tests/nixos/no-new-privileges/no-sandbox.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

let
  inherit (import ../util.nix) mkNixBuildTest;
in
mkNixBuildTest {
  name = "no-new-privileges-outside-sandbox";
  extraMachineConfig =
    { pkgs, ... }:
    {
      security.wrappers.ohno = {
        owner = "root";
        group = "root";
        capabilities = "cap_sys_nice=eip";
        source = "${pkgs.libcap}/bin/getpcaps";
      };
      nix.settings = {
        extra-sandbox-paths = [ "/run/wrappers/bin/ohno" ];
        sandbox = false;
      };
    };
  expressionFile = ./package.nix;
}