Eelco Dolstra 6cc6c15a2d Add a seccomp filter to prevent creating setuid/setgid binaries ...

This prevents builders from setting the S_ISUID or S_ISGID bits,
preventing users from using a nixbld* user to create a setuid/setgid
binary to interfere with subsequent builds under the same nixbld* uid.

This is based on aszlig's seccomp code
(47f587700d).

Reported by Linus Heckemann.

2017-05-29 16:14:10 +02:00

884 B

Raw Blame History

View Raw