wroclaw-git-backups/nix
1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-07-18 07:08:27 +02:00
Code Activity

Merge pull request #13468 from xokdvium/darwin-sandbox-sockets

Browse source 
libstore: fix Unix sockets in the build directory on sandboxed macOS
This commit is contained in:
Eelco Dolstra 2025-07-14 11:13:36 +02:00 • committed by GitHub
commit 03bf582be3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/libstore/unix/build/darwin-derivation-builder.cc
View file

@ -160,6 +160,8 @@ struct DarwinDerivationBuilder : DerivationBuilderImpl
if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") { if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {
Strings sandboxArgs; Strings sandboxArgs;
sandboxArgs.push_back("_NIX_BUILD_TOP");
sandboxArgs.push_back(tmpDir);
sandboxArgs.push_back("_GLOBAL_TMP_DIR"); sandboxArgs.push_back("_GLOBAL_TMP_DIR");
sandboxArgs.push_back(globalTmpDir); sandboxArgs.push_back(globalTmpDir);
if (drvOptions.allowLocalNetworking) { if (drvOptions.allowLocalNetworking) {

6
src/libstore/unix/build/sandbox-defaults.sb
View file

@ -29,12 +29,14 @@ R""(
; Allow getpwuid. ; Allow getpwuid.
(allow mach-lookup (global-name "com.apple.system.opendirectoryd.libinfo")) (allow mach-lookup (global-name "com.apple.system.opendirectoryd.libinfo"))
; Access to /tmp. ; Access to /tmp and the build directory.
; The network-outbound/network-inbound ones are for unix domain sockets, which ; The network-outbound/network-inbound ones are for unix domain sockets, which
; we allow access to in TMPDIR (but if we allow them more broadly, you could in ; we allow access to in TMPDIR (but if we allow them more broadly, you could in
; theory escape the sandbox) ; theory escape the sandbox)
(allow file* process-exec network-outbound network-inbound (allow file* process-exec network-outbound network-inbound
(literal "/tmp") (subpath TMPDIR)) (literal "/tmp")
(subpath TMPDIR)
(subpath (param "_NIX_BUILD_TOP")))
; Some packages like to read the system version. ; Some packages like to read the system version.
(allow file-read* (allow file-read*