Add support for Mac OS X's sandbox_init(3) sandbox functionality, which

is marked as DEPRECATED in OS X after 2011 or so, but has not been
removed and has no replacement.

ok schwarze@

1 files changed, 10 insertions, 0 deletions

diff --git a/mandocdb.c b/mandocdb.c
index 4a1544d2..8a084451 100644
--- a/mandocdb.c
+++ b/mandocdb.c
@@ -34,6 +34,9 @@
 #include "compat_fts.h"
 #endif
 #include <limits.h>
+#if HAVE_SANDBOX_INIT
+#include <sandbox.h>
+#endif
 #include <stddef.h>
 #include <stdio.h>
 #include <stdint.h>
@@ -345,6 +348,13 @@ mandocdb(int argc, char *argv[])
 	}
 #endif
 
+#if HAVE_SANDBOX_INIT
+	if (sandbox_init(kSBXProfileNoInternet, SANDBOX_NAMED, NULL) == -1) {
+		warnx("sandbox_init");
+		return (int)MANDOCLEVEL_SYSERR;
+	}
+#endif
+
 	memset(&conf, 0, sizeof(conf));
 	memset(stmts, 0, STMT__MAX * sizeof(sqlite3_stmt *));