about summary refs log tree commit diff
diff options
context:
space:
mode:
authorDan Peebles <pumpkin@me.com>2017-10-31T12·16+0100
committerDan Peebles <pumpkin@me.com>2017-10-31T14·33+0100
commitbc6b3f7e8fa46c183e20a9f28a5e0a7a6a19429d (patch)
tree201bd3442faa21615d50511f87c723bec633ea82
parent72cd52c3cdd1fc465fade6d553b3823aca9f8b6e (diff)
Always allow builds to use unix domain sockets in Darwin sandbox
-rw-r--r--src/libstore/sandbox-defaults.sb9
1 files changed, 8 insertions, 1 deletions
diff --git a/src/libstore/sandbox-defaults.sb b/src/libstore/sandbox-defaults.sb
index cf700c62c6fb..b4e29c94381c 100644
--- a/src/libstore/sandbox-defaults.sb
+++ b/src/libstore/sandbox-defaults.sb
@@ -22,7 +22,14 @@
 (allow signal (target same-sandbox))
 
 ; Access to /tmp.
-(allow file* process-exec (literal "/tmp") (subpath TMPDIR))
+; The network-outbound/network-inbound ones are for unix domain sockets, which
+; we allow access to in TMPDIR (but if we allow them more broadly, you could in
+; theory escape the sandbox)
+(allow file* process-exec network-outbound network-inbound
+       (literal "/tmp") (subpath TMPDIR))
+
+; Always allow unix domain sockets, since they can't hurt purity or security
+
 
 ; Some packages like to read the system version.
 (allow file-read* (literal "/System/Library/CoreServices/SystemVersion.plist"))