lix-project/lix-releng-staging
0
0
Fork 0
Code Packages Activity
lix-releng-staging/src/Makefile.am

14 lines
443 B
Makefile
Raw Normal View History

* Refactoring: put the Nix expression evaluator in its own library so that it can be used by multiple programs.
2003-11-19 11:35:41 +00:00
SUBDIRS = bin2c boost libutil libstore libmain nix-store nix-hash \
* Added a utility that can be used to produce nice HTML pages from Nix build logs. The program `log2xml' converts a Nix build log (read from standard input) into XML file that can then be converted to XHTML by the `log2html.xsl' stylesheet. The CSS stylesheet `logfile.css' is necessary to make it look good. This is primarily useful if the log file has a *tree structure*, i.e., that sub-tasks such as the various phases of a build (unpack, configure, make, etc.) or recursive invocations of Make are represented as such. While a log file is in principle an unstructured plain text file, builders can communicate this tree structure to `log2xml' by using escape sequences: - "\e[p" starts a new nesting level; the first line following the escape code is the header; - "\e[q" ends the current nesting level. The generic builder in nixpkgs (not yet committed) uses this. It shouldn't be to hard to patch GNU Make to speak this protocol. Further improvements to the generated HTML pages are to allow collapsing/expanding of subtrees, and to abbreviate store paths (but to show the full path by hovering the mouse over it).
2004-03-15 21:51:14 +00:00
libexpr nix-instantiate nix-env log2xml
* Setuid support for sharing a Nix installation between multiple users. If the configure flag `--enable-setuid' is used, the Nix programs nix-env, nix-store, etc. are installed with the setuid bit turned on so that they are executed as the user and group specified by `--with-nix-user=USER' and `--with-nix-group=GROUP', respectively (with defaults `nix' and `nix'). The setuid programs drop all special privileges if they are executed by a user who is not a member of the Nix group. The setuid feature is a quick hack to enable sharing of a Nix installation between users who trust each other. It is not generally secure, since any user in the Nix group can modify (by building an appropriate derivation) any object in the store, and for instance inject trojans into binaries used by other users. The setuid programs are owned by root, not the Nix user. This is because on Unix normal users cannot change the real uid, only the effective uid. Many programs don't work properly when the real uid differs from the effective uid. For instance, Perl will turn on taint mode. However, the setuid programs drop all root privileges immediately, changing all uids and gids to the Nix user and group.
2004-08-20 14:49:05 +00:00
SETUID_PROGS = nix-store nix-instantiate nix-env
install-exec-hook:
if SETUID_HACK
* A very dirty hack to make setuid installations a bit nicer to use. Previously there was the problem that all files read by nix-env etc. should be reachable and readable by the Nix user. So for instance building a Nix expression in your home directory meant that the home directory should have at least g+x or o+x permission so that the Nix user could reach the Nix expression. Now we just switch back to the original user just prior to reading sources and the like. The places where this happens are somewhat arbitrary, however. Any scope that has a live SwitchToOriginalUser object in it is executed as the original user. * Back out r1385. setreuid() sets the saved uid to the new real/effective uid, which prevents us from switching back to the original uid. setresuid() doesn't have this problem (although the manpage has a bug: specifying -1 for the saved uid doesn't leave it unchanged; an explicit value must be specified).
2004-09-09 21:12:53 +00:00
if HAVE_SETRESUID
* On systems that have the setresuid() and setresgid() system calls to set the real uid and gid to the effective uid and gid, the Nix binaries can be installed as owned by the Nix user and group instead of root, so no root involvement of any kind is necessary. Linux and FreeBSD have these functions.
2004-08-20 15:22:33 +00:00
cd $(DESTDIR)$(bindir) && chown @NIX_USER@ $(SETUID_PROGS) \
&& chgrp @NIX_GROUP@ $(SETUID_PROGS) && chmod ug+s $(SETUID_PROGS)
else
* Setuid support for sharing a Nix installation between multiple users. If the configure flag `--enable-setuid' is used, the Nix programs nix-env, nix-store, etc. are installed with the setuid bit turned on so that they are executed as the user and group specified by `--with-nix-user=USER' and `--with-nix-group=GROUP', respectively (with defaults `nix' and `nix'). The setuid programs drop all special privileges if they are executed by a user who is not a member of the Nix group. The setuid feature is a quick hack to enable sharing of a Nix installation between users who trust each other. It is not generally secure, since any user in the Nix group can modify (by building an appropriate derivation) any object in the store, and for instance inject trojans into binaries used by other users. The setuid programs are owned by root, not the Nix user. This is because on Unix normal users cannot change the real uid, only the effective uid. Many programs don't work properly when the real uid differs from the effective uid. For instance, Perl will turn on taint mode. However, the setuid programs drop all root privileges immediately, changing all uids and gids to the Nix user and group.
2004-08-20 14:49:05 +00:00
cd $(DESTDIR)$(bindir) && chown root $(SETUID_PROGS) && chmod u+s $(SETUID_PROGS)
endif
* On systems that have the setresuid() and setresgid() system calls to set the real uid and gid to the effective uid and gid, the Nix binaries can be installed as owned by the Nix user and group instead of root, so no root involvement of any kind is necessary. Linux and FreeBSD have these functions.
2004-08-20 15:22:33 +00:00
endif
Copy permalink