diff options
Diffstat (limited to 'tests/nixos/no-new-privileges/package.nix')
| -rw-r--r-- | tests/nixos/no-new-privileges/package.nix | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/tests/nixos/no-new-privileges/package.nix b/tests/nixos/no-new-privileges/package.nix new file mode 100644 index 000000000..55c96bc2e --- /dev/null +++ b/tests/nixos/no-new-privileges/package.nix @@ -0,0 +1,8 @@ +{ runCommand, libcap }: +runCommand "cant-get-capabilities" { nativeBuildInputs = [ libcap.out ]; } '' + if [ "$(/run/wrappers/bin/ohno 2>&1)" != "failed to inherit capabilities: Operation not permitted" ]; then + echo "Oh no! We gained capabilities!" + exit 1 + fi + touch $out +'' |