wroclaw-git-backups/nix
1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-07-09 03:43:54 +02:00
Code Activity

Add a seccomp filter to prevent creating setuid/setgid binaries

Browse source 
This prevents builders from setting the S_ISUID or S_ISGID bits,
preventing users from using a nixbld* user to create a setuid/setgid
binary to interfere with subsequent builds under the same nixbld* uid.

This is based on aszlig's seccomp code
(47f587700d).

Reported by Linus Heckemann.
This commit is contained in:
Eelco Dolstra 2017-05-29 11:34:24 +02:00
parent 6e01ecd112
commit 6cc6c15a2d
No known key found for this signature in database
GPG key ID: 8170B4726D7198DE
5 changed files with 54 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
release.nix
View file

@ -30,6 +30,7 @@ let
docbook5 docbook5_xsl
autoconf-archive
git
libseccomp
];
configureFlags = "--enable-gc";
@ -78,6 +79,7 @@ let
openssl pkgconfig sqlite boehmgc
]
++ lib.optional stdenv.isLinux libseccomp
++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium
++ lib.optional (stdenv.isLinux || stdenv.isDarwin)
(aws-sdk-cpp.override {