diff options
| author | Eelco Dolstra <edolstra@gmail.com> | 2017-05-29 11:34:24 +0200 |
|---|---|---|
| committer | Eelco Dolstra <edolstra@gmail.com> | 2017-05-29 16:14:10 +0200 |
| commit | 6cc6c15a2d50d0021d7242e9806ed6d54538de17 (patch) | |
| tree | e9a5fbd03cd6c1e0a1d8b68fff784f2d0f29dee7 /configure.ac | |
| parent | 6e01ecd112dce8d8bbe46c839f982892a3ffb589 (diff) | |
Add a seccomp filter to prevent creating setuid/setgid binaries
This prevents builders from setting the S_ISUID or S_ISGID bits,
preventing users from using a nixbld* user to create a setuid/setgid
binary to interfere with subsequent builds under the same nixbld* uid.
This is based on aszlig's seccomp code
(47f587700d646f5b03a42f2fa57c28875a31efbe).
Reported by Linus Heckemann.
Diffstat (limited to 'configure.ac')
| -rw-r--r-- | configure.ac | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/configure.ac b/configure.ac index 24a95ce56..9d8a81d04 100644 --- a/configure.ac +++ b/configure.ac @@ -176,6 +176,13 @@ AC_SUBST(HAVE_SODIUM, [$have_sodium]) PKG_CHECK_MODULES([LIBLZMA], [liblzma], [CXXFLAGS="$LIBLZMA_CFLAGS $CXXFLAGS"]) +# Look for libseccomp, required for Linux sandboxing. +if test "$sys_name" = linux; then + PKG_CHECK_MODULES([LIBSECCOMP], [libseccomp], + [CXXFLAGS="$LIBSECCOMP_CFLAGS $CXXFLAGS"]) +fi + + # Look for aws-cpp-sdk-s3. AC_LANG_PUSH(C++) AC_CHECK_HEADERS([aws/s3/S3Client.h], |