30dcc19d1f
I think it is bad for these reasons when `tests/` contains a mix of functional and integration tests - Concepts is harder to understand, the documentation makes a good unit vs functional vs integration distinction, but when the integration tests are just two subdirs within `tests/` this is not clear. - Source filtering in the `flake.nix` is more complex. We need to filter out some of the dirs from `tests/`, rather than simply pick the dirs we want and take all of them. This is a good sign the structure of what we are trying to do is not matching the structure of the files. With this change we have a clean: ```shell-session $ git show 'HEAD:tests' tree HEAD:tests functional/ installer/ nixos/ ``` (cherry picked from commit 68c81c737571794f7246db53fb4774e94fcf4b7e)
53 lines
3 KiB
Bash
53 lines
3 KiB
Bash
source common.sh
|
|
|
|
clearStore
|
|
|
|
nix-instantiate --restrict-eval --eval -E '1 + 2'
|
|
(! nix-instantiate --eval --restrict-eval ./restricted.nix)
|
|
(! nix-instantiate --eval --restrict-eval <(echo '1 + 2'))
|
|
nix-instantiate --restrict-eval ./simple.nix -I src=.
|
|
nix-instantiate --restrict-eval ./simple.nix -I src1=simple.nix -I src2=config.nix -I src3=./simple.builder.sh
|
|
|
|
(! nix-instantiate --restrict-eval --eval -E 'builtins.readFile ./simple.nix')
|
|
nix-instantiate --restrict-eval --eval -E 'builtins.readFile ./simple.nix' -I src=../..
|
|
|
|
(! nix-instantiate --restrict-eval --eval -E 'builtins.readDir ../../src/nix-channel')
|
|
nix-instantiate --restrict-eval --eval -E 'builtins.readDir ../../src/nix-channel' -I src=../../src
|
|
|
|
(! nix-instantiate --restrict-eval --eval -E 'let __nixPath = [ { prefix = "foo"; path = ./.; } ]; in <foo>')
|
|
nix-instantiate --restrict-eval --eval -E 'let __nixPath = [ { prefix = "foo"; path = ./.; } ]; in <foo>' -I src=.
|
|
|
|
p=$(nix eval --raw --expr "builtins.fetchurl file://$(pwd)/restricted.sh" --impure --restrict-eval --allowed-uris "file://$(pwd)")
|
|
cmp $p restricted.sh
|
|
|
|
(! nix eval --raw --expr "builtins.fetchurl file://$(pwd)/restricted.sh" --impure --restrict-eval)
|
|
|
|
(! nix eval --raw --expr "builtins.fetchurl file://$(pwd)/restricted.sh" --impure --restrict-eval --allowed-uris "file://$(pwd)/restricted.sh/")
|
|
|
|
nix eval --raw --expr "builtins.fetchurl file://$(pwd)/restricted.sh" --impure --restrict-eval --allowed-uris "file://$(pwd)/restricted.sh"
|
|
|
|
(! nix eval --raw --expr "builtins.fetchurl https://github.com/NixOS/patchelf/archive/master.tar.gz" --impure --restrict-eval)
|
|
(! nix eval --raw --expr "builtins.fetchTarball https://github.com/NixOS/patchelf/archive/master.tar.gz" --impure --restrict-eval)
|
|
(! nix eval --raw --expr "fetchGit git://github.com/NixOS/patchelf.git" --impure --restrict-eval)
|
|
|
|
ln -sfn $(pwd)/restricted.nix $TEST_ROOT/restricted.nix
|
|
[[ $(nix-instantiate --eval $TEST_ROOT/restricted.nix) == 3 ]]
|
|
(! nix-instantiate --eval --restrict-eval $TEST_ROOT/restricted.nix)
|
|
(! nix-instantiate --eval --restrict-eval $TEST_ROOT/restricted.nix -I $TEST_ROOT)
|
|
(! nix-instantiate --eval --restrict-eval $TEST_ROOT/restricted.nix -I .)
|
|
nix-instantiate --eval --restrict-eval $TEST_ROOT/restricted.nix -I $TEST_ROOT -I .
|
|
|
|
[[ $(nix eval --raw --impure --restrict-eval -I . --expr 'builtins.readFile "${import ./simple.nix}/hello"') == 'Hello World!' ]]
|
|
|
|
# Check whether we can leak symlink information through directory traversal.
|
|
traverseDir="$(pwd)/restricted-traverse-me"
|
|
ln -sfn "$(pwd)/restricted-secret" "$(pwd)/restricted-innocent"
|
|
mkdir -p "$traverseDir"
|
|
goUp="..$(echo "$traverseDir" | sed -e 's,[^/]\+,..,g')"
|
|
output="$(nix eval --raw --restrict-eval -I "$traverseDir" \
|
|
--expr "builtins.readFile \"$traverseDir/$goUp$(pwd)/restricted-innocent\"" \
|
|
2>&1 || :)"
|
|
echo "$output" | grep "is forbidden"
|
|
echo "$output" | grepInverse -F restricted-secret
|
|
|
|
expectStderr 1 nix-instantiate --restrict-eval true ./dependencies.nix | grepQuiet "forbidden in restricted mode"
|