wroclaw-git-backups/nix
1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-06-25 02:21:16 +02:00
Code Activity

Add a NixOS test for the sandbox escape

Browse source 
Test that we can't leverage abstract unix domain sockets to leak file
descriptors out of the sandbox and modify the path after it has been
registered.
This commit is contained in:
Théophane Hufschmitt 2024-02-12 21:28:20 +01:00
parent 864fc85fc8
commit a55c6a0f47
4 changed files with 224 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
tests/nixos/default.nix
View file

@ -109,7 +109,7 @@ in
nix.package = lib.mkForce pkgs.nixVersions.nix_2_13;
};
};
# TODO: (nixpkgs update) remoteBuildsSshNg_remote_2_18 = ...
# Test our Nix as a builder for clients that are older
@ -156,4 +156,6 @@ in
(system: runNixOSTestFor system ./setuid.nix);
fetch-git = runNixOSTestFor "x86_64-linux" ./fetch-git;
ca-fd-leak = runNixOSTestFor "x86_64-linux" ./ca-fd-leak;
}