lix/src/libstore/build/sandbox-minimal.sb

R""(

(allow default)

; Disallow creating setuid/setgid binaries, since that
; would allow breaking build user isolation.
(deny file-write-setugid)

)""
Include macOS sandbox files in the Nix binary This basically reverts 6e5165b77370c76bfa39d4b55e9f83673f3bd466. It fixes errors like sandbox-exec: <internal init prelude>:292:47: unable to open sandbox-minimal.sb: not found when trying to run a development Nix installed in a user's home directory. Also, we're trying to minimize the number of installed files to make it possible to deploy Nix as a single statically-linked binary. 2023-01-04 12:36:07 +00:00			`R""(`

Always use the Darwin sandbox Even with "build-use-sandbox = false", we now use sandboxing with a permissive profile that allows everything except the creation of setuid/setgid binaries. 2017-06-06 16:44:49 +00:00			`(allow default)`

			`; Disallow creating setuid/setgid binaries, since that`
			`; would allow breaking build user isolation.`
			`(deny file-write-setugid)`
Include macOS sandbox files in the Nix binary This basically reverts 6e5165b77370c76bfa39d4b55e9f83673f3bd466. It fixes errors like sandbox-exec: <internal init prelude>:292:47: unable to open sandbox-minimal.sb: not found when trying to run a development Nix installed in a user's home directory. Also, we're trying to minimize the number of installed files to make it possible to deploy Nix as a single statically-linked binary. 2023-01-04 12:36:07 +00:00
			`)""`