about summary refs log tree commit diff
path: root/src/libstore/sandbox-network.sb
diff options
context:
space:
mode:
authorEelco Dolstra <edolstra@gmail.com>2017-05-31T15·23+0200
committerEelco Dolstra <edolstra@gmail.com>2017-05-31T15·25+0200
commitc96e8cd097ce0d181467fddd92acad4341ca566a (patch)
tree7783c7735ed0309fb7c854b7f7780224784759d1 /src/libstore/sandbox-network.sb
parent5ea8161b552ad79b7caf9b68b3c7d6daab203266 (diff)
OS X sandbox: Improve builtin sandbox profile
Also, add rules to allow fixed-output derivations to access the
network.

These rules are sufficient to build stdenvDarwin without any
__sandboxProfile magic.
Diffstat (limited to 'src/libstore/sandbox-network.sb')
-rw-r--r--src/libstore/sandbox-network.sb16
1 files changed, 16 insertions, 0 deletions
diff --git a/src/libstore/sandbox-network.sb b/src/libstore/sandbox-network.sb
new file mode 100644
index 000000000000..56beec761fa8
--- /dev/null
+++ b/src/libstore/sandbox-network.sb
@@ -0,0 +1,16 @@
+; Allow local and remote network traffic.
+(allow network* (local ip) (remote ip))
+
+; Allow access to /etc/resolv.conf (which is a symlink to
+; /private/var/run/resolv.conf).
+(allow file-read-metadata
+       (literal "/var")
+       (literal "/etc")
+       (literal "/etc/resolv.conf")
+       (literal "/private/etc/resolv.conf"))
+
+(allow file-read*
+       (literal "/private/var/run/resolv.conf"))
+
+; Allow DNS lookups.
+(allow network-outbound (remote unix-socket (path-literal "/private/var/run/mDNSResponder")))