mirror of
https://github.com/NixOS/nix
synced 2024-09-19 23:03:53 -04:00
Add release notes
This commit is contained in:
parent
244f3eee0b
commit
d6918898c9
14
doc/manual/rl-next/fod-sandbox-escape.md
Normal file
14
doc/manual/rl-next/fod-sandbox-escape.md
Normal file
|
@ -0,0 +1,14 @@
|
||||||
|
---
|
||||||
|
synopsis: Fix a FOD sandbox escape
|
||||||
|
issues:
|
||||||
|
prs:
|
||||||
|
---
|
||||||
|
|
||||||
|
Cooperating Nix derivations could send file descriptors to files in the Nix
|
||||||
|
store to each other via Unix domain sockets in the abstract namespace. This
|
||||||
|
allowed one derivation to modify the output of the other derivation, after Nix
|
||||||
|
has registered the path as "valid" and immutable in the Nix database.
|
||||||
|
In particular, this allowed the output of fixed-output derivations to be
|
||||||
|
modified from their expected content.
|
||||||
|
|
||||||
|
This isn't the case any more.
|
Loading…
Reference in a new issue