From 4876bb012e78e6e397f34fd7fb91f67520cbd744 Mon Sep 17 00:00:00 2001
From: Jude Taylor <me@jude.bio>
Date: Sat, 14 Nov 2015 13:52:33 -0800
Subject: [PATCH] simplify build permissions

---
 release.nix           |  7 +++----
 src/libstore/build.cc | 16 +++-------------
 2 files changed, 6 insertions(+), 17 deletions(-)

diff --git a/release.nix b/release.nix
index cb391d0ff..8935cfa19 100644
--- a/release.nix
+++ b/release.nix
@@ -97,10 +97,9 @@ let
 
         enableParallelBuilding = true;
 
-        __sandboxProfile = lib.sandbox.allowNetwork
-          + lib.sandbox.allowFileRead {
-            literal = [ "/etc" "/etc/nix/nix.conf" "/private/etc/nix/nix.conf" ];
-          };
+        __sandboxProfile = lib.sandbox.allowFileRead [
+          "/etc" "/etc/nix/nix.conf" "/private/etc/nix/nix.conf"
+        ];
 
         makeFlags = "profiledir=$(out)/etc/profile.d";
 
diff --git a/src/libstore/build.cc b/src/libstore/build.cc
index 5cd695b1c..32325a6b1 100644
--- a/src/libstore/build.cc
+++ b/src/libstore/build.cc
@@ -2498,13 +2498,8 @@ void DerivationGoal::runChild()
             }
             sandboxProfile += ")\n";
 
-            /* Our inputs (transitive dependencies and any impurities computed above)
-               Note that the sandbox profile allows file-write* even though it isn't seemingly necessary. First of all, nix's standard user permissioning
-               mechanism still prevents builders from writing to input directories, so no security/purity is lost. The reason we allow file-write* is that
-               denying it means the `access` syscall will return EPERM instead of EACCESS, which confuses a few programs that assume (understandably, since
-               it appears to be a violation of the POSIX spec) that `access` won't do that, and don't deal with it nicely if it does. The most notable of
-               these is the entire GHC Haskell ecosystem. */
-            sandboxProfile += "(allow file-read* file-write* process-exec mach-priv-task-port\n";
+            /* Our inputs (transitive dependencies and any impurities computed above) */
+            sandboxProfile += "(allow file-read* process-exec\n";
             for (auto & i : dirsInChroot) {
                 if (i.first != i.second)
                     throw SysError(format("can't map '%1%' to '%2%': mismatched impure paths not supported on darwin"));
@@ -2520,12 +2515,7 @@ void DerivationGoal::runChild()
             }
             sandboxProfile += ")\n";
 
-            /* Our ancestry. N.B: this uses literal on folders, instead of subpath. Without that,
-               you open up the entire filesystem because you end up with (subpath "/")
-               Note: file-read-metadata* is not sufficiently permissive for GHC. file-read* is but may
-               be a security hazard.
-               TODO: figure out a more appropriate directive.
-             */
+            /* Allow file-read* on full directory hierarchy to self. Allows realpath() */
             sandboxProfile += "(allow file-read*\n";
             for (auto & i : ancestry) {
                 sandboxProfile += (format("\t(literal \"%1%\")\n") % i.c_str()).str();