utility.sb 1.0 KB

1234567891011121314151617181920212223242526
  1. ;;
  2. ;; Copyright (c) 2011 The Chromium Authors. All rights reserved.
  3. ;; Use of this source code is governed by a BSD-style license that can be
  4. ;; found in the LICENSE file.
  5. ;;
  6. ; This is the Sandbox configuration file used for safeguarding the utility
  7. ; process which is used for performing sandboxed operations that need to touch
  8. ; the filesystem like decoding theme images and unpacking extensions.
  9. ;
  10. ; This configuration locks everything down, except access to one configurable
  11. ; directory. This is different from other sandbox configuration files where
  12. ; file system access is entireley restricted.
  13. ; *** The contents of common.sb are implicitly included here. ***
  14. ; No additional resource access needed.
  15. ; This is available in 10.15+, and rolled out as a Finch experiment.
  16. (if (param-true? filter-syscalls-debug)
  17. (when (defined? 'syscall-unix)
  18. (deny syscall-unix (with send-signal SIGSYS))
  19. (allow syscall-unix
  20. (syscall-number SYS_psynch_cvwait)
  21. (syscall-number SYS_sendto)
  22. (syscall-number SYS_socketpair)
  23. )))