6f36a8834c
It is possible to exfiltrate a file descriptor out of the build sandbox of FODs, and use it to modify the store path after it has been registered. To avoid that issue, don't register the output of the build, but a copy of it (that will be free of any leaked file descriptor). Test that we can't leverage abstract unix domain sockets to leak file descriptors out of the sandbox and modify the path after it has been registered. (cherry picked from commit 2dadfeb690e7f4b8f97298e29791d202fdba5ca6) (tests cherry picked from commit c854ae5b3078ac5d99fa75fe148005044809e18c) Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io> Co-authored-by: Theophane Hufschmitt <theophane.hufschmitt@tweag.io> Co-authored-by: Tom Bereknyei <tomberek@gmail.com> Change-Id: I87cd58f1c0a4f7b7a610d354206b33301e47b1a4 |
||
|---|---|---|
| .. | ||
| ca-fd-leak | ||
| containers | ||
| authorization.nix | ||
| default.nix | ||
| github-flakes.nix | ||
| nix-copy-closure.nix | ||
| nix-copy.nix | ||
| nss-preload.nix | ||
| remote-builds.nix | ||
| setuid.nix | ||
| sourcehut-flakes.nix | ||
| tarball-flakes.nix | ||