lix-project/lix
20
57
Fork 31
Code Issues 347 Code Review (Gerrit) Projects 3 Releases Wiki Activity

Merge pull request #10456 from NixOS/fixpermdeniedbind

Browse source 
Fix adding symlink to the sandbox paths

(cherry-picked from commit da1e977bf48cff2a635034c85e7c13878e38efc2)

Change-Id: I221c85a38180800ec6552d2e86a88df48398fad8
This commit is contained in:
Théophane Hufschmitt 2024-04-11 13:41:49 +02:00 committed by K900
parent aeee22e5a1
commit 07b627cc6d
3 changed files with 58 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
src/libstore/build/local-derivation-goal.cc
View file

@ -389,21 +389,33 @@ void LocalDerivationGoal::cleanupPostOutputsRegisteredModeNonCheck()
#if __linux__
static void doBind(const Path & source, const Path & target, bool optional = false) {
debug("bind mounting '%1%' to '%2%'", source, target);
struct stat st;
if (stat(source.c_str(), &st) == -1) {
if (optional && errno == ENOENT)
auto bindMount = [&]() {
if (mount(source.c_str(), target.c_str(), "", MS_BIND | MS_REC, 0) == -1)
throw SysError("bind mount from '%1%' to '%2%' failed", source, target);
};
auto maybeSt = maybeLstat(source);
if (!maybeSt) {
if (optional)
return;
else
throw SysError("getting attributes of path '%1%'", source);
}
if (S_ISDIR(st.st_mode))
auto st = *maybeSt;
if (S_ISDIR(st.st_mode)) {
createDirs(target);
else {
bindMount();
} else if (S_ISLNK(st.st_mode)) {
// Symlinks can (apparently) not be bind-mounted, so just copy it
createDirs(dirOf(target));
copyFile(source, target, /* andDelete */ false);
} else {
createDirs(dirOf(target));
writeFile(target, "");
bindMount();
}
if (mount(source.c_str(), target.c_str(), "", MS_BIND | MS_REC, 0) == -1)
throw SysError("bind mount from '%1%' to '%2%' failed", source, target);
};
#endif

3
tests/functional/linux-sandbox.sh
View file

@ -73,3 +73,6 @@ testCert missing fixed-output "$nocert"
# Cert in sandbox when ssl-cert-file is set to an existing file
testCert present fixed-output "$cert"
# Symlinks should be added in the sandbox directly and not followed
nix-sandbox-build symlink-derivation.nix

36
tests/functional/symlink-derivation.nix Normal file
View file

@ -0,0 +1,36 @@
with import ./config.nix;
let
foo_in_store = builtins.toFile "foo" "foo";
foo_symlink = mkDerivation {
name = "foo-symlink";
buildCommand = ''
ln -s ${foo_in_store} $out
'';
};
symlink_to_not_in_store = mkDerivation {
name = "symlink-to-not-in-store";
buildCommand = ''
ln -s ${builtins.toString ./.} $out
'';
};
in
mkDerivation {
name = "depends-on-symlink";
buildCommand = ''
(
set -x
# `foo_symlink` should be a symlink pointing to `foo_in_store`
[[ -L ${foo_symlink} ]]
[[ $(readlink ${foo_symlink}) == ${foo_in_store} ]]
# `symlink_to_not_in_store` should be a symlink pointing to `./.`, which
# is not available in the sandbox
[[ -L ${symlink_to_not_in_store} ]]
[[ $(readlink ${symlink_to_not_in_store}) == ${builtins.toString ./.} ]]
(! ls ${symlink_to_not_in_store}/)
)
echo "Success!" > $out
'';
}