diff options
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/manual/redirects.js | 1 | ||||
| -rw-r--r-- | doc/manual/rl-next/linux-sandbox-consistency.md | 12 | ||||
| -rw-r--r-- | doc/manual/src/installation/prerequisites-source.md | 5 |
3 files changed, 13 insertions, 5 deletions
diff --git a/doc/manual/redirects.js b/doc/manual/redirects.js index 436564baa..f270d31a4 100644 --- a/doc/manual/redirects.js +++ b/doc/manual/redirects.js @@ -24,7 +24,6 @@ const redirects = { "chap-writing-nix-expressions": "language/index.html", "part-command-ref": "command-ref/command-ref.html", "conf-allow-import-from-derivation": "command-ref/conf-file.html#conf-allow-import-from-derivation", - "conf-allow-new-privileges": "command-ref/conf-file.html#conf-allow-new-privileges", "conf-allowed-uris": "command-ref/conf-file.html#conf-allowed-uris", "conf-allowed-users": "command-ref/conf-file.html#conf-allowed-users", "conf-auto-optimise-store": "command-ref/conf-file.html#conf-auto-optimise-store", diff --git a/doc/manual/rl-next/linux-sandbox-consistency.md b/doc/manual/rl-next/linux-sandbox-consistency.md new file mode 100644 index 000000000..6538362b3 --- /dev/null +++ b/doc/manual/rl-next/linux-sandbox-consistency.md @@ -0,0 +1,12 @@ +--- +synopsis: Enforce syscall filtering and no-new-privileges on Linux +cls: 1063 +category: Breaking Changes +credits: alois31 +--- + +In order to improve consistency of the build environment, system call filtering and no-new-privileges are now unconditionally enabled on Linux. +The `filter-syscalls` and `allow-new-privileges` options which could be used to disable these features under some circumstances have been removed. + +In order to support building on architectures without libseccomp support, the option to disable syscall filtering at build time remains. +However, other uses of this option are heavily discouraged, since it would reduce the security of the sandbox substantially. diff --git a/doc/manual/src/installation/prerequisites-source.md b/doc/manual/src/installation/prerequisites-source.md index 8584f295a..88a411b7a 100644 --- a/doc/manual/src/installation/prerequisites-source.md +++ b/doc/manual/src/installation/prerequisites-source.md @@ -68,10 +68,7 @@ The most current alternative to this section is to read `package.nix` and see wh may also work, but ancient versions like the ubiquitous 2.5.4a won't. - - The `libseccomp` is used to provide syscall filtering on Linux. This - is an optional dependency and can be disabled passing a - `--disable-seccomp-sandboxing` option to the `configure` script (Not - recommended unless your system doesn't support `libseccomp`). To get + - The `libseccomp` is used to provide syscall filtering on Linux. To get the library, visit <https://github.com/seccomp/libseccomp>. - On 64-bit x86 machines only, `libcpuid` library |