://40235432, rdar://75636874 tracks implementing sandboxes for other platforms.
+        return command
+        #endif
+    }
+}
+
+// MARK: - macOS
+
+#if os(macOS)
+fileprivate extension SandboxProfile {
+    /// Private function that generates a Darwin sandbox profile suitable for passing to `sandbox-exec(1)`.
+    func generateMacOSSandboxProfileString() throws -> String {
+        var contents = "(version 1)\n"
+
+        // Deny everything by default.
+        contents += "(deny default)\n"
+
+        // Import the system sandbox profile.
+        contents += "(import \"system.sb\")\n"
+
+        // Allow operations on subprocesses.
+        contents += "(allow process*)\n"
+
+        // Allow reading any file that isn't protected by TCC or permissions (ideally we'd only allow a specific set
+        // of readable locations, and can maybe tighten this in the future).
+        contents += "(allow file-read*)\n"
+
+        // Apply customized rules for specific file system locations. Everything is readonly by default, so we just
+        // either allow or deny writing, in order. Later rules have precedence over earlier rules.
+        for rule in pathAccessRules {
+            switch rule {
+            case .noaccess(let path):
+                contents += "(deny file-* (subpath \(try resolveSymlinksAndQuotePath(path))))\n"
+            case .readonly(let path):
+                contents += "(deny file-write* (subpath \(try resolveSymlinksAndQuotePath(path))))\n"
+            case .writable(let path):
+                contents += "(allow file-write* (subpath \(try resolveSymlinksAndQuotePath(path))))\n"
+            }
+        }
+        return contents
+    }
+
+    /// Private helper function that resolves an AbsolutePath and returns it as a string quoted for use as a subpath
+    /// in a .sb sandbox profile.
+    func resolveSymlinksAndQuotePath(_ path: AbsolutePath) throws -> String {
+        return try "\"" + resolveSymlinks(path).pathString
+            .replacingOccurrences(of: "\\", with: "\\\\")
+            .replacingOccurrences(of: "\"", with: "\\\"")
+            + "\""
+    }
+}
+#endif

Sources/Basics/SandboxProfile.swift

@@ -554,7 +554,12 @@ public final class BuildOperation: PackageStructureDelegate, SPMBuildCore.BuildS
                 // TODO: We need to also use any working directory, but that support isn't yet available on all platforms at a lower level.
                 var commandLine = [command.configuration.executable.pathString] + command.configuration.arguments
                 if !self.disableSandboxForPluginCommands {
-                    commandLine = try Sandbox.apply(command: commandLine, strictness: .writableTemporaryDirectory, writableDirectories: [pluginResult.pluginOutputDirectory])
+                    // Allow access to the plugin's output directory as well as to the local temporary directory.
+                    let sandboxProfile = SandboxProfile([
+                        .writable(pluginResult.pluginOutputDirectory),
+                        .writable(try AbsolutePath(validating: "/tmp")),
+                        .writable(try self.fileSystem.tempDirectory)])
+                    commandLine = try sandboxProfile.apply(to: commandLine)
                 }
                 let processResult = try TSCBasic.Process.popen(arguments: commandLine, environment: command.configuration.environment)
                 let output = try processResult.utf8Output() + processResult.utf8stderrOutput()

Sources/Build/BuildOperation.swift

@@ -621,8 +621,14 @@ extension LLBuildManifestBuilder {
                 let uniquedName = ([execPath.pathString] + command.configuration.arguments).joined(separator: "|")
                 let displayName = command.configuration.displayName ?? execPath.basename
                 var commandLine = [execPath.pathString] + command.configuration.arguments
+
+                // Apply the sandbox, if appropriate.
                 if !self.disableSandboxForPluginCommands {
-                    commandLine = try Sandbox.apply(command: commandLine, strictness: .writableTemporaryDirectory, writableDirectories: [result.pluginOutputDirectory])
+                    let sandboxProfile = SandboxProfile([
+                        .writable(result.pluginOutputDirectory),
+                        .writable(try AbsolutePath(validating: "/tmp")),
+                        .writable(try self.fileSystem.tempDirectory)])
+                    commandLine = try sandboxProfile.apply(to: commandLine)
                 }
                 manifest.addShellCmd(
                     name: displayName + "-" + ByteString(encodingAsUTF8: uniquedName).sha256Checksum,

Sources/Build/LLBuildManifestBuilder.swift

@@ -708,10 +708,29 @@ public final class ManifestLoader: ManifestLoaderProtocol {
                         // This provides some safety against arbitrary code execution when parsing manifest files.
                         // We only allow the permissions which are absolutely necessary.
                         if self.isManifestSandboxEnabled {
-                            let cacheDirectories = [self.databaseCacheDir, moduleCachePath].compactMap{ $0 }
-                            let strictness: Sandbox.Strictness = toolsVersion < .v5_3 ? .manifest_pre_53 : .default
                             do {
-                                cmd = try Sandbox.apply(command: cmd, strictness: strictness, writableDirectories: cacheDirectories)
+                                var sandbox = SandboxProfile()
+
+                                // Allow writing inside the temporary directories.
+                                sandbox.pathAccessRules.append(.writable(try AbsolutePath(validating: "/tmp")))
+                                sandbox.pathAccessRules.append(.writable(try localFileSystem.tempDirectory))
+
+                                // Allow writing in the database cache directory, if we have one.
+                                if let databaseCacheDir = self.databaseCacheDir {
+                                    sandbox.pathAccessRules.append(.writable(databaseCacheDir))
+                                }
+
+                                // Allow writing in the module cache path, if there is one.
+                                if let moduleCachePath = moduleCachePath {
+                                    sandbox.pathAccessRules.append(.writable(moduleCachePath))
+                                }
+
+                                // But do not allow writing in the directory that contains the manifest, even if it is
+                                // inside one of the otherwise writable directories.
+                                sandbox.pathAccessRules.append(.readonly(manifestPath.parentDirectory))
+
+                                // Finally apply the sandbox.
+                                cmd = try sandbox.apply(to: cmd)
                             } catch {
                                 return completion(.failure(error))
                             }

Sources/PackageLoading/ManifestLoader.swift

@@ -423,7 +423,23 @@ public struct DefaultPluginScriptRunner: PluginScriptRunner, Cancellable {
         // Optionally wrap the command in a sandbox, which places some limits on what it can do. In particular, it blocks network access and restricts the paths to which the plugin can make file system changes. It does allow writing to temporary directories.
         if self.enableSandbox {
             do {
-                command = try Sandbox.apply(command: command, strictness: .writableTemporaryDirectory, writableDirectories: writableDirectories + [self.cacheDir], readOnlyDirectories: readOnlyDirectories)
+                var sandbox = SandboxProfile()
+
+                // Allow writing inside the temporary directories.
+                sandbox.pathAccessRules.append(.writable(try AbsolutePath(validating: "/tmp")))
+                sandbox.pathAccessRules.append(.writable(try self.fileSystem.tempDirectory))
+
+                // But prevent writing in any read-only directories.
+                sandbox.pathAccessRules.append(contentsOf: readOnlyDirectories.map{ .readonly($0) })
+
+                // But allow writing in any writable directories.
+                sandbox.pathAccessRules.append(contentsOf: writableDirectories.map{ .writable($0) })
+
+                // And always allow writing to the cache directory, even if it is inside one of the readonly directories.
+                sandbox.pathAccessRules.append(.writable(self.cacheDir))
+
+                // Apply the sandbox to the command.
+                command = try sandbox.apply(to: command)
             } catch {
                 return callbackQueue.async {
                     completion(.failure(error))