From 53a16441878ebd4a5ac6ef8a95a649bfd521da3d Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Tue, 30 May 2017 17:16:49 +0200 Subject: [PATCH] Darwin sandbox: Disallow creating setuid/setgid binaries Suggested by Daiderd Jordan. --- src/libstore/build.cc | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/libstore/build.cc b/src/libstore/build.cc index 86cab9f35..46ce562f7 100644 --- a/src/libstore/build.cc +++ b/src/libstore/build.cc @@ -2656,6 +2656,10 @@ void DerivationGoal::runChild() sandboxProfile += "(deny default (with no-log))\n"; } + /* Disallow creating setuid/setgid binaries, since that + would allow breaking build user isolation. */ + sandboxProfile += "(deny file-write-setugid)\n"; + /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */ Path globalTmpDir = canonPath(getEnv("TMPDIR", "/tmp"), true);