nixos/nix
1
1
Fork 0
mirror of https://github.com/NixOS/nix.git synced 2025-11-15 23:12:44 +01:00
Code Activity

Make sure settings.sandboxedPaths is closed outside DerivationBuilder

Browse source 
This is a nicer separation of concerns --- `DerivationBuilder` just
mounts the extra paths you tell it too, and the outside world is
responsible for making sure those extra paths make sense.

Since the closure only depends on global settings, and not
per-derivation information, we also have the option of moving this up
further and caching it across all local builds. (I only just realized
this after having done this refactor. I am not doing that change at this
time, however.)
This commit is contained in:
John Ericson 2025-08-20 17:52:07 -04:00
parent 08e42e20fa
commit 4c76db8e7c
3 changed files with 27 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

18
src/libstore/unix/build/derivation-builder.cc
View file

@ -836,29 +836,13 @@ PathsInChroot DerivationBuilderImpl::getPathsInSandbox()
{
/* Allow a user-configurable set of directories from the
host file system. */
PathsInChroot pathsInChroot = settings.sandboxPaths.get();
PathsInChroot pathsInChroot = defaultPathsInChroot;
if (hasPrefix(store.storeDir, tmpDirInSandbox())) {
throw Error("`sandbox-build-dir` must not contain the storeDir");
}
pathsInChroot[tmpDirInSandbox()] = {.source = tmpDir};
/* Add the closure of store paths to the chroot. */
StorePathSet closure;
for (auto & i : pathsInChroot)
try {
if (store.isInStore(i.second.source))
store.computeFSClosure(store.toStorePath(i.second.source).first, closure);
} catch (InvalidPath & e) {
} catch (Error & e) {
e.addTrace({}, "while processing sandbox path '%s'", i.second.source);
throw;
}
for (auto & i : closure) {
auto p = store.printStorePath(i);
pathsInChroot.insert_or_assign(p, ChrootPath{.source = p});
}
PathSet allowedPaths = settings.allowedImpureHostPrefixes;
/* This works like the above, except on a per-derivation level */