├── .gitattributes ├── nomach.sb ├── ping.sb ├── LICENSE ├── download.sb ├── confined.sb ├── README.md └── exampleBuilds.md /.gitattributes: -------------------------------------------------------------------------------- 1 | # Auto detect text files and perform LF normalization 2 | * text=auto 3 | -------------------------------------------------------------------------------- /nomach.sb: -------------------------------------------------------------------------------- 1 | (version 1) 2 | ;; Profile that just blocks mach-lookup 3 | ;; Only used while populating xcrun_db 4 | (allow default) 5 | (deny mach-lookup) 6 | -------------------------------------------------------------------------------- /ping.sb: -------------------------------------------------------------------------------- 1 | (version 1) 2 | 3 | ;; sandbox profile for ping ping6 4 | 5 | ;; For explanation and usage see https://github.com/BrianSwift/macOSSandboxBuild 6 | 7 | (deny default) 8 | 9 | (allow file-read* process-exec 10 | (literal "/sbin/ping") 11 | (literal "/sbin/ping6") 12 | ) 13 | 14 | (allow network-outbound 15 | (literal "/private/var/run/mDNSResponder") 16 | (remote udp) ; ping 17 | ) 18 | 19 | (allow network-inbound (local udp "*:*")) ; ping 20 | 21 | (allow file-read-metadata 22 | (literal "/var") ; needed for DNS resolution 23 | ) 24 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2021 Brian Swift 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /download.sb: -------------------------------------------------------------------------------- 1 | (version 1) 2 | 3 | ;; sandbox profile for downloading software using curl or git 4 | 5 | ;; For explanation and usage see https://github.com/BrianSwift/macOSSandboxBuild 6 | 7 | (deny default) 8 | 9 | (allow process-fork) ;; git needs 10 | 11 | (allow file-read* process-exec 12 | (literal "/usr/bin/curl") 13 | (literal "/Applications/Xcode.app/Contents/Developer/usr/bin/git") 14 | (subpath "/Applications/Xcode.app/Contents/Developer/usr/libexec/git-core") 15 | (subpath "/Applications/Xcode.app/Contents/Developer/usr/share/git-core") 16 | ) 17 | 18 | (allow file-read* file-write-data 19 | (literal "/dev/null") ;; git 20 | (literal "/dev/zero")) 21 | 22 | (allow network-outbound 23 | (literal "/private/var/run/mDNSResponder") ; name lookup 24 | (remote tcp "*:443") 25 | ) 26 | 27 | (allow file-read-metadata 28 | (literal "/var") ; needed for DNS resolution 29 | (subpath "/etc") ; needed for curl/git to traverse to /private/etc/ssl 30 | ) 31 | 32 | (allow file-read* 33 | (subpath "/private/etc/ssl") ; git/curl references to /etc/ssl/cert.pem 34 | ) 35 | 36 | (allow file-read* file-write* 37 | (subpath (param "_RW1")) ;; current and sub dirs 38 | ) 39 | 40 | (allow file-read-metadata 41 | (path-ancestors (param "_RW1")) ; git does file-read-metadata (stat?) on all path prefixes several times 42 | ) 43 | 44 | (allow sysctl-read 45 | (sysctl-name 46 | "kern.hostname" ; git produces error without hostname, but still runs to completion 47 | ; when checking out gflags, hostname becomes part of log messages in: 48 | ; .git/logs/HEAD gflags/.git/logs/HEAD 49 | ; .git/logs/refs/heads/master gflags/.git/logs/refs/heads/master 50 | ; .git/logs/refs/remotes/origin/HEAD gflags/.git/logs/refs/remotes/origin/HEAD 51 | )) 52 | -------------------------------------------------------------------------------- /confined.sb: -------------------------------------------------------------------------------- 1 | (version 1) 2 | 3 | ;; sandbox profile for building software from command line 4 | 5 | ;; For explanation and usage see https://github.com/BrianSwift/macOSSandboxBuild 6 | 7 | ;; MIT License (at end) 8 | 9 | 10 | (deny default) 11 | 12 | 13 | ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; 14 | ;; process 15 | 16 | (allow process-fork) ;; Because building means running commands and scripts 17 | 18 | 19 | ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; 20 | ;; file 21 | 22 | (allow file-read* file-write* 23 | (subpath (param "_RW1")) ;; current and sub dirs 24 | (subpath (param "_TMPDIR")) ;; TMPDIR and sub dirs (should already be setup with pre-heated xcrun_db) 25 | ) 26 | 27 | (allow file-read* file-write-data 28 | (literal "/dev/null") 29 | (literal "/dev/zero")) 30 | 31 | (allow file-read* process-exec 32 | (subpath (param "_RX1")) ;; additional direcory read/execute directory 33 | (subpath "/bin") ;; sh, bash 34 | (subpath "/usr/bin") ;; uname (cmake), dirname 35 | (subpath "/Applications/Xcode.app") ;; clang 36 | ) 37 | 38 | ;; Initial elements mentioned in blastdoor.sb 39 | ;; Allow read access to standard system paths. 40 | (allow file-read* 41 | (subpath "/System/Library") ;; Tightened, was "/System" 42 | (subpath "/usr/lib") 43 | (subpath "/usr/share") 44 | ;; Tighter. Removed (subpath "/private/var/db/dyld") 45 | 46 | ;; my additions 47 | (literal "/Library/Preferences/.GlobalPreferences.plist") ;; sw_vers xcodebuild 48 | (literal "/Library/Preferences/com.apple.dt.Xcode.plist") ;; xcodebuild (checking last license agreed to "IDELastGMLicenseAgreedTo") 49 | 50 | ;; xcodebuild (though doesn't break without) 51 | (literal "/System") 52 | (literal "/usr") 53 | ) 54 | 55 | ;; Initially from blastdoor.sb 56 | (allow file-read-metadata 57 | (path-ancestors (param "_RX1")) 58 | (literal "/etc") 59 | (literal "/tmp") 60 | (literal "/var") 61 | (literal "/private/etc/localtime") 62 | ;; sh wants 63 | (literal "/private/var/select/sh") 64 | 65 | ;; clang wants to read metadata from from XCode parent dirs 66 | (literal "/Applications") 67 | (literal "/") 68 | ) 69 | 70 | ;; From blastdoor.sb 71 | ;; Allow access to standard special files. 72 | (allow file-read* 73 | (literal "/dev/random") 74 | (literal "/dev/urandom")) 75 | 76 | ;; deny (with no-report) to reduce log pollution 77 | ;; Idea is to reduce/eliminate logged messages for a nominal run, 78 | ;; so any messages that are logged are significant. 79 | (deny file* (with no-report) 80 | (literal "/dev") ;; bash 81 | (literal "/dev/tty") ;; bash 82 | (literal "/Library/Preferences/Logging/com.apple.diagnosticd.filter.plist") 83 | (literal "/usr/local") 84 | (subpath "/private/var/db/timezone") ; xcodebuild, sw_vers, make 85 | (literal "/private/etc/passwd") ;; clang, make, access probably for group number to name conversion, block doesn't cause failure but does pollute log file 86 | (literal "/System/Volumes") ;; xcodebuild 87 | (literal "/private/tmp") ;; cmake frequent file-read-metadata (possibly due to ./kwsys/SystemTools.cxx: SystemTools::AddKeepPath("/tmp/");) 88 | (literal "/private") ;; cmake frequent file-read-metadata 89 | ) 90 | 91 | 92 | 93 | ;; Everything accesses /AppleInternal. Blocking doesn't seem to hurt. Explicit block "(with no-report)" to prevent log pollution 94 | (deny file-read-metadata (with no-report) (literal "/AppleInternal")) 95 | 96 | 97 | ;; Every launched process tries to access dtracehelper. Added (with no-report) to reduce log pollution. 98 | (deny (with no-report) file-read* file-write-data file-ioctl 99 | (literal "/dev/dtracehelper")) 100 | 101 | 102 | ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; 103 | ;; mach-lookup 104 | ;; 105 | ;; All are denied by (deny default). Reduce log pollution for these. 106 | 107 | ;; reduce log pollution 108 | (deny mach-lookup (with no-report) 109 | (global-name-prefix "com.apple.system.opendirectoryd.") ;; clang 110 | (global-name-prefix "com.apple.logd") ;; make 111 | (global-name "com.apple.bsd.dirhelper") ;; clang 112 | (global-name "com.apple.system.notification_center") ;; xcodebuild, make, sw_vers 113 | (global-name "com.apple.coresymbolicationd") ;; xcodebuild 114 | (global-name "com.apple.CoreServices.coreservicesd") ;; xcodebuild 115 | (global-name "com.apple.diagnosticd") ;; xcodebuild, make, sw_vers 116 | (global-name "com.apple.lsd.mapdb") ;; xcodebuild 117 | (global-name "com.apple.dt.CommandLineTools.installondemand") ;; gcc, clang 118 | ) 119 | 120 | 121 | ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; 122 | ;; sysctl 123 | ;; 124 | ;; All denied by (deny default) at top. 125 | ;; 126 | 127 | (deny sysctl* (with no-report) (sysctl-name 128 | ;; every executable startup does this, why 129 | "kern.osvariant_status" 130 | "hw.ephemeral_storage" 131 | )) 132 | 133 | (allow sysctl-read 134 | (sysctl-name 135 | ;; uname ( used in cmake build) 136 | "kern.ostype" 137 | "kern.hostname" 138 | "kern.osrelease" 139 | "kern.version" 140 | "hw.machine" 141 | 142 | ;;clang 143 | "hw.pagesize_compat" 144 | "kern.argmax" 145 | ;;ld 146 | "hw.ncpu" 147 | ;; bash, clang++, 148 | "kern.secure_kernel" ;; pollution doesn't break 149 | ;; xcodebuild 150 | "kern.maxfilesperproc" 151 | "kern.osproductversion" 152 | ;; bash and others 153 | "kern.ngroups" 154 | ) 155 | ) 156 | 157 | 158 | ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; 159 | ;; ipc 160 | 161 | (deny ipc-posix-shm-read-data (with no-report) (ipc-posix-name "apple.shm.notification_center")) ;; xcodebuild, sw_vers, make 162 | 163 | 164 | ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; 165 | ;; network 166 | ;; 167 | ;; All network access is already denied by (deny default) at top. 168 | ;; This is just reducing frequent log message 169 | 170 | (deny network-outbound (with no-report) (literal "/private/var/run/syslog")) ;; clang, make, test 171 | 172 | 173 | ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; 174 | ;; syscall 175 | 176 | ;; Stop xcodebuild from enumerating mounts on every invocation 177 | ;; syscall names in /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include/sys/syscall.h 178 | 179 | (deny syscall-unix (with no-report) 180 | (syscall-number SYS_getfsstat64) 181 | ) 182 | ;; would be nice to have more granularity, to be able to specify the "no-report" just for xcodebuild 183 | ;; so any other occurrences would be visible 184 | 185 | 186 | ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; 187 | ;; system-privilege 188 | 189 | (deny system-privilege) ;; from blastdoor.sb, wasn't generating deny messaegs before added. Seeing deny(1) system-privilege 1002. Don't know if allowed even with (deny default), or by default denied (with no-report) 190 | 191 | 192 | 193 | ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; 194 | ;; License 195 | 196 | ;MIT License 197 | ; 198 | ;Copyright (c) 2021 Brian Swift 199 | ; 200 | ;Permission is hereby granted, free of charge, to any person obtaining a copy 201 | ;of this software and associated documentation files (the "Software"), to deal 202 | ;in the Software without restriction, including without limitation the rights 203 | ;to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 204 | ;copies of the Software, and to permit persons to whom the Software is 205 | ;furnished to do so, subject to the following conditions: 206 | ; 207 | ;The above copyright notice and this permission notice shall be included in all 208 | ;copies or substantial portions of the Software. 209 | ; 210 | ;THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 211 | ;IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 212 | ;FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 213 | ;AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 214 | ;LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 215 | ;OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 216 | ;SOFTWARE. 217 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # MacOS Sandbox Build 2 | 3 | ## What is this? 4 | 5 | MacOS sandbox profiles and instructions for command line (Terminal) building of software in a sandboxed environment. 6 | 7 | ## Audience 8 | 9 | People who build software from the command line on macOS and have security related concerns about what could be occurring in a complex build process. 10 | 11 | ## How do I use it? 12 | 13 | After some setup, software build commands are executed in a restricted environment defined by the `confined.sb` profile using macOS command `sandbox-exec`. Three parameters passed to `confined.sb` specify directories accessible to the build command that are additions to a limited set of standard system directories. 14 | * `_RX1` : contents are readable and executable, and metadata can be read from its path-ancestors 15 | * `_RW1`: contents are readable and writable 16 | * `_TMPDIR`: contents are readable and writable 17 | 18 | The following example steps through building `cmake`. 19 | 20 | ### Download Profiles 21 | 22 | ``` 23 | mkdir -p "$HOME/Development/github" 24 | cd "$HOME/Development/github" 25 | git clone https://github.com/BrianSwift/macOSSandboxBuild.git 26 | ``` 27 | 28 | ### Setup `TMPDIR` 29 | 30 | ``` 31 | export TMPDIR="$HOME/Dev Space/sandtmp" 32 | mkdir -p "$TMPDIR" 33 | ``` 34 | 35 | ### Load `xcrun_db` cache 36 | Identify tool names in `/usr/bin` that might bounce to an XCode tool (this is intersection of tools in Xcode.app and tools in `/usr/bin`.) 37 | This annoying setup process only needs to be done once. 38 | ``` 39 | (ls /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin ; ls /Applications/Xcode.app/Contents/Developer/usr/bin ) | sort -u >/tmp/tool_list_xcode.txt 40 | ls /usr/bin | sort >/tmp/tool_list_usr_bin.txt 41 | comm -12 /tmp/tool_list_usr_bin.txt /tmp/tool_list_xcode.txt >/tmp/tool_list_to_cache.txt 42 | ``` 43 | Execute `xcrun -find` for each tool name to load `xcrun_db`. Execution in sandbox using `nomach.sb` profile causes `xcrun` to fallback to using `$TMPDIR` for location of `xcrun_db`, rather than `_CS_DARWIN_USER_TEMP_DIR` returned by `confstr(3)`. `nomach.sb` only denies `mach-lookup` operations. It is not more restrictive because only Apple provided code is executed. 44 | 45 | First pass takes a few seconds per tool, and may get error messages when looking up `DeRez` and `swift`. Second command produces lots of errors, but that is expected because some apps don't recognize `--version`. Final command should only take a fraction of second per tool, and produce no errors. 46 | ``` 47 | /tmp/sblog-cmake-01.txt 92 | ``` 93 | bootstrap `cmake` within confined sandbox 94 | ``` 95 | cd "$HOME/Dev Space/Net/cmake/Build" 96 | PATH="`pwd`:$PATH" /usr/bin/time sandbox-exec -D_RX1="$HOME/Dev Space/Net" -D_RW1="$PWD" -D_TMPDIR="$TMPDIR" -f "$HOME/Development/github/macOSSandboxBuild/confined.sb" "$HOME/Dev Space/Net/cmake/Src/cmake-3.21.2/bootstrap" --prefix="$HOME/Dev Space/Net/cmake/Inst" 97 | : Expected final output 98 | : CMake has bootstrapped. Now run make. 99 | : 463.29 real 376.10 user 79.49 sys 100 | ``` 101 | build and install `cmake` within confined sandbox 102 | ``` 103 | PATH="`pwd`:$PATH" /usr/bin/time sandbox-exec -D_RX1="$HOME/Dev Space/Net" -D_RW1="`dirname $PWD`" -D_TMPDIR="$TMPDIR" -f "$HOME/Development/github/macOSSandboxBuild/confined.sb" make -j 4 install 104 | : Expected final output 105 | : -- Installing: /Users/sand/Dev Space/Net/cmake/Inst/share/bash-completion/completions/ctest 106 | : 501.18 real 1820.55 user 124.39 sys 107 | ``` 108 | Stop logging 109 | 110 | Stop (^C) the `log stream...` running in another window. 111 | 112 | A tally of sandbox allow/deny log messages can be produced with this command. 113 | ``` 114 | tr '0123456789' '##########' s8v4.pbrt <<'EOFF' 346 | Film "rgb" 347 | "integer yresolution" [ 300 ] 348 | "integer xresolution" [ 300 ] 349 | "string filename" [ "s8.png" ] 350 | 351 | Sampler "halton" 352 | "integer pixelsamples" [ 128 ] 353 | Integrator "bdpt" 354 | LookAt 796800000 0 0 355 | 800000000 0 0 356 | 0 0 1 357 | Camera "perspective" 358 | "float fov" [ 4 ] 359 | WorldBegin 360 | LightSource "distant" 361 | "float scale" [1.5] 362 | "blackbody L" [ 6500 ] 363 | "point3 to" [ 1 0 0 ] 364 | AttributeBegin 365 | Material "diffuse" 366 | "rgb reflectance" [ 0.9 0.9 0.9 ] 367 | Translate 800000000 0 0 368 | Shape "sphere" 369 | "float radius" [ 80000 ] 370 | AttributeEnd 371 | EOFF 372 | 373 | /usr/bin/time sandbox-exec -D_RX1="$HOME/Dev Space/Net" -D_RW1="$PWD" -D_TMPDIR="$TMPDIR" -f "$HOME/Development/github/macOSSandboxBuild/confined.sb" "$HOME/Dev Space/Net/pbrt-v4/Inst/bin/pbrt" s8v4.pbrt 374 | pbrt version 4 (built Sep 13 2021 at 20:35:33) 375 | Copyright (c)1998-2021 Matt Pharr, Wenzel Jakob, and Greg Humphreys. 376 | The source code to pbrt (but *not* the book contents) is covered by the Apache 2.0 License. 377 | See the file LICENSE.txt for the conditions of the license. 378 | Rendering: [+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++] (10.6s) 379 | 10.82 real 78.99 user 0.17 sys 380 | ``` 381 | ### llvm clang 382 | ``` 383 | mkdir -p "$HOME/Dev Space/Net/llvm/"{Src,Build,Dist,Inst} 384 | cd "$HOME/Dev Space/Net/llvm/Src" 385 | git clone --depth=1 https://github.com/llvm/llvm-project.git 386 | 387 | ;: patch llvm bug that causes abort durring clang link of build directory path contains space character 388 | cd "$HOME/Dev Space/Net/llvm/Src/llvm-project/clang/tools/driver" 389 | patch <<'EOFF' 390 | --- CMakeLists.txt 2021-09-14 13:10:43.000000000 -0700 391 | +++ CMakeLists-fixed.txt 2021-09-14 13:13:16.000000000 -0700 392 | @@ -82,7 +82,7 @@ 393 | set(TOOL_INFO_PLIST_OUT "${CMAKE_CURRENT_BINARY_DIR}/${TOOL_INFO_PLIST}") 394 | target_link_libraries(clang 395 | PRIVATE 396 | - "-Wl,-sectcreate,__TEXT,__info_plist,${TOOL_INFO_PLIST_OUT}") 397 | + "-Wl,-sectcreate,__TEXT,__info_plist,\"${TOOL_INFO_PLIST_OUT}\"") 398 | configure_file("${TOOL_INFO_PLIST}.in" "${TOOL_INFO_PLIST_OUT}" @ONLY) 399 | 400 | set(TOOL_INFO_UTI) 401 | EOFF 402 | 403 | 404 | cd "$HOME/Dev Space/Net/llvm/Build" 405 | unset CMAKE_PREFIX_PATH 406 | /usr/bin/time sandbox-exec -D_RX1="$HOME/Dev Space/Net" -D_RW1="$PWD" -D_TMPDIR="$TMPDIR" -f "$HOME/Development/github/macOSSandboxBuild/confined.sb" cmake -S "$HOME/Dev Space/Net/llvm/Src/llvm-project/llvm" -B . --install-prefix "$HOME/Dev Space/Net/llvm/Inst" -DLLVM_ENABLE_PROJECTS=clang -G "Unix Makefiles" 407 | ... 408 | -- Performing Test HAVE_STEADY_CLOCK -- success 409 | -- Configuring done 410 | -- Generating done 411 | -- Build files have been written to: /Users/sand/Dev Space/Net/llvm/Build 412 | 65.92 real 27.86 user 34.20 sys 413 | 414 | /usr/bin/time sandbox-exec -D_RX1="$HOME/Dev Space/Net" -D_RW1="`dirname $PWD`" -D_TMPDIR="$TMPDIR" -f "$HOME/Development/github/macOSSandboxBuild/confined.sb" make -j 4 install ; date 415 | ... 416 | -- Installing: /Users/sand/Dev Space/Net/llvm/Inst/lib/cmake/llvm/./TableGen.cmake 417 | 5701.77 real 20778.79 user 1164.39 sys 418 | Tue Sep 14 15:07:26 PDT 2021 419 | ``` 420 | Test trivial compile with built clang 421 | ``` 422 | mkdir -p "$HOME/Dev Space/Net/tests" 423 | cd "$HOME/Dev Space/Net/tests" 424 | cat >main.c <<'EOFF' 425 | #include 426 | int main(){ 427 | printf("hello you\n"); 428 | return 0; 429 | } 430 | EOFF 431 | 432 | ;: Note: needed -isysroot to find stdio.h 433 | ;: Maybe there is better way to build clang to specify default system search 434 | sandbox-exec -D_RX1="$HOME/Dev Space/Net" -D_RW1="$PWD" -D_TMPDIR="$TMPDIR" -f "$HOME/Development/github/macOSSandboxBuild/confined.sb" "$HOME/Dev Space/Net/llvm/Inst"/bin/clang -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk main.c 435 | sandbox-exec -D_RX1="$HOME/Dev Space/Net" -D_RW1="$PWD" -D_TMPDIR="$TMPDIR" -f "$HOME/Development/github/macOSSandboxBuild/confined.sb" "`pwd`/a.out" 436 | ``` 437 | --------------------------------------------------------------------------------