diff options
Diffstat (limited to 'src/libstore/sandbox-minimal.sb')
| -rw-r--r-- | src/libstore/sandbox-minimal.sb | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/libstore/sandbox-minimal.sb b/src/libstore/sandbox-minimal.sb new file mode 100644 index 000000000000..65f5108b3990 --- /dev/null +++ b/src/libstore/sandbox-minimal.sb @@ -0,0 +1,5 @@ +(allow default) + +; Disallow creating setuid/setgid binaries, since that +; would allow breaking build user isolation. +(deny file-write-setugid) |