Add doc/sandbox (osx seatbelt and openbsd systrace support)

doc/osx

@@ -31,5 +31,5 @@ $ cd binr/radare2
 $ make osxsign
 
 To create the package
-cd macports
-make
+
+$ sys/osx-pkg.sh

doc/sandbox/Makefile

@@ -0,0 +1,5 @@
+all:
+	# must succeess
+	sandbox-exec -f radare2.sb /usr/bin/r2 /bin/ls
+	# must fail
+	sandbox-exec -f radare2.sb /usr/bin/r2 /bin/md5

doc/sandbox/README.md

@@ -0,0 +1,34 @@
+Sandboxing r2
+=============
+
+OSX:
+
+	OSX Seatbelt implements a system-level sandbox for applications,
+	it's rules are defined in lispy .sb file:
+
+	sandbox-exec -f radare2.sb r2 -S /bin/ls
+
+	NOTE: r2 -S is an alias for -e cfg.sandbox=true
+
+
+OpenBSD:
+
+	$ man systrace
+
+	Generate default profile
+
+		$ systrace -A r2 /bin/ls
+
+	Run with the generated profile
+
+		$ systrace -a r2 -S /bin/ls
+
+Windows:
+Linux:
+	Only r2's sandbox is supported.
+	- disables file system access
+	- disables network connectivity
+	- disables forks (no shell escapes or debugger)
+	- activated before showing the prompt
+
+	$ r2 -S /bin/ls

doc/sandbox/rabin2.sb

@@ -0,0 +1,39 @@
+; Seatbelt script to sandbox radare2 in OSX
+; =========================================
+; --pancake <nopcode.org>
+;
+
+(version 1)
+(debug all)
+
+; (allow default)
+
+(deny network*)
+(deny system*)
+(deny sysctl*)
+(deny file-write*)
+(deny file-ioctl)
+(deny mach*)
+
+
+; disables debugger and ! shell escape
+(allow process*)
+(deny process-fork)
+
+; record trace log
+; (trace "r2.log")
+
+; (deny file-read* (subpath "."))
+; (allow file-read*)
+; (deny file-read*)
+
+(allow file-read*
+    (regex
+	#"^/Users/[^.]+/*/radare2/"
+        #"^/usr/share/radare2/*"
+        #"^/usr/lib/system/*"
+        #"^/usr/lib/libr*"
+        #"^/usr/bin/rabin2"
+    )   
+)
+(deny default)

doc/sandbox/radare2.sb

@@ -0,0 +1,42 @@
+; Seatbelt script to sandbox radare2 in OSX
+; =========================================
+; --pancake <nopcode.org>
+;
+
+(version 1)
+(debug all)
+
+; (allow default)
+
+(deny network*)
+(deny system*)
+(deny sysctl*)
+(deny file-write*)
+(deny file-ioctl)
+(deny mach*)
+
+
+; disables debugger and ! shell escape
+(allow process*)
+(deny process-fork)
+
+; record trace log
+; (trace "r2.log")
+
+; (deny file-read* (subpath "."))
+; (allow file-read*)
+; (deny file-read*)
+
+(allow file-read*
+    (regex
+        #"^/Users/[^.]+/.config/radare2/$"
+	#"^/Users/[^.]+/*/radare2/"
+        #"^/usr/share/radare2/*"
+        #"^/usr/lib/system/*"
+        #"^/usr/bin/radare2"
+        #"^/usr/lib/libr*"
+        #"^/usr/bin/r2"
+        #"^/bin/ls"
+    )   
+)
+(deny default)