lix/tests/linux-sandbox.sh

source common.sh

needLocalStore "the sandbox only runs on the builder side, so it makes no sense to test it with the daemon"

clearStore

if ! canUseSandbox; then exit 99; fi

# Note: we need to bind-mount $SHELL into the chroot. Currently we
# only support the case where $SHELL is in the Nix store, because
# otherwise things get complicated (e.g. if it's in /bin, do we need
# /lib as well?).
if [[ ! $SHELL =~ /nix/store ]]; then exit 99; fi

chmod -R u+w $TEST_ROOT/store0 || true
rm -rf $TEST_ROOT/store0

export NIX_STORE_DIR=/my/store
export NIX_REMOTE=$TEST_ROOT/store0

outPath=$(nix-build dependencies.nix --no-out-link --sandbox-paths /nix/store)

[[ $outPath =~ /my/store/.*-dependencies ]]

nix path-info -r $outPath | grep input-2

nix store ls -R -l $outPath | grep foobar

nix store cat $outPath/foobar | grep FOOBAR

# Test --check without hash rewriting.
nix-build dependencies.nix --no-out-link --check --sandbox-paths /nix/store

# Test that sandboxed builds with --check and -K can move .check directory to store
nix-build check.nix -A nondeterministic --sandbox-paths /nix/store --no-out-link

(! nix-build check.nix -A nondeterministic --sandbox-paths /nix/store --no-out-link --check -K 2> $TEST_ROOT/log)
if grepQuiet 'error: renaming' $TEST_ROOT/log; then false; fi
grepQuiet 'may not be deterministic' $TEST_ROOT/log

# Test that sandboxed builds cannot write to /etc easily
(! nix-build -E 'with import ./config.nix; mkDerivation { name = "etc-write"; buildCommand = "echo > /etc/test"; }' --no-out-link --sandbox-paths /nix/store)
Add a test for diverted stores 2017-05-02 13:09:35 +00:00			`source common.sh`

Allow running all the tests with the daemon When `NIX_DAEMON_PACKAGE` is set, make all the tests use the Nix daemon. That way we can test every piece of Nix functionality both with and without the daemon. Tests for which using the daemon isn’t possible or doesn’t make sens can selectively be disabled with `needLocalStore` 2021-07-26 04:54:55 +00:00			`needLocalStore "the sandbox only runs on the builder side, so it makes no sense to test it with the daemon"`

Add a test for diverted stores 2017-05-02 13:09:35 +00:00			`clearStore`

tests/*: show when tests are skipped 2021-03-24 13:44:20 +00:00			`if ! canUseSandbox; then exit 99; fi`
Add a test for diverted stores 2017-05-02 13:09:35 +00:00
			`# Note: we need to bind-mount $SHELL into the chroot. Currently we`
			`# only support the case where $SHELL is in the Nix store, because`
			`# otherwise things get complicated (e.g. if it's in /bin, do we need`
			`# /lib as well?).`
tests/*: show when tests are skipped 2021-03-24 13:44:20 +00:00			`if [[ ! $SHELL =~ /nix/store ]]; then exit 99; fi`
Add a test for diverted stores 2017-05-02 13:09:35 +00:00
			`chmod -R u+w $TEST_ROOT/store0 \|\| true`
			`rm -rf $TEST_ROOT/store0`

			`export NIX_STORE_DIR=/my/store`
Allow shorter syntax for chroot stores You can now say '--store /tmp/nix' instead of '--store local?root=/tmp/nix'. 2017-10-24 13:16:18 +00:00			`export NIX_REMOTE=$TEST_ROOT/store0`
Add a test for diverted stores 2017-05-02 13:09:35 +00:00
Test: Replace --option with the corresponding flag 2017-11-20 16:50:49 +00:00			`outPath=$(nix-build dependencies.nix --no-out-link --sandbox-paths /nix/store)`
Add a test for diverted stores 2017-05-02 13:09:35 +00:00
			`[[ $outPath =~ /my/store/.*-dependencies ]]`

			`nix path-info -r $outPath \| grep input-2`

Move NAR-related commands to 'nix nar' 2020-07-24 18:42:24 +00:00			`nix store ls -R -l $outPath \| grep foobar`
Add a test for diverted stores 2017-05-02 13:09:35 +00:00
Move NAR-related commands to 'nix nar' 2020-07-24 18:42:24 +00:00			`nix store cat $outPath/foobar \| grep FOOBAR`
build: add test for sandboxed --check 2019-05-12 14:46:21 +00:00
			`# Test --check without hash rewriting.`
			`nix-build dependencies.nix --no-out-link --check --sandbox-paths /nix/store`
Fix nix-build --check -K in sandbox w/o root Temporarily add user-write permission to build directory so that it can be moved out of the sandbox to the store with a .check suffix. This is necessary because the build directory has already had its permissions set read-only, but write permission is required to update the directory's parent link to move it out of the sandbox. Updated the related --check "derivation may not be deterministic" messages to consistently use the real store paths. Added test for non-root sandbox nix-build --check -K to demonstrate issue and help prevent regressions. 2019-02-17 19:34:31 +00:00
			`# Test that sandboxed builds with --check and -K can move .check directory to store`
			`nix-build check.nix -A nondeterministic --sandbox-paths /nix/store --no-out-link`

			`(! nix-build check.nix -A nondeterministic --sandbox-paths /nix/store --no-out-link --check -K 2> $TEST_ROOT/log)`
Harden tests' bash Use `set -u` and `set -o pipefail` to catch accidental mistakes and failures more strongly. - `set -u` catches the use of undefined variables - `set -o pipefail` catches failures (like `set -e`) earlier in the pipeline. This makes the tests a bit more robust. It is nice to read code not worrying about these spurious success paths (via uncaught) errors undermining the tests. Indeed, I caught some bugs doing this. There are a few tests where we run a command that should fail, and then search its output to make sure the failure message is one that we expect. Before, since the `grep` was the last command in the pipeline the exit code of those failing programs was silently ignored. Now with `set -o pipefail` it won't be, and we have to do something so the expected failure doesn't accidentally fail the test. To do that we use `expect` and a new `expectStderr` to check for the exact failing exit code. See the comments on each for why. `grep -q` is replaced with `grepQuiet`, see the comments on that function for why. `grep -v` when we just want the exit code is replaced with `grepInverse, see the comments on that function for why. `grep -q -v` together is, surprise surprise, replaced with `grepQuietInverse`, which is both combined. Co-authored-by: Robert Hensing <roberth@users.noreply.github.com> 2021-12-09 15:26:46 +00:00			`if grepQuiet 'error: renaming' $TEST_ROOT/log; then false; fi`
			`grepQuiet 'may not be deterministic' $TEST_ROOT/log`
Don't allow writing to /etc 2023-02-14 11:03:34 +00:00
			`# Test that sandboxed builds cannot write to /etc easily`
			`(! nix-build -E 'with import ./config.nix; mkDerivation { name = "etc-write"; buildCommand = "echo > /etc/test"; }' --no-out-link --sandbox-paths /nix/store)`