dnl Start with write access to parent dir to force tests to declare
dnl explicit deny paths when they want to test that behavior.  That
dnl way we get same result when run under an implicit write path like
dnl any of the tempdirs.  Same goes for predict access, but this is
dnl due to the default PM test env having that predict.
m4_defun([SB_RUN],[\
	env \
		SANDBOX_LOG="$PWD/sandbox.log" \
		sandbox.sh \
			addpredict / \; \
			addwrite "${PWD%/*}" \; \
			set -x \; \
])

m4_defun([AT_SB_CHECK],[AT_CHECK([SB_RUN $1],[$2],[$3],[$4],[$5],[$6])])

m4_defun([SB_CHECK],[dnl
AT_SETUP([SB_SECTION/$1])
AT_KEYWORDS([SB_SECTION])
AT_XFAIL_IF([(
	]SB_SECTION[-0 >/dev/null ; test $? -eq 77 && exit 0
	if expr ]SB_SECTION[ : .*_static >/dev/null ; then
		trace-0 ; test $? -eq 77 && exit 0
	fi
	exit 1
)])
AT_SB_CHECK(
	[. $abs_top_srcdir/tests/]SB_SECTION[-$1.sh],
	m4_ifval($4,$4,[0]),
	m4_ifval($2,$2,[ignore]),
	m4_ifval($3,$3,[ignore]))
AT_CLEANUP])