about summary refs log tree commit diff
path: root/src/libstore/sandbox-minimal.sb
diff options
context:
space:
mode:
authorEelco Dolstra <edolstra@gmail.com>2017-06-06T16·44+0200
committerEelco Dolstra <edolstra@gmail.com>2017-06-06T16·44+0200
commit85e93d7b874f99730387714394bb60407cf138d5 (patch)
treea8b27c3200ce4d8dca85d9dc3f414bedb3c1d0bc /src/libstore/sandbox-minimal.sb
parentd3f780996c05d348bd44fe846520153d5c1ae31c (diff)
Always use the Darwin sandbox
Even with "build-use-sandbox = false", we now use sandboxing with a
permissive profile that allows everything except the creation of
setuid/setgid binaries.
Diffstat (limited to 'src/libstore/sandbox-minimal.sb')
-rw-r--r--src/libstore/sandbox-minimal.sb5
1 files changed, 5 insertions, 0 deletions
diff --git a/src/libstore/sandbox-minimal.sb b/src/libstore/sandbox-minimal.sb
new file mode 100644
index 000000000000..65f5108b3990
--- /dev/null
+++ b/src/libstore/sandbox-minimal.sb
@@ -0,0 +1,5 @@
+(allow default)
+
+; Disallow creating setuid/setgid binaries, since that
+; would allow breaking build user isolation.
+(deny file-write-setugid)