diff options
Diffstat (limited to 'doc/manual/command-ref')
| -rw-r--r-- | doc/manual/command-ref/conf-file.xml | 17 | ||||
| -rw-r--r-- | doc/manual/command-ref/nix-instantiate.xml | 3 |
2 files changed, 19 insertions, 1 deletions
diff --git a/doc/manual/command-ref/conf-file.xml b/doc/manual/command-ref/conf-file.xml index 616983bc7f0e..cde32b35f5b4 100644 --- a/doc/manual/command-ref/conf-file.xml +++ b/doc/manual/command-ref/conf-file.xml @@ -643,6 +643,23 @@ password <replaceable>my-password</replaceable> </varlistentry> + <varlistentry xml:id="conf-allow-new-privileges"><term><literal>allow-new-privileges</literal></term> + + <listitem><para>(Linux-specific.) By default, builders on Linux + cannot acquire new privileges by calling setuid/setgid programs or + programs that have file capabilities. For example, programs such + as <command>sudo</command> or <command>ping</command> will + fail. (Note that in sandbox builds, no such programs are available + unless you bind-mount them into the sandbox via the + <option>build-sandbox-paths</option> option.) You can allow the + use of such programs by enabling this option. This is impure and + usually undesirable, but may be useful in certain scenarios + (e.g. to spin up containers or set up userspace network interfaces + in tests).</para></listitem> + + </varlistentry> + + </variablelist> </para> diff --git a/doc/manual/command-ref/nix-instantiate.xml b/doc/manual/command-ref/nix-instantiate.xml index 3d03358bea3f..fe077ff65603 100644 --- a/doc/manual/command-ref/nix-instantiate.xml +++ b/doc/manual/command-ref/nix-instantiate.xml @@ -43,7 +43,8 @@ <arg choice='plain'><option>-E</option></arg> </group> <arg choice='plain' rep='repeat'><replaceable>files</replaceable></arg> - <sbr/> + </cmdsynopsis> + <cmdsynopsis> <command>nix-instantiate</command> <arg choice='plain'><option>--find-file</option></arg> <arg choice='plain' rep='repeat'><replaceable>files</replaceable></arg> |