nixos/nix
1
1
Fork 0
mirror of https://github.com/NixOS/nix.git synced 2025-11-12 21:46:01 +01:00
Code Activity

Merge pull request #14531 from NixOS/fix-14529

Browse source 
Restore isAllowed check in ChrootLinuxDerivationBuilder
This commit is contained in:
John Ericson 2025-11-10 19:27:05 +00:00 • committed by GitHub
commit 060a354f22
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 21 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

16
src/libstore/include/nix/store/restricted-store.hh
View file

@ -52,7 +52,21 @@ struct RestrictionContext
* Add 'path' to the set of paths that may be referenced by the
* outputs, and make it appear in the sandbox.
*/
virtual void addDependency(const StorePath & path) = 0;
void addDependency(const StorePath & path)
{
if (isAllowed(path))
return;
addDependencyImpl(path);
}
protected:
/**
* This is the underlying implementation to be defined. The caller
* will ensure that this is only called on newly added dependencies,
* and that idempotent calls are a no-op.
*/
virtual void addDependencyImpl(const StorePath & path) = 0;
};
/**

7
src/libstore/unix/build/derivation-builder.cc
View file

@ -334,7 +334,7 @@ private:
protected:
void addDependency(const StorePath & path) override;
void addDependencyImpl(const StorePath & path) override;
/**
* Make a file owned by the builder.
@ -1203,11 +1203,8 @@ void DerivationBuilderImpl::stopDaemon()
daemonSocket.close();
}
void DerivationBuilderImpl::addDependency(const StorePath & path)
void DerivationBuilderImpl::addDependencyImpl(const StorePath & path)
{
if (isAllowed(path))
return;
addedPaths.insert(path);
}

5
src/libstore/unix/build/linux-derivation-builder.cc
View file

@ -709,8 +709,11 @@ struct ChrootLinuxDerivationBuilder : ChrootDerivationBuilder, LinuxDerivationBu
DerivationBuilderImpl::killSandbox(getStats);
}
void addDependency(const StorePath & path) override
void addDependencyImpl(const StorePath & path) override
{
if (isAllowed(path))
return;
auto [source, target] = ChrootDerivationBuilder::addDependencyPrep(path);
/* Bind-mount the path into the sandbox. This requires