From e59a8a63e10992834a48e2b43c854c2e4f990dbe Mon Sep 17 00:00:00 2001 From: Shea Levy Date: Mon, 19 Feb 2018 09:56:24 -0500 Subject: [PATCH] Don't silently succeed seccomp setup when !HAVE_SECCOMP. Running Nix with build users without seccomp on Linux is dangerous, and administrators should very explicitly opt-in to it. --- src/libstore/build.cc | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/libstore/build.cc b/src/libstore/build.cc index 9b7abaa3d..30f22833f 100644 --- a/src/libstore/build.cc +++ b/src/libstore/build.cc @@ -2471,9 +2471,9 @@ void DerivationGoal::chownToBuilder(const Path & path) void setupSeccomp() { -#if __linux__ && HAVE_SECCOMP +#if __linux__ if (!settings.filterSyscalls) return; - +#if HAVE_SECCOMP scmp_filter_ctx ctx; if (!(ctx = seccomp_init(SCMP_ACT_ALLOW))) @@ -2519,6 +2519,11 @@ void setupSeccomp() if (seccomp_load(ctx) != 0) throw SysError("unable to load seccomp BPF program"); +#else + throw Error("%s\n%s", + "seccomp is not supported on this platform" + "you can avoid this by setting the filter-syscalls option to false, but note that untrusted builds can then create setuid binaries!"); +#endif #endif }