wroclaw-git-backups/nix
1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-07-07 14:21:48 +02:00
Code Activity

Add a NixOS test for the sandbox escape

Browse source 
Test that we can't leverage abstract unix domain sockets to leak file
descriptors out of the sandbox and modify the path after it has been
registered.

Co-authored-by: Theophane Hufschmitt <theophane.hufschmitt@tweag.io>
This commit is contained in:
Tom Bereknyei 2024-03-01 03:42:26 -05:00 • committed by Théophane Hufschmitt
parent ec177b98f3
commit f8d20e91a4
4 changed files with 223 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
flake.nix
View file

@ -634,6 +634,8 @@
["i686-linux" "x86_64-linux"]
(system: runNixOSTestFor system ./tests/nixos/setuid.nix);
tests.ca-fd-leak = runNixOSTestFor "x86_64-linux" ./tests/nixos/ca-fd-leak;
# Make sure that nix-env still produces the exact same result
# on a particular version of Nixpkgs.