feat: note that Homebrew does not have a sandbox on Linux #17318
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
carlocab
approved these changes
May 16, 2024
Co-authored-by: Patrick Linnane <[email protected]>
p-linnane
approved these changes
May 16, 2024
gromgit
reviewed
May 16, 2024
Co-authored-by: Adrian Ho <[email protected]>
MikeMcQuaid
reviewed
May 17, 2024
| @@ -45,6 +45,9 @@ brew install hello | |||
|
|
|||
| If you're using an older distribution of Linux, installing your first package will also install a recent version of *glibc* and *gcc*. Use `brew doctor` to troubleshoot common issues. | |||
|
|
|||
| > [!NOTICE] | |||
| > Please note that unlike macOS, Homebrew does not use a sandbox when building on Linux, so formulae may install outside the Homebrew prefix. | |||
There was a problem hiding this comment.
may not only read but also write arbitrary files anywhere outside the Homebrew prefix
Thoughts?
There was a problem hiding this comment.
I would turn them around, since I'd be more worried about reads than writes. But clarification is good either way
There was a problem hiding this comment.
Our macOS sandbox doesn't block reads either - it wasn't really designed to allow you to install untrusted software, more to prevent accidents due to not passing the correct --prefix.
Bo98
reviewed
May 17, 2024
| @@ -45,6 +45,9 @@ brew install hello | |||
|
|
|||
| If you're using an older distribution of Linux, installing your first package will also install a recent version of *glibc* and *gcc*. Use `brew doctor` to troubleshoot common issues. | |||
|
|
|||
| > [!NOTICE] | |||
There was a problem hiding this comment.
This is GitHub-specific syntax that our website generation doesn't currently support
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
brew stylewith your changes locally?brew typecheckwith your changes locally?brew testswith your changes locally?