mirror of
https://github.com/NixOS/nix
synced 2025-06-24 22:11:15 +02:00
88b7db1ba4
If a build directory is accessible to other users it is possible to smuggle data in and out of build directories. Usually this is only a build purity problem, but in combination with other issues it can be used to break out of a build sandbox. to prevent this we default to using a subdirectory of nixStateDir (which is more restrictive). (cherry picked from pennae Lix commit 55b416f6897fb0d8a9315a530a9b7f0914458ded) (store setting done by roberth)
2 lines
112 B
Text
2 lines
112 B
Text
d @localstatedir@/nix/daemon-socket 0755 root root - -
|
|
d @localstatedir@/nix/builds 0755 root root 7d -
|