Document that final hook match wins

Signed-off-by: Allan McRae <allan@archlinux.org>
(cherry picked from commit 8ebdccd4d6)

README

@@ -765,7 +765,7 @@ Fine-grained sandbox controls:
 - ALPM_ERR_RETRUEVE_PREPARE
 
 [CHANGED]
-- error codes:
-    PM_ERR_TRANS_COMMITING renamed to PM_ERR_TRANS_COMMITTING
 - alpm_pubkey_t - removed pubkey_algo member
 - alpm_sandbox_setup_child() - added parameter to restrict syscalls
+- alpm_option_get_disable_standbox() - returns 1 if any component is
+  disabled, 2 if all components are disabled.

doc/alpm-hooks.5.asciidoc

@@ -63,7 +63,8 @@ defined the hook will run if the transaction matches *any* of the triggers.
 	Paths refer to the files in the package archive; the installation root
 	should *not* be included in the path.  Shell-style glob patterns are
 	allowed. It is possible to invert matches by prepending a target with an
-	exclamation mark. May be specified multiple times. Required.
+	exclamation mark. May be specified multiple times, with subsequent
+	matches overriding previous ones. Required.
 
 ACTIONS
 -------

lib/libalpm/alpm.h

@@ -2307,6 +2307,19 @@ int alpm_option_set_parallel_downloads(alpm_handle_t *handle, unsigned int num_s
  * @{
  */
 
+/** Get the state of the sandbox
+ * @param handle the context handle
+ * @return 0 for enabled, 1 if any component is disabled, 2 if completely disabled
+ */
+int alpm_option_get_disable_sandbox(alpm_handle_t *handle);
+
+/** Enables/disables all components of the sandbox.
+ * @param handle the context handle
+ * @param disable_sandbox 0 for enabled, 1 for disabled
+ * @return 0 on success, -1 on error (pm_errno is set accordingly)
+ */
+int alpm_option_set_disable_sandbox(alpm_handle_t *handle, unsigned short disable_sandbox);
+
 /** Get the state of the filesystem part of the sandbox
  * @param handle the context handle
  * @return 0 for enabled, 1 for disabled

lib/libalpm/handle.c

@@ -968,6 +968,26 @@ int SYMEXPORT alpm_option_set_parallel_downloads(alpm_handle_t *handle,
 	return 0;
 }
 
+int alpm_option_get_disable_sandbox(alpm_handle_t *handle)
+{
+	CHECK_HANDLE(handle, return -1);
+
+	if(handle->disable_sandbox_filesystem && handle->disable_sandbox_syscalls) {
+		return 2;
+	} else if (handle->disable_sandbox_filesystem || handle->disable_sandbox_syscalls) {
+		return 1;
+	}
+
+	return 0;
+}
+
+int alpm_option_set_disable_sandbox(alpm_handle_t *handle, unsigned short disable_sandbox) {
+	CHECK_HANDLE(handle, return -1);
+	handle->disable_sandbox_filesystem = disable_sandbox;
+	handle->disable_sandbox_syscalls = disable_sandbox;
+	return 0;
+}
+
 int SYMEXPORT alpm_option_get_disable_sandbox_filesystem(alpm_handle_t *handle)
 {
 	CHECK_HANDLE(handle, return -1);

meson.build

@@ -10,7 +10,7 @@ project('pacman',
         ],
         meson_version : '>= 0.61')
 
-libalpm_version = '16.0.0'
+libalpm_version = '16.0.1'
 
 cc = meson.get_compiler('c')
 

scripts/libmakepkg/lint_pkgbuild/arch.sh.in

@@ -88,7 +88,7 @@ validate_arch_override() {
 
 	for o in "${override[@]}"; do
 		if ! in_array "$o" "${arch[@]}"; then
-			error "$(gettext "Overriden %s in package_%s() contains value not in global directive: '%s'")" "arch" "$package" "$o"
+			error "$(gettext "Overridden %s in package_%s() contains value not in global directive: '%s'")" "arch" "$package" "$o"
 			ret=1
 		fi
 	done

src/pacman/pacman.c

@@ -1035,6 +1035,8 @@ static int parseargs(int argc, char *argv[])
 		{"color",      required_argument, 0, OP_COLOR},
 		{"disable-download-timeout", no_argument, 0, OP_DISABLEDLTIMEOUT},
 		{"disable-sandbox", no_argument, 0, OP_DISABLESANDBOX},
+		{"disable-sandbox-filesystem", no_argument, 0, OP_DISABLESANDBOXFILESYSTEM},
+		{"disable-sandbox-syscalls", no_argument, 0, OP_DISABLESANDBOXSYSCALLS},
 		{0, 0, 0, 0}
 	};