From 6cc6c15a2d50d0021d7242e9806ed6d54538de17 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 29 May 2017 11:34:24 +0200
Subject: Add a seccomp filter to prevent creating setuid/setgid binaries

This prevents builders from setting the S_ISUID or S_ISGID bits,
preventing users from using a nixbld* user to create a setuid/setgid
binary to interfere with subsequent builds under the same nixbld* uid.

This is based on aszlig's seccomp code
(47f587700d646f5b03a42f2fa57c28875a31efbe).

Reported by Linus Heckemann.
---
 release.nix | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'release.nix')

diff --git a/release.nix b/release.nix
index f1a553d01cc6..1e854a075f6d 100644
--- a/release.nix
+++ b/release.nix
@@ -30,6 +30,7 @@ let
             docbook5 docbook5_xsl
             autoconf-archive
             git
+            libseccomp
           ];
 
         configureFlags = "--enable-gc";
@@ -78,6 +79,7 @@ let
             openssl pkgconfig sqlite boehmgc
 
           ]
+          ++ lib.optional stdenv.isLinux libseccomp
           ++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium
           ++ lib.optional (stdenv.isLinux || stdenv.isDarwin)
             (aws-sdk-cpp.override {
-- 
cgit 1.4.1