nixos/nix
1
1
Fork 0
mirror of https://github.com/NixOS/nix.git synced 2025-11-11 13:06:01 +01:00
Code Activity

Merge pull request #14534 from NixOS/backport-14531-to-2.32-maintenance

Browse source 
[Backport 2.32-maintenance] Restore isAllowed check in ChrootLinuxDerivationBuilder
This commit is contained in:
internal-nix-ci[bot] 2025-11-10 20:47:31 +00:00 • committed by GitHub
commit d7fc293353
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 21 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

16
src/libstore/include/nix/store/restricted-store.hh
View file

@ -52,7 +52,21 @@ struct RestrictionContext
* Add 'path' to the set of paths that may be referenced by the
* outputs, and make it appear in the sandbox.
*/
virtual void addDependency(const StorePath & path) = 0;
void addDependency(const StorePath & path)
{
if (isAllowed(path))
return;
addDependencyImpl(path);
}
protected:
/**
* This is the underlying implementation to be defined. The caller
* will ensure that this is only called on newly added dependencies,
* and that idempotent calls are a no-op.
*/
virtual void addDependencyImpl(const StorePath & path) = 0;
};
/**

7
src/libstore/unix/build/derivation-builder.cc
View file

@ -325,7 +325,7 @@ private:
protected:
void addDependency(const StorePath & path) override;
void addDependencyImpl(const StorePath & path) override;
/**
* Make a file owned by the builder.
@ -1181,11 +1181,8 @@ void DerivationBuilderImpl::stopDaemon()
daemonSocket.close();
}
void DerivationBuilderImpl::addDependency(const StorePath & path)
void DerivationBuilderImpl::addDependencyImpl(const StorePath & path)
{
if (isAllowed(path))
return;
addedPaths.insert(path);
}

5
src/libstore/unix/build/linux-derivation-builder.cc
View file

@ -703,8 +703,11 @@ struct ChrootLinuxDerivationBuilder : ChrootDerivationBuilder, LinuxDerivationBu
DerivationBuilderImpl::killSandbox(getStats);
}
void addDependency(const StorePath & path) override
void addDependencyImpl(const StorePath & path) override
{
if (isAllowed(path))
return;
auto [source, target] = ChrootDerivationBuilder::addDependencyPrep(path);
/* Bind-mount the path into the sandbox. This requires