diff options
| author | Alois Wohlschlager <alois1@gmx-topmail.de> | 2024-05-08 19:15:00 +0200 |
|---|---|---|
| committer | alois31 <alois1@gmx-topmail.de> | 2024-05-24 21:19:29 +0000 |
| commit | f047e4357b4f7ad66c2e476506bf35cab82e441e (patch) | |
| tree | fcfc0bd4776ca73e19f5125aa9d7f778fc8b3fc7 /tests/nixos/default.nix | |
| parent | 19ea351642d48a49a2b41248cbbc4569aa16c0a9 (diff) | |
libstore/build: always enable seccomp filtering and no-new-privileges
Seccomp filtering and the no-new-privileges functionality improve the security
of the sandbox, and have been enabled by default for a long time. In
https://git.lix.systems/lix-project/lix/issues/265 it was decided that they
should be enabled unconditionally. Accordingly, remove the allow-new-privileges
(which had weird behavior anyway) and filter-syscall settings, and force the
security features on. Syscall filtering can still be enabled at build time to
support building on architectures libseccomp doesn't support.
Change-Id: Iedbfa18d720ae557dee07a24f69b2520f30119cb
Diffstat (limited to 'tests/nixos/default.nix')
| -rw-r--r-- | tests/nixos/default.nix | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/tests/nixos/default.nix b/tests/nixos/default.nix index 354413a7c..5e8bc69ce 100644 --- a/tests/nixos/default.nix +++ b/tests/nixos/default.nix @@ -184,7 +184,9 @@ in symlinkResolvconf = runNixOSTestFor "x86_64-linux" ./symlink-resolvconf.nix; - rootInSandbox = runNixOSTestFor "x86_64-linux" ./root-in-sandbox; + noNewPrivilegesInSandbox = runNixOSTestFor "x86_64-linux" ./no-new-privileges/sandbox.nix; + + noNewPrivilegesOutsideSandbox = runNixOSTestFor "x86_64-linux" ./no-new-privileges/no-sandbox.nix; broken-userns = runNixOSTestFor "x86_64-linux" ./broken-userns.nix; |