{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nix/issues/695","labels_url":"https://api.github.com/repos/NixOS/nix/issues/695/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nix/issues/695/comments","events_url":"https://api.github.com/repos/NixOS/nix/issues/695/events","html_url":"https://github.com/NixOS/nix/pull/695","id":116691930,"number":695,"title":"Use per-derivation sandbox profiles","user":{"login":"pikajude","id":316117,"avatar_url":"https://avatars.githubusercontent.com/u/316117?v=3","gravatar_id":"","url":"https://api.github.com/users/pikajude","html_url":"https://github.com/pikajude","followers_url":"https://api.github.com/users/pikajude/followers","following_url":"https://api.github.com/users/pikajude/following{/other_user}","gists_url":"https://api.github.com/users/pikajude/gists{/gist_id}","starred_url":"https://api.github.com/users/pikajude/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pikajude/subscriptions","organizations_url":"https://api.github.com/users/pikajude/orgs","repos_url":"https://api.github.com/users/pikajude/repos","events_url":"https://api.github.com/users/pikajude/events{/privacy}","received_events_url":"https://api.github.com/users/pikajude/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":20,"created_at":"2015-11-13T03:11:23Z","updated_at":"2015-11-18T22:16:15Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/NixOS/nix/pulls/695","html_url":"https://github.com/NixOS/nix/pull/695","diff_url":"https://github.com/NixOS/nix/pull/695.diff","patch_url":"https://github.com/NixOS/nix/pull/695.patch"},"body":"@edolstra @shlevy @copumpkin \r\n\r\nSee https://github.com/NixOS/nixpkgs/pull/11001\r\n\r\nAdvantages of this change:\r\n* Non-file dependencies can be added to new derivations without needing to modify nix.\r\n    * Specifically, the packages that depend on SDL will not necessitate the addition of some 15+ new sandbox directives to nix in order to build.\r\n* `pre-build-hook` is no longer necessary to safely link with Apple frameworks. A derivation can be (and has been) written that is able to generate a sandbox profile containing a comprehensive list of libraries that a certain framework depends on.\r\n    * To clarify, though the `__noChroot` attribute has existed for awhile, the difference in this case is that a sandbox profile can consist of an invocation of the `import` function, meaning that some derivation's allowed host dependencies can depend on the build-time results of another derivation.\r\n\r\nDisadvantages of this change:\r\n* There is **no longer any guarantee** that any specific derivation will be **unable** to modify **any part** of the filesystem. I acknowledge that this is a pretty serious change of security policy in nix, but believe that it's a worthy tradeoff in order to make Darwin maintenance less of a hassle for developers. In questionable cases, I suggest relying on code reviews and a vetted list of contributors to not push any derivations that contain, for example, `__sandboxProfile = \"(allow default)\";` :smile:"},"comment":{"url":"https://api.github.com/repos/NixOS/nix/issues/comments/157882241","html_url":"https://github.com/NixOS/nix/pull/695#issuecomment-157882241","issue_url":"https://api.github.com/repos/NixOS/nix/issues/695","id":157882241,"user":{"login":"shlevy","id":487050,"avatar_url":"https://avatars.githubusercontent.com/u/487050?v=3","gravatar_id":"","url":"https://api.github.com/users/shlevy","html_url":"https://github.com/shlevy","followers_url":"https://api.github.com/users/shlevy/followers","following_url":"https://api.github.com/users/shlevy/following{/other_user}","gists_url":"https://api.github.com/users/shlevy/gists{/gist_id}","starred_url":"https://api.github.com/users/shlevy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shlevy/subscriptions","organizations_url":"https://api.github.com/users/shlevy/orgs","repos_url":"https://api.github.com/users/shlevy/repos","events_url":"https://api.github.com/users/shlevy/events{/privacy}","received_events_url":"https://api.github.com/users/shlevy/received_events","type":"User","site_admin":false},"created_at":"2015-11-18T22:16:15Z","updated_at":"2015-11-18T22:16:15Z","body":"Oh, eh, as long as that fails at build time it doesn't seem like a big deal. I mean, with the current PR you can write whatever you want in the string, right? :grin: "}}