Théophane Hufschmitt 1d3696f0fb Run the builds in a daemon-controled directory ... Instead of running the builds under `$TMPDIR/{unique-build-directory-owned-by-the-build-user}`, run them under `$TMPDIR/{unique-build-directory-owned-by-the-daemon}/{subdir-owned-by-the-build-user}` where the build directory is only readable and traversable by the daemon user. This achieves two things: 1. It prevents builders from making their build directory world-readable (or even writeable), which would allow the outside world to interact with them. 2. It prevents external processes running as the build user (either because that somehow leaked, maybe as a consequence of 1., or because `build-users` isn't in use) from gaining access to the build directory.		2024-06-21 17:06:19 +02:00
..
build	Run the builds in a daemon-controled directory	2024-06-21 17:06:19 +02:00
meson.build	Build nix-store with Meson	2024-06-14 10:25:14 -04:00
pathlocks.cc	Pathlocks Implementation for Windows (#10586)	2024-04-22 15:08:10 +00:00
user-lock.cc	Start building the scheduler for Windows	2024-05-10 20:23:59 -04:00
user-lock.hh	Start building the scheduler for Windows	2024-05-10 20:23:59 -04:00