1
1
Fork 0
mirror of https://github.com/NixOS/nix.git synced 2025-11-22 02:09:36 +01:00
Commit graph

17 commits

Author SHA1 Message Date
John Ericson
f4a0161cb1 Create StringSet DerivationBuilderParams::systemFeatures
Do this to avoid checking "system features" from the store config
directly, because we rather not have `DerivationBuilder` depend on
`Store`.
2025-08-27 12:38:15 -04:00
John Ericson
4bc9ae67c7 Give DerivationBuilder a LocalStore not Store
This is just more honest, since we downcasted it to `LocalStore` in many
places. We had the downcast before because it wasn't needed in the hook
case, just the local building case, but now that `DerivationBuilder` is
separated and just does the building case, we have formalized the
boundary where the single downcast should occur.
2025-08-15 15:50:36 -04:00
John Ericson
d4ef822add Factor out ChrootDerivationBuilder
This will allow us to have non-Linux chroot-using sandboxed builds.
2025-08-07 13:47:16 -04:00
Graham Christensen
e4f62e4608 Apply clang-format universally.
* It is tough to contribute to a project that doesn't use a formatter,
* It is extra hard to contribute to a project which has configured the formatter, but ignores it for some files
* Code formatting makes it harder to hide obscure / weird bugs by accident or on purpose,

Let's rip the bandaid off?

Note that PRs currently in flight should be able to be merged relatively easily by applying `clang-format` to their tip prior to merge.
2025-07-18 12:47:27 -04:00
Samuli Thomasson
0f6cb33763
fix throwing output paths out of sandbox paths
It seems obvious that erasing any output paths from pathsInChroot needs
to happen after getPathsInSandbox(), not before.

Signed-off-by: Samuli Thomasson <samuli.thomasson@pm.me>
2025-06-12 21:36:04 +02:00
Eelco Dolstra
4dc419eaec Split LinuxDerivationBuilder
This restores doing seccomp/personality initialization even when
sandboxing is disabled.

https://hydra.nixos.org/build/298482132
2025-05-29 21:57:25 +02:00
Eelco Dolstra
b7fd872147 Cleanup 2025-05-29 21:39:22 +02:00
John Ericson
24f5d7a9c3 Fix warning when HAVE_EMBEDDED_SANDBOX_SHELL is not set
Clang doesn't like the double indent that is needed for the `if...else`
that is CPP'd away. Adding braces is fine in the `if...else...` case,
and fine as a naked block in the CPP'd away case, and properly-indented
both ways.
2025-05-28 12:49:13 -04:00
John Ericson
625dce659a Prepare for FreeBSD sandboxing support
This is the utility changes from #9968, which were easier to rebase
first.

I (@Ericson2314) didn't write this code; I just rebased it.

Co-Authored-By: Artemis Tosini <me@artem.ist>
Co-Authored-By: Audrey Dutcher <audrey@rhelmot.io>
2025-05-27 14:54:50 -04:00
Eelco Dolstra
352ca238a9 Move cgroup support 2025-05-27 14:06:32 +02:00
Eelco Dolstra
774678b87f Get rid of tmpDirInSandbox variable 2025-05-27 14:00:21 +02:00
Eelco Dolstra
c9b55fa3f0 Move autoDelChroot 2025-05-27 14:00:16 +02:00
Eelco Dolstra
9e2151d839 Move seccomp code 2025-05-27 14:00:12 +02:00
Eelco Dolstra
b623fe8d14 Move doBind() 2025-05-27 14:00:07 +02:00
Eelco Dolstra
9f8f3968e3 Eliminate useChroot 2025-05-27 13:59:40 +02:00
Eelco Dolstra
67408807d8 Move pathsInChroot 2025-05-27 13:57:41 +02:00
Eelco Dolstra
5653bf5e0a DerivationBuilder: Move Linux/Darwin-specific code into subclasses 2025-05-27 13:42:22 +02:00