nrabulinski/lix
0
0
Fork 0
forked from lix-project/lix
Code Pull requests Activity

local-derivation-goal.cc: warn if failing and /proc/self/ns/user missing

Browse source 
This commit causes nix to `warn()` if sandbox setup has failed and
`/proc/self/ns/user` does not exist.  This is usually a sign that the
kernel was compiled without `CONFIG_USER_NS=y`, which is required for
sandboxing.
This commit is contained in:
Adam Joseph 2022-07-16 19:37:27 -07:00
parent 90830b1074
commit 8d35f387dc
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/libstore/build/local-derivation-goal.cc
View file

@ -861,6 +861,9 @@ void LocalDerivationGoal::startBuilder()
_exit(1);
if (!userNamespacesEnabled && errno==EPERM)
warn("user namespaces appear to be disabled; they are required for sandboxing; check /proc/sys/user/max_user_namespaces");
Path procSelfNsUser = "/proc/self/ns/user";
if (!pathExists(procSelfNsUser))
warn("/proc/self/ns/user does not exist; your kernel was likely built without CONFIG_USER_NS=y, which is required for sandboxing");
/* Mention sandbox-fallback in the error message so the user
knows that having it disabled contributed to the
unrecoverability of this failure */