[openssh-commits] [openssh] branch V_10_5 updated: Require kSBXProfilePureComputation for OS X sandbox.

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

dtucker pushed a commit to branch V_10_5
in repository openssh.

The following commit(s) were added to refs/heads/V_10_5 by this push:
     new cd1d58b43 Require kSBXProfilePureComputation for OS X sandbox.
cd1d58b43 is described below

commit cd1d58b4318a35532e2dec1dd64a864fa97c2072
Author: Darren Tucker <dtucker at dtucker.net>
AuthorDate: Sun Aug 16 09:30:54 2026 +1000

    Require kSBXProfilePureComputation for OS X sandbox.
    
    This has been removed in OS X SDK >= 27, so if it's not present then
    don't enable the corresponding sandbox.
---
 configure.ac | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/configure.ac b/configure.ac
index cb1711f6b..a0fc91a37 100644
--- a/configure.ac
+++ b/configure.ac
@@ -859,6 +859,7 @@ int main(void) { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
 	AC_CHECK_LIB([sandbox], [sandbox_apply], [
 	    SSHDLIBS="$SSHDLIBS -lsandbox"
 	])
+	AC_CHECK_DECLS(kSBXProfilePureComputation, [], [], [#include <sandbox.h>])
 	# proc_pidinfo()-based closefrom() replacement.
 	AC_CHECK_HEADERS([libproc.h])
 	AC_CHECK_FUNCS([proc_pidinfo])
@@ -3904,10 +3905,12 @@ fi
 
 if test "x$sandbox_arg" = "xdarwin" || \
      ( test -z "$sandbox_arg" && test "x$ac_cv_func_sandbox_init" = "xyes" && \
-       test "x$ac_cv_header_sandbox_h" = "xyes") ; then
+       test "x$ac_cv_header_sandbox_h" = "xyes" && \
+       test "x$ac_cv_have_decl_kSBXProfilePureComputation" = "xyes") ; then
 	test "x$ac_cv_func_sandbox_init" != "xyes" -o \
-	     "x$ac_cv_header_sandbox_h" != "xyes" && \
-		AC_MSG_ERROR([Darwin seatbelt sandbox requires sandbox.h and sandbox_init function])
+	     "x$ac_cv_header_sandbox_h" != "xyes" -o \
+	     "x$ac_cv_have_decl_kSBXProfilePureComputation" != "xyes" && \
+		AC_MSG_ERROR([Darwin seatbelt sandbox requires sandbox.h, sandbox_init() and kSBXProfilePureComputation])
 	SANDBOX_STYLE="darwin"
 	AC_DEFINE([SANDBOX_DARWIN], [1], [Sandbox using Darwin sandbox_init(3)])
 elif test "x$sandbox_arg" = "xseccomp_filter" || \

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.