From c2fd44e9d7b80d4ac7973ed8c5bfa2b90943cc81 Mon Sep 17 00:00:00 2001
From: Alois Wohlschlager <alois1@gmx-topmail.de>
Date: Mon, 1 Jul 2024 09:18:01 +0200
Subject: [PATCH] libstore/build: block io_uring

Change-Id: I45d3895f95abe1bc103a63969f444c334dbbf50d
---
 src/libstore/build/local-derivation-goal.cc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index c83205924..d9571696c 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -1588,9 +1588,9 @@ void setupSeccomp()
     allowSyscall(ctx, SCMP_SYS(ioprio_set));
     allowSyscall(ctx, SCMP_SYS(io_setup));
     allowSyscall(ctx, SCMP_SYS(io_submit));
-    allowSyscall(ctx, SCMP_SYS(io_uring_enter));
-    allowSyscall(ctx, SCMP_SYS(io_uring_register));
-    allowSyscall(ctx, SCMP_SYS(io_uring_setup));
+    // skip io_uring_enter (may become dangerous)
+    // skip io_uring_register (may become dangerous)
+    // skip io_uring_setup (may become dangerous)
     allowSyscall(ctx, SCMP_SYS(ipc));
     allowSyscall(ctx, SCMP_SYS(kcmp));
     allowSyscall(ctx, SCMP_SYS(kexec_file_load));