artemist/lix
0
0
Fork 0
forked from lix-project/lix
Code Pull requests Activity

Merge branch 'master' of https://github.com/MagicRB/nix

Browse source
This commit is contained in:
Eelco Dolstra 2021-12-10 14:49:25 +01:00
commit f9437b4f18
2 changed files with 10 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/libstore/globals.hh
View file

@ -797,6 +797,15 @@ public:
may be useful in certain scenarios (e.g. to spin up containers or may be useful in certain scenarios (e.g. to spin up containers or
set up userspace network interfaces in tests). set up userspace network interfaces in tests).
)"}; )"};
Setting<StringSet> ignoredAcls{
this, {"security.selinux"}, "ignored-acls",
R"(
A list of ACLs that should be ignored, normally Nix attempts to
remove all ACLs from files and directories in the Nix store, but
some ACLs like `security.selinux` or `system.nfs4_acl` can't be
removed even by root. Therefore it's best to just ignore them.
)"};
#endif #endif
Setting<Strings> hashedMirrors{ Setting<Strings> hashedMirrors{

4
src/libstore/local-store.cc
View file

@ -590,9 +590,7 @@ static void canonicalisePathMetaData_(const Path & path, uid_t fromUid, InodesSe
throw SysError("querying extended attributes of '%s'", path); throw SysError("querying extended attributes of '%s'", path);
for (auto & eaName: tokenizeString<Strings>(std::string(eaBuf.data(), eaSize), std::string("\000", 1))) { for (auto & eaName: tokenizeString<Strings>(std::string(eaBuf.data(), eaSize), std::string("\000", 1))) {
/* Ignore SELinux security labels since these cannot be if (settings.ignoredAcls.get().count(eaName)) continue;
removed even by root. */
if (eaName == "security.selinux") continue;
if (lremovexattr(path.c_str(), eaName.c_str()) == -1) if (lremovexattr(path.c_str(), eaName.c_str()) == -1)
throw SysError("removing extended attribute '%s' from '%s'", eaName, path); throw SysError("removing extended attribute '%s' from '%s'", eaName, path);
} }