![]() Writing the gid_map is already non-fatal, but the actual sandbox process still tries to setresgid() to nogroup (usually 65534). This however fails, because if user namespace sandboxing is present, the namespace doesn't have CAP_SETGID at this point. Fortunately, the effective GID is already 65534, so we just need to check whether the target gid matches and only(!) setresgid() if it doesn't. So if someone would run a SUID version of the sandbox, it would still work nonetheless without a negative impact on security. Fixes #5730, thanks to @wizeman for reporting and initial debugging. Signed-off-by: aszlig <aszlig@redmoonstudios.org> |
||
---|---|---|
doc | ||
lib | ||
maintainers | ||
nixos | ||
pkgs | ||
.gitignore | ||
.travis.yml | ||
.version | ||
COPYING | ||
default.nix | ||
README.md |
Nixpkgs is a collection of packages for Nix package manager.
NixOS linux distribution source code is located inside nixos/
folder.
- NixOS installation instructions
- Documentation (Nix Expression Language chapter)
- Manual (How to write packages for Nix)
- Manual (NixOS)
- Continuous package builds for unstable/master
- Continuous package builds for 14.12 release
- Tests for unstable/master
- Tests for 14.12 release
Communication: