diff options
author | aszlig <aszlig@redmoonstudios.org> | 2017-09-27 19:58:21 +0200 |
---|---|---|
committer | aszlig <aszlig@redmoonstudios.org> | 2017-10-03 23:41:20 +0200 |
commit | 2554e3ce9096c7036cbea55d78828794085734af (patch) | |
tree | adc363f46193c1ab3368325d900525e23d6918b9 /pkgs/games/build-support/build-sandbox | |
parent | 673cf2b1b38fb9a6fc4a5b01716feda7d3b861e4 (diff) |
pkgs/build-game: Add preliminary sandbox hook
This is basically to make sure various games can't write to whatever they want in the file system, so it's not a complete sandboxing solution. Currently there's a drawback in that we can't easily determine the runtime dependencies while building a particular game, so we need to recursively dig through all referenced store paths to look them up. A better solution for this would be to gather the build time reference graph prior to building so that we can limit searching for these references within only the actual build outputs instead of churning through all inputs. In addition to that, we currently mount the namespaced root file system on top of /tmp, which makes the real /tmp unavailable to us. While in theory this shouldn't be a problem, it actually turns out it is indeed a problem if the application wants to connect to the X server socket, which is at something like /tmp/.X11-unix/X0 for display :0. Apart from these drawbacks we have a working solution for simple applications (not games, because they usually require X), which now get its own chroot with only the paths accessible that are strictly necessary. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Diffstat (limited to 'pkgs/games/build-support/build-sandbox')
0 files changed, 0 insertions, 0 deletions