diff --git a/doc/manual/release-notes/rl-2.0.xml b/doc/manual/release-notes/rl-2.0.xml index fc9a77b08..4c683dd3d 100644 --- a/doc/manual/release-notes/rl-2.0.xml +++ b/doc/manual/release-notes/rl-2.0.xml @@ -503,14 +503,14 @@ - Pure evaluation mode. This is a variant - of the existing restricted evaluation mode. In pure mode, the Nix - evaluator forbids access to anything that could cause different - evaluations of the same command line arguments to produce a + Pure evaluation mode. With the + --pure-eval flag, Nix enables a variant of the existing + restricted evaluation mode that forbids access to anything that could cause + different evaluations of the same command line arguments to produce a different result. This includes builtin functions such as builtins.getEnv, but more importantly, - all filesystem or network access unless a - content hash or commit hash is specified. For example, calls to + all filesystem or network access unless a content hash + or commit hash is specified. For example, calls to builtins.fetchGit are only allowed if a rev attribute is specified. diff --git a/src/libstore/ssh.cc b/src/libstore/ssh.cc index 2ee7115c5..84548a6e4 100644 --- a/src/libstore/ssh.cc +++ b/src/libstore/ssh.cc @@ -33,6 +33,9 @@ std::unique_ptr SSHMaster::startCommand(const std::string out.create(); auto conn = std::make_unique(); + ProcessOptions options; + options.dieWithParent = false; + conn->sshPid = startProcess([&]() { restoreSignals(); @@ -64,7 +67,7 @@ std::unique_ptr SSHMaster::startCommand(const std::string // could not exec ssh/bash throw SysError("unable to execute '%s'", args.front()); - }); + }, options); in.readSide = -1; @@ -91,6 +94,9 @@ Path SSHMaster::startMaster() Pipe out; out.create(); + ProcessOptions options; + options.dieWithParent = false; + state->sshMaster = startProcess([&]() { restoreSignals(); @@ -110,7 +116,7 @@ Path SSHMaster::startMaster() execvp(args.begin()->c_str(), stringsToCharPtrs(args).data()); throw SysError("unable to execute '%s'", args.front()); - }); + }, options); out.writeSide = -1;