From e7188e211a5a2ac0ba34635a846569560bb5f000 Mon Sep 17 00:00:00 2001
From: Alois Wohlschlager <alois1@gmx-topmail.de>
Date: Mon, 1 Jul 2024 09:18:01 +0200
Subject: libstore/build: block io_uring

Unfortunately, io_uring is totally opaque to seccomp, and while currently there
are no dangerous operations implemented, there is no guarantee that it remains
this way. This means that io_uring should be blocked entirely to ensure that
the sandbox is future-proof. This has not been observed to cause issues in
practice.

Change-Id: I45d3895f95abe1bc103a63969f444c334dbbf50d
---
 tests/nixos/io_uring/package.nix | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 tests/nixos/io_uring/package.nix

(limited to 'tests/nixos/io_uring/package.nix')

diff --git a/tests/nixos/io_uring/package.nix b/tests/nixos/io_uring/package.nix
new file mode 100644
index 000000000..8f980183a
--- /dev/null
+++ b/tests/nixos/io_uring/package.nix
@@ -0,0 +1,19 @@
+{ runCommandCC }:
+runCommandCC "io_uring-is-blocked" { } ''
+  cat > test.c <<EOF
+  #include <errno.h>
+  #include <sys/syscall.h>
+  #include <unistd.h>
+
+  int main() {
+      int res = syscall(SYS_io_uring_setup, 0, NULL);
+      return res == -1 && errno == ENOSYS ? 0 : 1;
+  }
+  EOF
+  "$CC" -o test test.c
+  if ! ./test; then
+    echo "Oh no! io_uring is available!"
+    exit 1
+  fi
+  touch "$out"
+''
-- 
cgit v1.2.3