libstore/build: set NO_NEW_PRIVS for the sandbox

Change-Id: I711f64e2b68495ed9c85c1a4bd5025405805e43a

1 files changed, 23 insertions, 0 deletions

diff --git a/tests/nixos/util.nix b/tests/nixos/util.nix
new file mode 100644
index 000000000..0c51cc075
--- /dev/null
+++ b/tests/nixos/util.nix
@@ -0,0 +1,23 @@
+{
+  mkNixBuildTest = { name, expressionFile, extraMachineConfig ? {} }:
+    { lib, pkgs, ... }:
+    {
+      inherit name;
+
+      nodes.machine = {
+        imports = [extraMachineConfig];
+        nix.nixPath = ["nixpkgs=${pkgs.path}"];
+        nix.settings.substituters = lib.mkForce [];
+        virtualisation.additionalPaths = [
+          expressionFile
+          (pkgs.callPackage expressionFile {}).inputDerivation
+        ];
+      };
+
+      testScript = { nodes }: ''
+        start_all()
+
+        machine.succeed('nix-build --expr "let pkgs = import <nixpkgs> {}; in pkgs.callPackage ${expressionFile} {}"')
+      '';
+    };
+}