Hi Sarah, Thanks for looking into this, and more generally for all the work you've been putting into Guix lately.
Sarah Morgensen <[email protected]> writes: > While it looks like preliminary precise whitelisting was done for > ffmpeg, it seems that this approach may require excessive effort for > WebGL. Perhaps, but I don't think that's yet been established. For what it's worth, as the maintainer of our IceCat package since the early years of Guix, I'm uncomfortable allowing the IceCat sandbox to obtain a complete list of software (with precise versions) installed on our users' systems. I hope that we will not give up so easily on precise whitelisting. > For example, after whitelisting libxcb, > it needs > > > /gnu/store/w68jrgqqbfcakm27wm4zf7hmpgw294my-libxxf86vm-1.1.4/lib/libXxf86vm.so.1 > > and after whitelisting that one, > > > /gnu/store/jwga98k68l0h5c45jx7z4jdjzhfc34vm-libxshmfence-1.3/lib/libxshmfence.so.1 > > and so on. I agree that this approach would be very tedious, but there are better ways. I faced a similar problem before I wrote the existing precise whitelisting code (which your proposed patch would remove): 'libavcodec' had too many dependencies, and I didn't want to maintain a list of them all. I eventually realized that 'libavcodec's RUNPATH would cover most of what was needed, and in fact only one additional directory needed to be added manually. Would you like to try adding the RUNPATHs of Mesa's libraries to the whitelist, i.e. using the same code that computes 'libavcodec-runpath'? To find the directories that must be added manually, how about scraping the *successful* log for a list of file names in /gnu/store and distilling it down to a set of packages? > Both the above are propagated-inputs in mesa. So, it seems > to "properly" fix this, we would need to read *all* input libraries > recursively. Even if we had to do that, it wouldn't be an excessive amount of effort. We already have the code to extract the RUNPATH of a library and add it to the whitelist. Doing that for all libraries found in FOO/lib/*.so for all inputs FOO shouldn't be much harder, no? What do you think? Would you like to try it? Regards, Mark -- Disinformation flourishes because many people care deeply about injustice but very few check the facts. Ask me about <https://stallmansupport.org>.
