eldritch horrorsandRaito Bezarius
749afbbe99
if a build directory is accessible to other users it is possible to smuggle data in and out of build directories. usually this ins only a build purity problem, but in combination with other issues it can be used to break out of a build sandbox. to prevent this we default to using a subdirectory of nixStateDir (which is more restrictive). Fixes CVE-2025-52991. Change-Id: Iacfc9b50534de158618c815f9fb99d7dae1be4d0
14 lines
467 B
Bash
14 lines
467 B
Bash
requireSandboxSupport
|
|
[[ $busybox =~ busybox ]] || skipTest "no busybox"
|
|
|
|
unset NIX_STORE_DIR
|
|
|
|
remoteDir=$TEST_ROOT/remote
|
|
|
|
# Note: ssh{-ng}://localhost bypasses ssh. See tests/functional/build-remote.sh for
|
|
# more details.
|
|
nix-build $file -o $TEST_ROOT/result --max-jobs 0 \
|
|
--arg busybox $busybox \
|
|
--store $TEST_ROOT/local \
|
|
--builders "$proto://localhost?remote-program=$prog&remote-store=${remoteDir}%3Fsystem-features=foo%20bar%20baz - - 1 1 foo,bar,baz"
|