mdebray/tvl-depot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Darwin sandbox: Disallow creating setuid/setgid binaries

Browse source 
Suggested by Daiderd Jordan.
This commit is contained in:
Eelco Dolstra 2017-05-30 17:16:49 +02:00
parent 83eec5a997
commit 53a1644187
No known key found for this signature in database
GPG key ID: 8170B4726D7198DE
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/libstore/build.cc
View file

@ -2656,6 +2656,10 @@ void DerivationGoal::runChild()
sandboxProfile += "(deny default (with no-log))\n"; sandboxProfile += "(deny default (with no-log))\n";
} }
/* Disallow creating setuid/setgid binaries, since that
would allow breaking build user isolation. */
sandboxProfile += "(deny file-write-setugid)\n";
/* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms
to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */ to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */
Path globalTmpDir = canonPath(getEnv("TMPDIR", "/tmp"), true); Path globalTmpDir = canonPath(getEnv("TMPDIR", "/tmp"), true);