diff options
| author | Vincent Ambo <tazjin@google.com> | 2020-05-17T14·52+0100 |
|---|---|---|
| committer | Vincent Ambo <tazjin@google.com> | 2020-05-17T14·52+0100 |
| commit | 7994fd1d545cc5c876d6f21db7ddf9185d23dad6 (patch) | |
| tree | 32dd695785378c5b9c8be97fc583e9dfc62cb105 /third_party/nix/src/libstore/sandbox-network.sb | |
| parent | cf8cd640c1adf74a3706efbcb0ea4625da106fb2 (diff) | |
| parent | 90b3b31dc27f31e9b11653a636025d29ddb087a3 (diff) | |
Add 'third_party/nix/' from commit 'be66c7a6b24e3c3c6157fd37b86c7203d14acf10' r/724
git-subtree-dir: third_party/nix git-subtree-mainline: cf8cd640c1adf74a3706efbcb0ea4625da106fb2 git-subtree-split: be66c7a6b24e3c3c6157fd37b86c7203d14acf10
Diffstat (limited to 'third_party/nix/src/libstore/sandbox-network.sb')
| -rw-r--r-- | third_party/nix/src/libstore/sandbox-network.sb | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/third_party/nix/src/libstore/sandbox-network.sb b/third_party/nix/src/libstore/sandbox-network.sb new file mode 100644 index 000000000000..56beec761fa8 --- /dev/null +++ b/third_party/nix/src/libstore/sandbox-network.sb @@ -0,0 +1,16 @@ +; Allow local and remote network traffic. +(allow network* (local ip) (remote ip)) + +; Allow access to /etc/resolv.conf (which is a symlink to +; /private/var/run/resolv.conf). +(allow file-read-metadata + (literal "/var") + (literal "/etc") + (literal "/etc/resolv.conf") + (literal "/private/etc/resolv.conf")) + +(allow file-read* + (literal "/private/var/run/resolv.conf")) + +; Allow DNS lookups. +(allow network-outbound (remote unix-socket (path-literal "/private/var/run/mDNSResponder"))) |