diff --git a/src/libstore/unix/build/derivation-builder.cc b/src/libstore/unix/build/derivation-builder.cc index 5d26ab8fd..73bb026a2 100644 --- a/src/libstore/unix/build/derivation-builder.cc +++ b/src/libstore/unix/build/derivation-builder.cc @@ -652,17 +652,17 @@ static void handleChildException(bool sendException) } } -static bool checkNotWorldWritable(std::filesystem::path path) +static void checkNotWorldWritable(std::filesystem::path path) { while (true) { auto st = lstat(path); if (st.st_mode & S_IWOTH) - return false; + throw Error("Path %s is world-writable or a symlink. That's not allowed for security.", path); if (path == path.parent_path()) break; path = path.parent_path(); } - return true; + return; } void DerivationBuilderImpl::startBuilder() @@ -700,9 +700,8 @@ void DerivationBuilderImpl::startBuilder() createDirs(buildDir); - if (buildUser && !checkNotWorldWritable(buildDir)) - throw Error( - "Path %s or a parent directory is world-writable or a symlink. That's not allowed for security.", buildDir); + if (buildUser) + checkNotWorldWritable(buildDir); /* Create a temporary directory where the build will take place. */