about summary refs log tree commit diff
path: root/src/libstore/store-api.cc
diff options
context:
space:
mode:
authorEelco Dolstra <edolstra@gmail.com>2017-05-29T09·34+0200
committerEelco Dolstra <edolstra@gmail.com>2017-05-29T14·14+0200
commit6cc6c15a2d50d0021d7242e9806ed6d54538de17 (patch)
treee9a5fbd03cd6c1e0a1d8b68fff784f2d0f29dee7 /src/libstore/store-api.cc
parent6e01ecd112dce8d8bbe46c839f982892a3ffb589 (diff)
Add a seccomp filter to prevent creating setuid/setgid binaries
This prevents builders from setting the S_ISUID or S_ISGID bits,
preventing users from using a nixbld* user to create a setuid/setgid
binary to interfere with subsequent builds under the same nixbld* uid.

This is based on aszlig's seccomp code
(47f587700d646f5b03a42f2fa57c28875a31efbe).

Reported by Linus Heckemann.
Diffstat (limited to 'src/libstore/store-api.cc')
0 files changed, 0 insertions, 0 deletions