diff options
author | Graham Christensen <graham@grahamc.com> | 2017-02-14 13:57:44 -0500 |
---|---|---|
committer | GitHub <noreply@github.com> | 2017-02-14 13:57:44 -0500 |
commit | 3be13889633df6413cea1f2fdeed34ecee01d598 (patch) | |
tree | d5f8bb8ea26d3c125ac3189e25e24fb5adca4b95 | |
parent | d440052b64ef54479299b0ed24c11f078bef5536 (diff) | |
parent | d0a086770a1be8c1f3175c195587052c5a5bfe1c (diff) |
Merge pull request #22767 from grahamc/sandbox-by-default
nix-daemon: default useSandbox to true
-rw-r--r-- | nixos/doc/manual/release-notes/rl-1703.xml | 4 | ||||
-rw-r--r-- | nixos/modules/services/misc/nix-daemon.nix | 8 |
2 files changed, 8 insertions, 4 deletions
diff --git a/nixos/doc/manual/release-notes/rl-1703.xml b/nixos/doc/manual/release-notes/rl-1703.xml index 8f9694bad8bdd..68dc8e9b4bfc9 100644 --- a/nixos/doc/manual/release-notes/rl-1703.xml +++ b/nixos/doc/manual/release-notes/rl-1703.xml @@ -30,6 +30,10 @@ has the following highlights: </para> <listitem> <para>PHP now defaults to PHP 7.1</para> </listitem> + + <listitem> + <para>nix-daemon now uses sandboxing by default.</para> + </listitem> </itemizedlist> <para>The following new services were added since the last release:</para> diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix index 7101cadfeed26..4c7264f4ac836 100644 --- a/nixos/modules/services/misc/nix-daemon.nix +++ b/nixos/modules/services/misc/nix-daemon.nix @@ -100,14 +100,14 @@ in useSandbox = mkOption { type = types.either types.bool (types.enum ["relaxed"]); - default = false; + default = true; description = " If set, Nix will perform builds in a sandboxed environment that it will set up automatically for each build. This prevents impurities in builds by disallowing access to dependencies - outside of the Nix store. This isn't enabled by default for - performance. It doesn't affect derivation hashes, so changing - this option will not trigger a rebuild of packages. + outside of the Nix store. It doesn't affect derivation + hashes, so changing this option will not trigger a rebuild + of packages. "; }; |