diff options
Diffstat (limited to 'src/libstore/build/sandbox-minimal.sb')
| -rw-r--r-- | src/libstore/build/sandbox-minimal.sb | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/src/libstore/build/sandbox-minimal.sb b/src/libstore/build/sandbox-minimal.sb new file mode 100644 index 000000000..976a1f636 --- /dev/null +++ b/src/libstore/build/sandbox-minimal.sb @@ -0,0 +1,9 @@ +R""( + +(allow default) + +; Disallow creating setuid/setgid binaries, since that +; would allow breaking build user isolation. +(deny file-write-setugid) + +)"" |