diff options
| -rw-r--r-- | CMakeLists.txt | 50 |
1 files changed, 49 insertions, 1 deletions
diff --git a/CMakeLists.txt b/CMakeLists.txt index 2d3dabec..f37fd9b9 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -10,7 +10,6 @@ # On some platforms this builds also xz and xzdec, but these are # highly experimental and meant for testing only: # - No large file support on those 32-bit platforms that need it -# - No sandboxing support # - No translations # # Other missing things: @@ -1241,6 +1240,55 @@ if(NOT MSVC OR MSVC_VERSION GREATER_EQUAL 1900) endif() endif() + # Sandboxing: + # ON Use sandboxing if a supported method is available in the OS. + # OFF Disable sandboxing. + # capsicum Require Capsicum (FreeBSD >= 10.2) and fail if not found. + # pledge Require pledge(2) (OpenBSD >= 5.9) and fail if not found. + set(SUPPORTED_SANDBOX_METHODS ON OFF capsicum pledge) + + set(ENABLE_SANDBOX ON CACHE STRING "Sandboxing method to use in 'xz'") + + set_property(CACHE ENABLE_SANDBOX + PROPERTY STRINGS "${SUPPORTED_SANDBOX_METHODS}") + + if(NOT ENABLE_SANDBOX IN_LIST SUPPORTED_SANDBOX_METHODS) + message(FATAL_ERROR "'${ENABLE_SANDBOX}' is not a supported " + "sandboxing method") + endif() + + # When autodetecting, the search order is fixed and we must not find + # more than one method. + if(ENABLE_SANDBOX STREQUAL "OFF") + set(SANDBOX_FOUND ON) + else() + set(SANDBOX_FOUND OFF) + endif() + + # Sandboxing: Capsicum + if(NOT SANDBOX_FOUND AND ENABLE_SANDBOX MATCHES "^ON$|^capsicum$") + check_symbol_exists(cap_rights_limit sys/capsicum.h + HAVE_CAP_RIGHTS_LIMIT) + if(HAVE_CAP_RIGHTS_LIMIT) + target_compile_definitions(xz PRIVATE HAVE_CAP_RIGHTS_LIMIT) + set(SANDBOX_FOUND ON) + endif() + endif() + + # Sandboxing: pledge(2) + if(NOT SANDBOX_FOUND AND ENABLE_SANDBOX MATCHES "^ON$|^pledge$") + check_symbol_exists(pledge unistd.h HAVE_PLEDGE) + if(HAVE_PLEDGE) + target_compile_definitions(xz PRIVATE HAVE_PLEDGE) + set(SANDBOX_FOUND ON) + endif() + endif() + + if(NOT SANDBOX_FOUND AND NOT ENABLE_SANDBOX MATCHES "^ON$|^OFF$") + message(SEND_ERROR "ENABLE_SANDBOX=${ENABLE_SANDBOX} was used but " + "support for the sandboxing method wasn't found.") + endif() + install(TARGETS xz RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}" COMPONENT xz) |