eldritch horrors
a53f28aa80
if a build directory is accessible to other users it is possible to smuggle data in and out of build directories. usually this ins only a build purity problem, but in combination with other issues it can be used to break out of a build sandbox. to prevent this we default to using a subdirectory of nixStateDir (which is more restrictive). Change-Id: Iacfc9b50534de158618c815f9fb99d7dae1be4d0
3 lines
112 B
Plaintext
3 lines
112 B
Plaintext
d @localstatedir@/nix/daemon-socket 0755 root root - -
|
|
d @localstatedir@/nix/builds 0755 root root 7d -
|