Index: trunk/base/src/darwintracelib1.0/darwintrace.c
===================================================================
--- trunk/base/src/darwintracelib1.0/darwintrace.c	(revision 18710)
+++ trunk/base/src/darwintracelib1.0/darwintrace.c	(revision 18721)
@@ -4,5 +4,5 @@
  * All rights reserved.
  *
- * $Id: darwintrace.c,v 1.15 2006/07/24 05:55:43 pguyot Exp $
+ * $Id: darwintrace.c,v 1.16 2006/07/25 04:01:33 pguyot Exp $
  *
  * @APPLE_BSD_LICENSE_HEADER_START@
@@ -59,5 +59,5 @@
  * DARWINTRACE_SHOW_PROCESS: show the process id of every access
  * DARWINTRACE_LOG_CREATE: log creation of files as well.
- * DARWINTRACE_SANDBOX: control creation and writing to files.
+ * DARWINTRACE_SANDBOX: control creation, deletion and writing to files.
  * DARWINTRACE_LOG_FULL_PATH: use F_GETPATH to log the full path.
  * DARWINTRACE_DEBUG_OUTPUT: verbose output of stuff to debug darwintrace.
@@ -332,4 +332,35 @@
 }
 
+#if DARWINTRACE_SANDBOX
+/*
+ * return 1 if path (once normalized) is in sandbox, 0 otherwise.
+ * return -1 if no sandbox is defined or if the path couldn't be normalized.
+ */
+inline int __darwintrace_is_in_sandbox(const char* path) {
+	int result = -1; /* no sandbox is defined */
+	__darwintrace_setup();
+	if (__darwintrace_sandbox_bounds != NULL) {
+		/* check the path */
+		char** basePathsCrsr = __darwintrace_sandbox_bounds;
+		char* basepath = *basePathsCrsr++;
+		/* normalize the path */
+		char createpath[MAXPATHLEN];
+		if (realpath(path, createpath) != NULL) {
+			__darwintrace_cleanup_path(createpath);
+			/* say it's outside unless it's proved inside */
+			result = 0;
+			while (basepath != NULL) {
+				if (__darwintrace_strbeginswith(createpath, basepath)) {
+					result = 1;
+					break;
+				}
+				basepath = *basePathsCrsr++;;
+			}
+		} /* otherwise, operation will fail anyway */
+	}
+	return result;
+}
+#endif
+
 /* Log calls to open(2) into the file specified by DARWINTRACE_LOG.
    Only logs if the DARWINTRACE_LOG environment variable is set.
@@ -354,34 +385,17 @@
 	result = 0;
 	if (flags & (O_CREAT | O_APPEND | O_RDWR | O_WRONLY | O_TRUNC)) {
-		__darwintrace_setup();
-		if (__darwintrace_sandbox_bounds != NULL) {
-			/* check the path */
-			char** basePathsCrsr = __darwintrace_sandbox_bounds;
-			char* basepath = *basePathsCrsr++;
-			/* normalize the path */
-			char createpath[MAXPATHLEN];
-			if (realpath(path, createpath) != NULL) {
-				__darwintrace_cleanup_path(createpath);
-				/* forbid unless allowed */
-				result = -1;
-				while (basepath != NULL) {
-					if (__darwintrace_strbeginswith(createpath, basepath)) {
-						result = 0;
-						break;
-					}
-					basepath = *basePathsCrsr++;;
-				}
-			} /* otherwise, open will fail anyway */
-		}
-		if (result == 0) {
+		int isInSandbox = __darwintrace_is_in_sandbox(path);
+		if (isInSandbox == 1) {
 			dprintf("darwintrace: creation/writing was allowed at %s\n", path);
+		} else if (isInSandbox == 0) {
+			/* outside sandbox, but sandbox is defined: forbid */
+			dprintf("darwintrace: creation/writing was forbidden at %s\n", path);
+			__darwintrace_log_op("sandbox_violation", NULL, path, 0);
+			errno = EACCES;
+			result = -1;
 		}
 	}
 	if (result == 0) {
 		result = open(path, flags, mode);
-	} else {
-		dprintf("darwintrace: creation/writing was forbidden at %s\n", path);
-		__darwintrace_log_op("sandbox_violation", NULL, path, result);
-		errno = EACCES;
 	}
 #else
@@ -527,2 +541,27 @@
 #undef close
 }
+
+#if DARWINTRACE_SANDBOX
+/* Trap attempts to unlink a file outside the sandbox.
+ */
+int unlink(const char* path) {
+#define __unlink(x) syscall(SYS_unlink, (x))
+	int result = 0;
+	int isInSandbox = __darwintrace_is_in_sandbox(path);
+	if (isInSandbox == 1) {
+		dprintf("darwintrace: unlink was allowed at %s\n", path);
+	} else if (isInSandbox == 0) {
+		/* outside sandbox, but sandbox is defined: forbid */
+		dprintf("darwintrace: unlink was forbidden at %s\n", path);
+		__darwintrace_log_op("sandbox_violation", NULL, path, 0);
+		errno = EACCES;
+		result = -1;
+	}
+	
+	if (result == 0) {
+		result = __unlink(path);
+	}
+	
+	return result;
+}
+#endif
Index: trunk/base/src/port1.0/porttrace.tcl
===================================================================
--- trunk/base/src/port1.0/porttrace.tcl	(revision 18710)
+++ trunk/base/src/port1.0/porttrace.tcl	(revision 18721)
@@ -2,5 +2,5 @@
 # porttrace.tcl
 #
-# $Id: porttrace.tcl,v 1.17 2006/07/24 05:55:44 pguyot Exp $
+# $Id: porttrace.tcl,v 1.18 2006/07/25 04:01:34 pguyot Exp $
 #
 # Copyright (c) 2005-2006 Paul Guyot <pguyot@kallisys.net>,
@@ -118,5 +118,5 @@
 	
 	foreach violation [lsort $violations] {
-		ui_warn "A file creation/writing was attempted outside sandbox: $violation"
+		ui_warn "A file creation/deletion/modification was attempted outside sandbox: $violation"
 	}
 }
Index: trunk/base/tests/Makefile
===================================================================
--- trunk/base/tests/Makefile	(revision 18710)
+++ trunk/base/tests/Makefile	(revision 18721)
@@ -3,5 +3,5 @@
 SUBDIR=checksums-1 envvariables site-tags trace xcodeversion
 
-.PHONY: test
+.PHONY: test clean
 
 all:
@@ -23,5 +23,5 @@
 	@exit 1
 	
-test: /tmp/darwinports-tests/opt/local/etc/ports/sources.conf
+test: clean /tmp/darwinports-tests/opt/local/etc/ports/sources.conf
 	@for subdir in $(SUBDIR); do\
 		echo ===\> test ${DIRPRFX}$$subdir; \
@@ -39,5 +39,5 @@
 				exit 1; \
 			else \
-				rm -f difference; \
+				rm -f difference output.sed; \
 			fi) \
 		fi || exit 1; \
Index: trunk/base/tests/trace/Makefile
===================================================================
--- trunk/base/tests/trace/Makefile	(revision 18710)
+++ trunk/base/tests/trace/Makefile	(revision 18721)
@@ -9,5 +9,7 @@
 test:
 	@PORTSRC=$(PORTSRC) $(bindir)/port clean > /dev/null
+	@touch delete-trace
 	@PORTSRC=$(PORTSRC) $(bindir)/port -t test > output 2>&1 || (cat output; exit 1)
+	@rm -f delete-trace
 	@sed -e "s|${PWD}|PWD|g" < output > output.sed
 	@diff output.sed master 2>&1 | tee difference
@@ -15,4 +17,4 @@
 		exit 1; \
 	else \
-		rm -f difference; \
+		rm -f difference output.sed; \
 	fi
Index: trunk/base/tests/trace/Portfile
===================================================================
--- trunk/base/tests/trace/Portfile	(revision 18710)
+++ trunk/base/tests/trace/Portfile	(revision 18721)
@@ -1,3 +1,3 @@
-# $Id: Portfile,v 1.2 2006/07/24 05:55:44 pguyot Exp $
+# $Id: Portfile,v 1.3 2006/07/25 04:01:34 pguyot Exp $
 
 PortSystem 1.0
@@ -20,5 +20,6 @@
 
 test {  
-	catch {system "rm -f hello-trace && touch hello-trace && rm hello-trace"}
+	catch {system "rm -f create-trace && touch create-trace && rm create-trace"}
+	catch {system "rm delete-trace"}
 	catch {system "rm -f /tmp/hello-trace && /tmp/hello-trace && rm /tmp/hello-trace"}
 }
Index: trunk/base/tests/trace/master
===================================================================
--- trunk/base/tests/trace/master	(revision 18710)
+++ trunk/base/tests/trace/master	(revision 18721)
@@ -5,3 +5,4 @@
 --->  Building trace with target all
 --->  Testing trace
-Warning: A file creation/writing was attempted outside sandbox: PWD/hello-trace
+Warning: A file creation/deletion/modification was attempted outside sandbox: PWD/create-trace
+Warning: A file creation/deletion/modification was attempted outside sandbox: PWD/delete-trace
