picnoir/nix-gh
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

simplify build permissions

Browse source
This commit is contained in:
Jude Taylor 2015-11-14 13:52:33 -08:00
parent d760c2638c
commit 4876bb012e
2 changed files with 6 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
release.nix
View file

@ -97,10 +97,9 @@ let
enableParallelBuilding = true;
__sandboxProfile = lib.sandbox.allowNetwork
+ lib.sandbox.allowFileRead {
literal = [ "/etc" "/etc/nix/nix.conf" "/private/etc/nix/nix.conf" ];
};
__sandboxProfile = lib.sandbox.allowFileRead [
"/etc" "/etc/nix/nix.conf" "/private/etc/nix/nix.conf"
];
makeFlags = "profiledir=$(out)/etc/profile.d";

16
src/libstore/build.cc
View file

@ -2498,13 +2498,8 @@ void DerivationGoal::runChild()
}
sandboxProfile += ")\n";
/* Our inputs (transitive dependencies and any impurities computed above)
Note that the sandbox profile allows file-write* even though it isn't seemingly necessary. First of all, nix's standard user permissioning
mechanism still prevents builders from writing to input directories, so no security/purity is lost. The reason we allow file-write* is that
denying it means the `access` syscall will return EPERM instead of EACCESS, which confuses a few programs that assume (understandably, since
it appears to be a violation of the POSIX spec) that `access` won't do that, and don't deal with it nicely if it does. The most notable of
these is the entire GHC Haskell ecosystem. */
sandboxProfile += "(allow file-read* file-write* process-exec mach-priv-task-port\n";
/* Our inputs (transitive dependencies and any impurities computed above) */
sandboxProfile += "(allow file-read* process-exec\n";
for (auto & i : dirsInChroot) {
if (i.first != i.second)
throw SysError(format("can't map '%1%' to '%2%': mismatched impure paths not supported on darwin"));
@ -2520,12 +2515,7 @@ void DerivationGoal::runChild()
}
sandboxProfile += ")\n";
/* Our ancestry. N.B: this uses literal on folders, instead of subpath. Without that,
you open up the entire filesystem because you end up with (subpath "/")
Note: file-read-metadata* is not sufficiently permissive for GHC. file-read* is but may
be a security hazard.
TODO: figure out a more appropriate directive.
*/
/* Allow file-read* on full directory hierarchy to self. Allows realpath() */
sandboxProfile += "(allow file-read*\n";
for (auto & i : ancestry) {
sandboxProfile += (format("\t(literal \"%1%\")\n") % i.c_str()).str();