pkgs/sandbox: Add flag to bind-mount read-only

While the Nix store should be read-only by default, we can't guarantee
this as the Nix store could be mounted read-write (for example on
non-NixOS systems).

For paths other than store directories, I took a conservative approach
here where only /etc is mounted read-only, for all the pseudo-
filesystems such as /proc, /sys or /dev write access might still be
needed, for example to write to a hardware device exposed via /dev (eg.
a gamepad with rumble support).

Signed-off-by: aszlig <aszlig@nix.build>

1 files changed, 1 insertions, 1 deletions

diff --git a/pkgs/build-support/build-sandbox/src/setup.h b/pkgs/build-support/build-sandbox/src/setup.h
index fe882dc5..2ef05482 100644
--- a/pkgs/build-support/build-sandbox/src/setup.h
+++ b/pkgs/build-support/build-sandbox/src/setup.h
@@ -6,7 +6,7 @@
 #include "nix-query.h"
 
 bool write_maps(pid_t parent_pid);
-bool bind_mount(const char *path, bool restricted, bool resolve);
+bool bind_mount(const char *path, bool rdonly, bool restricted, bool resolve);
 bool extra_mount(const char *path, bool is_required);
 bool mount_from_path_var(struct query_state *qs, const char *name);
 bool setup_sandbox(void);