6cc6c15a2d
This prevents builders from setting the S_ISUID or S_ISGID bits,
preventing users from using a nixbld* user to create a setuid/setgid
binary to interfere with subsequent builds under the same nixbld* uid.
This is based on aszlig's seccomp code
(
|
||
---|---|---|
.. | ||
boost | ||
build-remote | ||
buildenv | ||
libexpr | ||
libmain | ||
libstore | ||
libutil | ||
linenoise | ||
nix | ||
nix-build | ||
nix-channel | ||
nix-collect-garbage | ||
nix-copy-closure | ||
nix-daemon | ||
nix-env | ||
nix-instantiate | ||
nix-prefetch-url | ||
nix-store | ||
resolve-system-dependencies |