forked from lix-project/lix
Audrey Dutcher
ae628d4af2
The <() process substitution syntax doesn't work for this one testcase
in bash for FreeBSD. The exact reason for this is unknown, possibly to
do with pipe vs file vs fifo EOF behavior. The prior behavior was this
test hanging forever, with no children of the bash process.
Change-Id: I71822a4b9dea6059b34300568256c5b7848109ac
54 lines
3 KiB
Bash
54 lines
3 KiB
Bash
source common.sh
|
|
|
|
clearStore
|
|
|
|
nix-instantiate --restrict-eval --eval -E '1 + 2'
|
|
(! nix-instantiate --eval --restrict-eval ./restricted.nix)
|
|
TMPFILE=$(mktemp); echo '1 + 2' >$TMPFILE; (! nix-instantiate --eval --restrict-eval $TMPFILE); rm $TMPFILE
|
|
nix-instantiate --restrict-eval ./simple.nix -I src=.
|
|
nix-instantiate --restrict-eval ./simple.nix -I src1=simple.nix -I src2=config.nix -I src3=./simple.builder.sh
|
|
|
|
(! nix-instantiate --restrict-eval --eval -E 'builtins.readFile ./simple.nix')
|
|
nix-instantiate --restrict-eval --eval -E 'builtins.readFile ./simple.nix' -I src=../..
|
|
|
|
(! nix-instantiate --restrict-eval --eval -E 'builtins.readDir ../../src/nix-channel')
|
|
nix-instantiate --restrict-eval --eval -E 'builtins.readDir ../../src/nix-channel' -I src=../../src
|
|
|
|
(! nix-instantiate --restrict-eval --eval -E 'let __nixPath = [ { prefix = "foo"; path = ./.; } ]; in <foo>')
|
|
nix-instantiate --restrict-eval --eval -E 'let __nixPath = [ { prefix = "foo"; path = ./.; } ]; in <foo>' -I src=.
|
|
|
|
p=$(nix eval --raw --expr "builtins.fetchurl \"file://$(pwd)/restricted.sh\"" --impure --restrict-eval --allowed-uris "file://$(pwd)")
|
|
cmp $p restricted.sh
|
|
|
|
(! nix eval --raw --expr "builtins.fetchurl \"file://$(pwd)/restricted.sh\"" --impure --restrict-eval)
|
|
|
|
(! nix eval --raw --expr "builtins.fetchurl \"file://$(pwd)/restricted.sh\"" --impure --restrict-eval --allowed-uris "file://$(pwd)/restricted.sh/")
|
|
|
|
nix eval --raw --expr "builtins.fetchurl \"file://$(pwd)/restricted.sh\"" --impure --restrict-eval --allowed-uris "file://$(pwd)/restricted.sh"
|
|
|
|
(! nix eval --raw --expr "builtins.fetchurl \"https://github.com/NixOS/patchelf/archive/master.tar.gz\"" --impure --restrict-eval)
|
|
(! nix eval --raw --expr "builtins.fetchTarball \"https://github.com/NixOS/patchelf/archive/master.tar.gz\"" --impure --restrict-eval)
|
|
(! nix eval --raw --expr "fetchGit \"git://github.com/NixOS/patchelf.git\"" --impure --restrict-eval)
|
|
|
|
ln -sfn $(pwd)/restricted.nix $TEST_ROOT/restricted.nix
|
|
[[ $(nix-instantiate --eval $TEST_ROOT/restricted.nix) == 3 ]]
|
|
(! nix-instantiate --eval --restrict-eval $TEST_ROOT/restricted.nix)
|
|
(! nix-instantiate --eval --restrict-eval $TEST_ROOT/restricted.nix -I $TEST_ROOT)
|
|
(! nix-instantiate --eval --restrict-eval $TEST_ROOT/restricted.nix -I .)
|
|
nix-instantiate --eval --restrict-eval $TEST_ROOT/restricted.nix -I $TEST_ROOT -I .
|
|
|
|
[[ $(nix eval --raw --impure --restrict-eval -I . --expr 'builtins.readFile "${import ./simple.nix}/hello"') == 'Hello World!' ]]
|
|
|
|
# Check whether we can leak symlink information through directory traversal.
|
|
traverseDir="$(pwd)/restricted-traverse-me"
|
|
ln -sfn "$(pwd)/restricted-secret" "$(pwd)/restricted-innocent"
|
|
mkdir -p "$traverseDir"
|
|
goUp="..$(echo "$traverseDir" | sed -e 's,[^/]\+,..,g')"
|
|
output="$(nix eval --raw --restrict-eval -I "$traverseDir" \
|
|
--expr "builtins.readFile \"$traverseDir/$goUp$(pwd)/restricted-innocent\"" \
|
|
2>&1 || :)"
|
|
echo "$output" | grep "is forbidden"
|
|
echo "$output" | grepInverse -F restricted-secret
|
|
|
|
expectStderr 1 nix-instantiate --restrict-eval true ./dependencies.nix | grepQuiet "forbidden in restricted mode"
|