Geoffrey Thomas 5a794d9366 libstore: Make our sandbox pivot_root directory accessible to ourself ... If you have the Nix store mounted from a nonlocal filesystem whose exporter is not running as root, making the directory mode 000 makes it inaccessible to that remote unprivileged user and therefore breaks the build. (Specifically, I am running into this with a virtiofs mount using Apple Virtualization.framework as a non-root user, but I expect the same thing would happen with virtiofs in qemu on Linux as a non-root user or with various userspace network file servers.) Make the directory mode 500 (dr-x------) to make the sandbox work in this use case, which explicitly conveys our intention to read and search the directory. The code only works because root can already bypass directory checks, so this does not actually grant more permissions to the directory owner / does not make the sandbox less secure.		2024-10-12 19:55:58 -04:00
..
build	libstore: Make our sandbox pivot_root directory accessible to ourself	2024-10-12 19:55:58 -04:00
meson.build	Build nix-store with Meson	2024-06-14 10:25:14 -04:00
pathlocks.cc	Make abort() call sites log first	2024-07-24 16:52:04 +02:00
user-lock.cc	Solve unused header warnings reported by clangd	2024-07-12 15:37:54 +02:00
user-lock.hh	Solve unused header warnings reported by clangd	2024-07-12 15:37:54 +02:00