forked from lix-project/lix
Further refactor linux-sandbox.sh and fix tee usage
This commit is contained in:
parent
b9c2f834ee
commit
f0233f3a3f
|
@ -11,6 +11,8 @@ requireSandboxSupport
|
||||||
# otherwise things get complicated (e.g. if it's in /bin, do we need
|
# otherwise things get complicated (e.g. if it's in /bin, do we need
|
||||||
# /lib as well?).
|
# /lib as well?).
|
||||||
if [[ ! $SHELL =~ /nix/store ]]; then skipTest "Shell is not from Nix store"; fi
|
if [[ ! $SHELL =~ /nix/store ]]; then skipTest "Shell is not from Nix store"; fi
|
||||||
|
# An alias to automatically bind-mount the $SHELL on nix-build invocations
|
||||||
|
nix-sandbox-build () { nix-build --no-out-link --sandbox-paths /nix/store "$@"; }
|
||||||
|
|
||||||
chmod -R u+w $TEST_ROOT/store0 || true
|
chmod -R u+w $TEST_ROOT/store0 || true
|
||||||
rm -rf $TEST_ROOT/store0
|
rm -rf $TEST_ROOT/store0
|
||||||
|
@ -18,7 +20,7 @@ rm -rf $TEST_ROOT/store0
|
||||||
export NIX_STORE_DIR=/my/store
|
export NIX_STORE_DIR=/my/store
|
||||||
export NIX_REMOTE=$TEST_ROOT/store0
|
export NIX_REMOTE=$TEST_ROOT/store0
|
||||||
|
|
||||||
outPath=$(nix-build dependencies.nix --no-out-link --sandbox-paths /nix/store)
|
outPath=$(nix-sandbox-build dependencies.nix)
|
||||||
|
|
||||||
[[ $outPath =~ /my/store/.*-dependencies ]]
|
[[ $outPath =~ /my/store/.*-dependencies ]]
|
||||||
|
|
||||||
|
@ -29,17 +31,18 @@ nix store ls -R -l $outPath | grep foobar
|
||||||
nix store cat $outPath/foobar | grep FOOBAR
|
nix store cat $outPath/foobar | grep FOOBAR
|
||||||
|
|
||||||
# Test --check without hash rewriting.
|
# Test --check without hash rewriting.
|
||||||
nix-build dependencies.nix --no-out-link --check --sandbox-paths /nix/store
|
nix-sandbox-build dependencies.nix --check
|
||||||
|
|
||||||
# Test that sandboxed builds with --check and -K can move .check directory to store
|
# Test that sandboxed builds with --check and -K can move .check directory to store
|
||||||
nix-build check.nix -A nondeterministic --sandbox-paths /nix/store --no-out-link
|
nix-sandbox-build check.nix -A nondeterministic
|
||||||
|
|
||||||
expectStderr 104 nix-build check.nix -A nondeterministic --sandbox-paths /nix/store --no-out-link --check -K \
|
expectStderr 104 nix-sandbox-build check.nix -A nondeterministic --check -K > $TEST_ROOT/log
|
||||||
| tee >( grepQuietInverse 'error: renaming' ) \
|
grepQuietInverse 'error: renaming' $TEST_ROOT/log
|
||||||
| grepQuiet 'may not be deterministic'
|
grepQuiet 'may not be deterministic' $TEST_ROOT/log
|
||||||
|
|
||||||
# Test that sandboxed builds cannot write to /etc easily
|
# Test that sandboxed builds cannot write to /etc easily
|
||||||
expect 100 nix-build -E 'with import ./config.nix; mkDerivation { name = "etc-write"; buildCommand = "echo > /etc/test"; }' --no-out-link --sandbox-paths /nix/store
|
expectStderr 100 nix-sandbox-build -E 'with import ./config.nix; mkDerivation { name = "etc-write"; buildCommand = "echo > /etc/test"; }' |
|
||||||
|
grepQuiet "/etc/test: Permission denied"
|
||||||
|
|
||||||
|
|
||||||
## Test mounting of SSL certificates into the sandbox
|
## Test mounting of SSL certificates into the sandbox
|
||||||
|
@ -48,9 +51,9 @@ testCert () {
|
||||||
mode=$2 # "normal" | "fixed-output"
|
mode=$2 # "normal" | "fixed-output"
|
||||||
certFile=$3 # a string that can be the path to a cert file
|
certFile=$3 # a string that can be the path to a cert file
|
||||||
[ "$mode" == fixed-output ] && ret=1 || ret=100
|
[ "$mode" == fixed-output ] && ret=1 || ret=100
|
||||||
expectStderr $ret nix-build linux-sandbox-cert-test.nix --argstr mode "$mode" --no-out-link --sandbox-paths /nix/store --option ssl-cert-file "$certFile" | \
|
expectStderr $ret nix-sandbox-build linux-sandbox-cert-test.nix --argstr mode "$mode" --option ssl-cert-file "$certFile" |
|
||||||
# tee /dev/stderr | \
|
# tee /dev/stderr |
|
||||||
grepQuiet "CERT_${expectation}_IN_SANDBOX"
|
grepQuiet "CERT_${expectation}_IN_SANDBOX"
|
||||||
}
|
}
|
||||||
|
|
||||||
nocert=$TEST_ROOT/no-cert-file.pem
|
nocert=$TEST_ROOT/no-cert-file.pem
|
||||||
|
|
Loading…
Reference in a new issue