3 ms·
oh, yeah, sandbox-exec is fun. for the record, the exact scheme they use is tinyscheme. the whole facility is largely undocumented, but it still somehow manages
by 0x69420 4y ago
oh, yeah, sandbox-exec is fun. for the record, the exact scheme they use is tinyscheme. the whole facility is largely undocumented, but it still somehow manages to be friendlier than seccomp -- i remember learning about it in a talk on the nix macos effort
you can “enjoy” the sight of some c++ directly generating scheme here: https://github.com/NixOS/nix/blob/2.9.2/src/libstore/build/local-derivation-goal.cc#L1915-L1967 https://github.com/NixOS/nix/blob/2.9.2/src/libstore/build/l...
- shepting 4y agoDo you happen to have a link to the talk about Nix on macOS you heard about it from? Or event the title/details so I could search?
- 0x69420 4y agohere: https://www.youtube.com/watch?v=73mnPBLL_20 https://www.youtube.com/watch?v=73mnPBLL_20 be warned, it's from 2017, so there are 5 years of history you'll still need to go looking for