wroclaw-git-backups/nix
1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-07-07 01:51:47 +02:00
Code Activity

Add a NixOS test for the sandbox escape

Browse source 
Test that we can't leverage abstract unix domain sockets to leak file
descriptors out of the sandbox and modify the path after it has been
registered.
This commit is contained in:
Théophane Hufschmitt 2024-02-12 21:28:20 +01:00
parent d829c21ef3
commit ca05f6d203
4 changed files with 223 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/nixos/default.nix
View file

@ -40,4 +40,6 @@ in
setuid = lib.genAttrs
["i686-linux" "x86_64-linux"]
(system: runNixOSTestFor system ./setuid.nix);
ca-fd-leak = runNixOSTestFor "x86_64-linux" ./ca-fd-leak;
}