sandbox allows capturing kernel cmdline from /proc

[xaverdh]

Describe the bug

The sandbox should probably hide some parts of /proc ?

Steps To Reproduce build the following derivation:

with import <nixpkgs> {}; stdenv.mkDerivation {
  name = "proc-cmdline-capture";
  buildCommand = ''cat /proc/cmdline > $out '';
}

Expected behavior

Access to some parts of /proc should probably be denied by the sandbox.

nix-env --version output

nix-env (Nix) 2.4pre20201201_5a6ddb3

Additional context

Also see https://github.com/NixOS/nixpkgs/issues/60416, where this came up.

[zimbatm]

This could help make builds more reproducible as well. It would require to mount a fake procfs or at least bind-mount some of the paths over with fake values.

[stale[bot]]

I marked this as stale due to inactivity. → More info

[NickCao]

Still relevant as in https://github.com/NixOS/nixpkgs/issues/205125

[amarshall]

Still relevant. Relatedly, /proc/modules is available causing unexpected issues in https://github.com/nix-community/home-manager/pull/4644

[Bot-wxt1221]

I meet the same problem here. https://github.com/NixOS/nixpkgs/issues/335612