artemist/lix
0
0
Fork 0
forked from lix-project/lix
Code Pull requests Activity

Add ignored_acls setting

Browse source 
Signed-off-by: Magic_RB <magic_rb@redalder.org>
This commit is contained in:
Magic_RB 2021-05-03 09:54:31 +02:00
parent d581129ef9
commit 8438114399
No known key found for this signature in database
GPG key ID: 08D5287CC5DDCA0E
2 changed files with 10 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/libstore/globals.hh
View file

@ -805,6 +805,15 @@ public:
may be useful in certain scenarios (e.g. to spin up containers or may be useful in certain scenarios (e.g. to spin up containers or
set up userspace network interfaces in tests). set up userspace network interfaces in tests).
)"}; )"};
Setting<StringSet> ignoredAcls{
this, {"security.selinux"}, "ignored-acls",
R"(
A list of ACLs that should be ignored, normally Nix attempts to
remove all ACLs from files and directories in the Nix store, but
some ACLs like `security.selinux` or `system.nfs4_acl` can't be
removed even by root. Therefore it's best to just ignore them.
)"};
#endif #endif
Setting<Strings> hashedMirrors{ Setting<Strings> hashedMirrors{

4
src/libstore/local-store.cc
View file

@ -583,9 +583,7 @@ static void canonicalisePathMetaData_(const Path & path, uid_t fromUid, InodesSe
throw SysError("querying extended attributes of '%s'", path); throw SysError("querying extended attributes of '%s'", path);
for (auto & eaName: tokenizeString<Strings>(std::string(eaBuf.data(), eaSize), std::string("\000", 1))) { for (auto & eaName: tokenizeString<Strings>(std::string(eaBuf.data(), eaSize), std::string("\000", 1))) {
/* Ignore SELinux security labels since these cannot be if (settings.ignoredAcls.get().count(eaName)) continue;
removed even by root. */
if (eaName == "security.selinux") continue;
if (lremovexattr(path.c_str(), eaName.c_str()) == -1) if (lremovexattr(path.c_str(), eaName.c_str()) == -1)
throw SysError("removing extended attribute '%s' from '%s'", eaName, path); throw SysError("removing extended attribute '%s' from '%s'", eaName, path);
} }