wroclaw-git-backups/nix
1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-07-07 01:51:47 +02:00
Code Activity

Darwin sandbox: Use sandbox-defaults.sb

Browse source 
Issue #759.

Also, remove nix.conf from the sandbox since I don't really see a
legitimate reason for builders to access the Nix configuration.
This commit is contained in:
Eelco Dolstra 2017-05-30 17:40:12 +02:00
parent 53a1644187
commit acc889c821
No known key found for this signature in database
GPG key ID: 8170B4726D7198DE
5 changed files with 19 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/libstore/build.cc
View file

@ -2656,9 +2656,9 @@ void DerivationGoal::runChild()
sandboxProfile += "(deny default (with no-log))\n";
}
/* Disallow creating setuid/setgid binaries, since that
would allow breaking build user isolation. */
sandboxProfile += "(deny file-write-setugid)\n";
sandboxProfile +=
#include "sandbox-defaults.sb.gen.hh"
;
/* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms
to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */