about summary refs log tree commit diff
path: root/src/libstore/sandbox-defaults.sb
AgeCommit message (Collapse)AuthorFilesLines
2017-11-08 Remove extraneous commentEelco Dolstra1-3/+0
2017-11-08 Merge pull request #1650 from copumpkin/darwin-sandbox-unix-socketEelco Dolstra1-1/+8
Always allow builds to use unix domain sockets in Darwin sandbox
2017-11-03 Allow getpwuid in the darwin sandbox.Daiderd Jordan1-0/+3
2017-10-31 Always allow builds to use unix domain sockets in Darwin sandboxDan Peebles1-1/+8
2017-10-30 Allow optional localhost network access to sandboxed derivationsDan Peebles1-2/+24
This will allow bind and connect to 127.0.0.1, which can reduce purity/ security (if you're running a vulnerable service on localhost) but is also needed for a ton of test suites, so I'm leaving it turned off by default but allowing certain derivations to turn it on as needed. It also allows DNS resolution of arbitrary hostnames but I haven't found a way to avoid that. In principle I'd just want to allow resolving localhost but that doesn't seem to be possible. I don't think this belongs under `build-use-sandbox = relaxed` because we want it on Hydra and I don't think it's the end of the world.
2017-06-06 Always use the Darwin sandboxEelco Dolstra1-0/+2
Even with "build-use-sandbox = false", we now use sandboxing with a permissive profile that allows everything except the creation of setuid/setgid binaries.
2017-05-31 OS X sandbox: Improve builtin sandbox profileEelco Dolstra1-50/+44
Also, add rules to allow fixed-output derivations to access the network. These rules are sufficient to build stdenvDarwin without any __sandboxProfile magic.
2017-05-30 Darwin sandbox: Use sandbox-defaults.sbEelco Dolstra1-0/+62
Issue #759. Also, remove nix.conf from the sandbox since I don't really see a legitimate reason for builders to access the Nix configuration.