mirror of
https://github.com/NixOS/nix.git
synced 2025-12-15 05:21:03 +01:00
64d7f56eaa
Instead of running the builds under
`$TMPDIR/{unique-build-directory-owned-by-the-build-user}`, run them
under `$TMPDIR/{unique-build-directory-owned-by-the-daemon}/{subdir-owned-by-the-build-user}`
where the build directory is only readable and traversable by the daemon user.
This achieves two things:
1. It prevents builders from making their build directory world-readable
(or even writeable), which would allow the outside world to interact
with them.
2. It prevents external processes running as the build user (either
because that somehow leaked, maybe as a consequence of 1., or because
`build-users` isn't in use) from gaining access to the build
directory.
|
||
|---|---|---|
| .. | ||
| build-remote | ||
| libcmd | ||
| libexpr | ||
| libfetchers | ||
| libmain | ||
| libstore | ||
| libutil | ||
| nix | ||
| nix-build | ||
| nix-channel | ||
| nix-collect-garbage | ||
| nix-copy-closure | ||
| nix-env | ||
| nix-instantiate | ||
| nix-store | ||
| resolve-system-dependencies | ||
| toml11 | ||