nordic-dev.net/nix
nordic-dev.net/nix
2
0
Fork 0
mirror of https://github.com/NixOS/nix.git synced 2024-11-26 00:32:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix __darwinAllowLocalNetworking sandbox

Browse Source 
The sandbox rule `(allow network* (local ip))` doesn't do what it
implies. Adding this rule permits all network traffic. We should be
matching on (remote ip "localhost:*")` instead.
This commit is contained in:
Simon Žlender 2024-02-25 23:00:57 +01:00
parent d83008c3a7
commit d60c3f7f7c
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/libstore/build/sandbox-defaults.sb
View File

@ -45,7 +45,7 @@ R""(
; allow it if the package explicitly asks for it. ; allow it if the package explicitly asks for it.
(if (param "_ALLOW_LOCAL_NETWORKING") (if (param "_ALLOW_LOCAL_NETWORKING")
(begin (begin
(allow network* (local ip) (local tcp) (local udp)) (allow network* (remote ip "localhost:*"))
; Allow access to /etc/resolv.conf (which is a symlink to ; Allow access to /etc/resolv.conf (which is a symlink to
; /private/var/run/resolv.conf). ; /private/var/run/resolv.conf).