Add X32 to the seccomp filter

Fixes #1432.
NixOS · Jul 4, 2017 · a3dc1e6 · a3dc1e6
1 parent 42c5774
commit a3dc1e6
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/libstore/build.cc b/src/libstore/build.cc
@@ -2317,6 +2317,10 @@ void setupSeccomp()
         seccomp_arch_add(ctx, SCMP_ARCH_X86) != 0)
         throw SysError("unable to add 32-bit seccomp architecture");
 
+    if (settings.thisSystem == "x86_64-linux" &&
+        seccomp_arch_add(ctx, SCMP_ARCH_X32) != 0)
+        throw SysError("unable to add X32 seccomp architecture");
+
     /* Prevent builders from creating setuid/setgid binaries. */
     for (int perm : { S_ISUID, S_ISGID }) {
         if (seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(chmod), 1,