about summary refs log tree commit diff
path: root/third_party/nix/src/libstore/sandbox-network.sb
diff options
context:
space:
mode:
Diffstat (limited to 'third_party/nix/src/libstore/sandbox-network.sb')
-rw-r--r--third_party/nix/src/libstore/sandbox-network.sb16
1 files changed, 16 insertions, 0 deletions
diff --git a/third_party/nix/src/libstore/sandbox-network.sb b/third_party/nix/src/libstore/sandbox-network.sb
new file mode 100644
index 000000000000..56beec761fa8
--- /dev/null
+++ b/third_party/nix/src/libstore/sandbox-network.sb
@@ -0,0 +1,16 @@
+; Allow local and remote network traffic.
+(allow network* (local ip) (remote ip))
+
+; Allow access to /etc/resolv.conf (which is a symlink to
+; /private/var/run/resolv.conf).
+(allow file-read-metadata
+       (literal "/var")
+       (literal "/etc")
+       (literal "/etc/resolv.conf")
+       (literal "/private/etc/resolv.conf"))
+
+(allow file-read*
+       (literal "/private/var/run/resolv.conf"))
+
+; Allow DNS lookups.
+(allow network-outbound (remote unix-socket (path-literal "/private/var/run/mDNSResponder")))