diff options
| author | Eelco Dolstra <edolstra@gmail.com> | 2017-05-29T09·34+0200 |
|---|---|---|
| committer | Eelco Dolstra <edolstra@gmail.com> | 2017-05-29T14·14+0200 |
| commit | 6cc6c15a2d50d0021d7242e9806ed6d54538de17 (patch) | |
| tree | e9a5fbd03cd6c1e0a1d8b68fff784f2d0f29dee7 /src/libstore/local.mk | |
| parent | 6e01ecd112dce8d8bbe46c839f982892a3ffb589 (diff) | |
Add a seccomp filter to prevent creating setuid/setgid binaries
This prevents builders from setting the S_ISUID or S_ISGID bits, preventing users from using a nixbld* user to create a setuid/setgid binary to interfere with subsequent builds under the same nixbld* uid. This is based on aszlig's seccomp code (47f587700d646f5b03a42f2fa57c28875a31efbe). Reported by Linus Heckemann.
Diffstat (limited to 'src/libstore/local.mk')
| -rw-r--r-- | src/libstore/local.mk | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/libstore/local.mk b/src/libstore/local.mk index e06002587f94..ffdb55abc65b 100644 --- a/src/libstore/local.mk +++ b/src/libstore/local.mk @@ -18,6 +18,10 @@ ifeq ($(OS), SunOS) libstore_LDFLAGS += -lsocket endif +ifeq ($(OS), Linux) + libstore_LDFLAGS += -lseccomp +endif + libstore_CXXFLAGS = \ -DNIX_PREFIX=\"$(prefix)\" \ -DNIX_STORE_DIR=\"$(storedir)\" \ |