eisfunke/lix
0
0
Fork 0
forked from lix-project/lix
Code Pull requests Activity

use per-derivation sandbox profiles

Browse source
This commit is contained in:
Jude Taylor 2015-11-12 19:00:16 -08:00
parent 9ee15abe30
commit 8a7f0dfd68
1 changed files with 36 additions and 25 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
src/libstore/build.cc
View file

@ -778,6 +778,8 @@ private:
DirsInChroot dirsInChroot; DirsInChroot dirsInChroot;
typedef map<string, string> Environment; typedef map<string, string> Environment;
Environment env; Environment env;
typedef string SandboxProfile;
SandboxProfile additionalSandboxProfile;
/* Hash rewriting. */ /* Hash rewriting. */
HashRewrites rewritesToTmp, rewritesFromTmp; HashRewrites rewritesToTmp, rewritesFromTmp;
@ -1919,6 +1921,7 @@ void DerivationGoal::startBuilder()
for (auto & i : closure) for (auto & i : closure)
dirsInChroot[i] = i; dirsInChroot[i] = i;
if(!SANDBOX_ENABLED) {
string allowed = settings.get("allowed-impure-host-deps", string(DEFAULT_ALLOWED_IMPURE_PREFIXES)); string allowed = settings.get("allowed-impure-host-deps", string(DEFAULT_ALLOWED_IMPURE_PREFIXES));
PathSet allowedPaths = tokenizeString<StringSet>(allowed); PathSet allowedPaths = tokenizeString<StringSet>(allowed);
@ -1944,6 +1947,9 @@ void DerivationGoal::startBuilder()
dirsInChroot[i] = i; dirsInChroot[i] = i;
} }
} else {
additionalSandboxProfile = get(drv->env, "__sandboxProfile");
}
#if CHROOT_ENABLED #if CHROOT_ENABLED
/* Create a temporary directory in which we set up the chroot /* Create a temporary directory in which we set up the chroot
@ -2471,8 +2477,6 @@ void DerivationGoal::runChild()
/* This has to appear before import statements */ /* This has to appear before import statements */
sandboxProfile += "(version 1)\n"; sandboxProfile += "(version 1)\n";
sandboxProfile += (format("(import \"%1%/nix/sandbox-defaults.sb\")\n") % settings.nixDataDir).str();
/* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */ /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */
if (settings.get("darwin-log-sandbox-violations", false)) { if (settings.get("darwin-log-sandbox-violations", false)) {
sandboxProfile += "(deny default)\n"; sandboxProfile += "(deny default)\n";
@ -2528,13 +2532,20 @@ void DerivationGoal::runChild()
} }
sandboxProfile += ")\n"; sandboxProfile += ")\n";
sandboxProfile += additionalSandboxProfile;
debug("Generated sandbox profile:"); debug("Generated sandbox profile:");
debug(sandboxProfile); debug(sandboxProfile);
char *tmpProfile = strdup((format("%1%/nix-sandboxXXXXXX.sb") % globalTmpDir).str().c_str());
int profileFd = mkstemps(tmpProfile, 3);
closeOnExec(profileFd);
writeFull(profileFd, sandboxProfile);
builder = "/usr/bin/sandbox-exec"; builder = "/usr/bin/sandbox-exec";
args.push_back("sandbox-exec"); args.push_back("sandbox-exec");
args.push_back("-p"); args.push_back("-f");
args.push_back(sandboxProfile); args.push_back(tmpProfile);
args.push_back("-D"); args.push_back("-D");
args.push_back((format("_GLOBAL_TMP_DIR=%1%") % globalTmpDir).str()); args.push_back((format("_GLOBAL_TMP_DIR=%1%") % globalTmpDir).str());
args.push_back(drv->builder); args.push_back(drv->builder);