From 6cc6c15a2d50d0021d7242e9806ed6d54538de17 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 29 May 2017 11:34:24 +0200
Subject: Add a seccomp filter to prevent creating setuid/setgid binaries

This prevents builders from setting the S_ISUID or S_ISGID bits,
preventing users from using a nixbld* user to create a setuid/setgid
binary to interfere with subsequent builds under the same nixbld* uid.

This is based on aszlig's seccomp code
(47f587700d646f5b03a42f2fa57c28875a31efbe).

Reported by Linus Heckemann.
---
 shell.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'shell.nix')

diff --git a/shell.nix b/shell.nix
index c4e2a20f8..435399f0b 100644
--- a/shell.nix
+++ b/shell.nix
@@ -22,7 +22,8 @@ with import ./release-common.nix { inherit pkgs; };
       # For nix-perl
       perl
       perlPackages.DBDSQLite
-    ];
+    ]
+    ++ lib.optional stdenv.isLinux libseccomp;
 
   inherit configureFlags;
 
-- 
cgit v1.2.3