diff options
author | alois31 <alois1@gmx-topmail.de> | 2024-05-25 04:21:53 +0000 |
---|---|---|
committer | Gerrit Code Review <gerrit@lix-systems> | 2024-05-25 04:21:53 +0000 |
commit | ddfe379a6b93c678a9a0845e5c5a85f7e77b1b7d (patch) | |
tree | bc99ab3f691eeef509943bdcc83feae60bc39d0e /tests/nixos/no-new-privileges/sandbox.nix | |
parent | 5b4b216facfb8af2f08c25a4b50fba1e197ca06e (diff) | |
parent | f047e4357b4f7ad66c2e476506bf35cab82e441e (diff) |
Merge "libstore/build: always enable seccomp filtering and no-new-privileges" into main
Diffstat (limited to 'tests/nixos/no-new-privileges/sandbox.nix')
-rw-r--r-- | tests/nixos/no-new-privileges/sandbox.nix | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/tests/nixos/no-new-privileges/sandbox.nix b/tests/nixos/no-new-privileges/sandbox.nix new file mode 100644 index 000000000..e2475555e --- /dev/null +++ b/tests/nixos/no-new-privileges/sandbox.nix @@ -0,0 +1,18 @@ +let + inherit (import ../util.nix) mkNixBuildTest; +in +mkNixBuildTest { + name = "no-new-privileges-in-sandbox"; + extraMachineConfig = + { pkgs, ... }: + { + security.wrappers.ohno = { + owner = "root"; + group = "root"; + capabilities = "cap_sys_nice=eip"; + source = "${pkgs.libcap}/bin/getpcaps"; + }; + nix.settings.extra-sandbox-paths = [ "/run/wrappers/bin/ohno" ]; + }; + expressionFile = ./package.nix; +} |