diff options
| author | Eelco Dolstra <edolstra@gmail.com> | 2017-05-31T15·23+0200 |
|---|---|---|
| committer | Eelco Dolstra <edolstra@gmail.com> | 2017-05-31T15·25+0200 |
| commit | c96e8cd097ce0d181467fddd92acad4341ca566a (patch) | |
| tree | 7783c7735ed0309fb7c854b7f7780224784759d1 /src/libstore/sandbox-network.sb | |
| parent | 5ea8161b552ad79b7caf9b68b3c7d6daab203266 (diff) | |
OS X sandbox: Improve builtin sandbox profile
Also, add rules to allow fixed-output derivations to access the network. These rules are sufficient to build stdenvDarwin without any __sandboxProfile magic.
Diffstat (limited to 'src/libstore/sandbox-network.sb')
| -rw-r--r-- | src/libstore/sandbox-network.sb | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/src/libstore/sandbox-network.sb b/src/libstore/sandbox-network.sb new file mode 100644 index 0000000000..56beec761f --- /dev/null +++ b/src/libstore/sandbox-network.sb @@ -0,0 +1,16 @@ +; Allow local and remote network traffic. +(allow network* (local ip) (remote ip)) + +; Allow access to /etc/resolv.conf (which is a symlink to +; /private/var/run/resolv.conf). +(allow file-read-metadata + (literal "/var") + (literal "/etc") + (literal "/etc/resolv.conf") + (literal "/private/etc/resolv.conf")) + +(allow file-read* + (literal "/private/var/run/resolv.conf")) + +; Allow DNS lookups. +(allow network-outbound (remote unix-socket (path-literal "/private/var/run/mDNSResponder"))) |