From 992cda1b113227cc6a4724e53ae2cb9f1e47be0e Mon Sep 17 00:00:00 2001
From: Jude Taylor <me@jude.bio>
Date: Wed, 21 Oct 2015 14:39:16 -0700
Subject: [PATCH] clarifying comment
---
src/libstore/build.cc | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/src/libstore/build.cc b/src/libstore/build.cc
index 2211191fb..725a82a86 100644
--- a/src/libstore/build.cc
+++ b/src/libstore/build.cc
@@ -2488,7 +2488,11 @@ void DerivationGoal::runChild()
sandboxProfile += ")\n";
/* Our ancestry. N.B: this uses literal on folders, instead of subpath. Without that,
- you open up the entire filesystem because you end up with (subpath "/") */
+ you open up the entire filesystem because you end up with (subpath "/")
+ Note: file-read-metadata* is not sufficiently permissive for GHC. file-read* is but may
+ be a security hazard.
+ TODO: figure out a more appropriate directive.
+ */
sandboxProfile += "(allow file-read*\n";
for (auto & i : ancestry) {
sandboxProfile += (format("\t(literal \"%1%\")\n") % i.c_str()).str();
--
GitLab