Commit graph

4769 commits

Author SHA1 Message Date
Shea Levy 79ca503332 Allow using /bin and /usr/bin as impure prefixes on non-darwin by default
These directories are generally world-readable anyway, and give us the two
most common linux impurities (env and sh)
2015-01-13 15:41:46 +01:00
Eelco Dolstra fcf57aad27 SysError -> Error 2015-01-13 11:17:56 +01:00
Eelco Dolstra 100961e370 Don't resolve symlinks while checking __impureHostDeps
Since these come from untrusted users, we shouldn't do any I/O on them
before we've checked that they're in an allowed prefix.
2015-01-13 11:16:32 +01:00
Daniel Peebles f1151a3373 Add basic Apple sandbox support 2015-01-12 12:00:01 +01:00
Tobias Geerinckx-Rice c23d67920e doc: nix-channel --remove takes a name, not a url 2015-01-12 10:56:58 +01:00
Eelco Dolstra 2a3b1df423 Fix builtins.readDir on XFS
The DT_UNKNOWN fallback code was getting the type of the wrong path,
causing readDir to report "directory" as the type of every file.

Reported by deepfire on IRC.
2015-01-09 14:56:25 +01:00
Eelco Dolstra 57d64d24aa Doh^2 2015-01-08 16:59:22 +01:00
Eelco Dolstra 57b82256b0 Doh 2015-01-08 16:49:31 +01:00
Данило Глинський (Danylo Hlynskyi) ed56ea980b Fix typo (assuming this is a typo)
Fix typo (assuming this is a typo)
`allowedRequisites` mentions `allowedReferences` in code example
2015-01-08 16:43:56 +01:00
Eelco Dolstra 27b7b94923 Set /nix/store permission to 1737
I.e., not readable to the nixbld group. This improves purity a bit for
non-chroot builds, because it prevents a builder from enumerating
store paths (i.e. it can only access paths it knows about).
2015-01-08 16:39:07 +01:00
Eelco Dolstra 128538ef06 nix-shell: Add --run flag
‘--run’ is like ‘--command’, except that it runs the command in a
non-interactive shell. This is important if you do things like:

  $ nix-shell --command make

Hitting Ctrl-C while make is running drops you into the interactive
Nix shell, which is probably not what you want. So you can now do

  $ nix-shell --run make

instead.
2015-01-08 15:14:38 +01:00
Eelco Dolstra b76589206a nix-shell: Interpret filenames relative to the #!-script
So you can have a script like:

  #! /usr/bin/env nix-shell
  #! nix-shell script.nix -i python

  import prettytable

  x = prettytable.PrettyTable(["Foo", "Bar"])
  for i in range(1, 10): x.add_row([i, i**2])
  print x

with a ‘script.nix’ in the same directory:

  with import <nixpkgs> {};

  runCommand "dummy" { buildInputs = [ python pythonPackages.prettytable ]; } ""

(Of course, in this particular case, using the ‘-p’ flag is more
convenient.)
2015-01-08 14:56:14 +01:00
Eelco Dolstra a957893b26 Allow nix-shell to be used as a #! interpreter
This allows scripts to fetch their own dependencies via nix-shell. For
instance, here is a Haskell script that, when executed, pulls in GHC
and the HTTP package:

  #! /usr/bin/env nix-shell
  #! nix-shell -i runghc -p haskellPackages.ghc haskellPackages.HTTP

  import Network.HTTP

  main = do
    resp <- Network.HTTP.simpleHTTP (getRequest "http://nixos.org/")
    body <- getResponseBody resp
    print (take 100 body)

Or a Perl script that pulls in Perl and some CPAN packages:

  #! /usr/bin/env nix-shell
  #! nix-shell -i perl -p perl perlPackages.HTMLTokeParserSimple perlPackages.LWP

  use HTML::TokeParser::Simple;

  my $p = HTML::TokeParser::Simple->new(url => 'http://nixos.org/');

  while (my $token = $p->get_tag("a")) {
      my $href = $token->get_attr("href");
      print "$href\n" if $href;
  }

Note that the options to nix-shell must be given on a separate line
that starts with the magic string ‘#! nix-shell’. This is because
‘env’ does not allow passing arguments to an interpreter directly.
2015-01-08 14:32:45 +01:00
Eelco Dolstra 7ba0e9cb48 nix-shell --command: Remove bogus argument to "exit"
Fixes "exit: Inappropriate: numeric argument required" errors.
2015-01-07 16:10:20 +01:00
Eelco Dolstra 153a943de7 Show position info for failing <...> lookups 2015-01-07 13:43:55 +01:00
Eelco Dolstra 6fec43ccb3 Remove quotes around filenames in position info 2015-01-07 12:08:10 +01:00
Eelco Dolstra 4d5c9d85ea Document how to set up build users on Mac OS X 2015-01-06 11:17:11 +01:00
Eelco Dolstra df05f49dcd Fix building on Darwin
Fixes #433.
2015-01-06 10:49:44 +01:00
Rob Vermaas 1b167c964f Merge pull request #431 from j-keck/master
small documentation fixes
2015-01-05 15:13:51 +01:00
j-keck 14fb7378df doc: remove wrong phrase.
'... another level of indirection not shown in the figure above ...'
but in the 'user-environments.png' figure there is '~/.nix-profile'.
the figure was updated with the commit: f982df3 on Mar 16, 2005.
2015-01-05 15:08:53 +01:00
j-keck 2c052278d2 doc: remove double word
'... when when ...' -> '... when ...'
2015-01-05 13:40:19 +01:00
Eelco Dolstra 8027083c3a Allow $NIX_PAGER to override $PAGER 2015-01-02 15:26:56 +01:00
aszlig 8b88d25cda libutil: Limit readLink() error to only overflows.
Let's not just improve the error message itself, but also the behaviour
to actually work around the ntfs-3g symlink bug. If the readlink() call
returns a smaller size than the stat() call, this really isn't a problem
even if the symlink target really has changed between the calls.

So if stat() reports the size for the absolute path, it's most likely
that the relative path is smaller and thus it should also work for file
system bugs as mentioned in 93002d69fc58c2b71e2dfad202139230c630c53a.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Tested-by: John Ericson <Ericson2314@Yahoo.com>
2015-01-02 12:53:42 +01:00
aszlig bbd45ac80f libutil: Improve errmsg on readLink size mismatch.
A message like "error: reading symbolic link `...' : Success" really is
quite confusing, so let's not indicate "success" but rather point out
the real issue.

We could also limit the check of this to just check for non-negative
values, but this would introduce a race condition between stat() and
readlink() if the link target changes between those two calls, thus
leading to a buffer overflow vulnerability.

Reported by @Ericson2314 on IRC. Happened due to a possible ntfs-3g bug
where a relative symlink returned the absolute path (st_)size in stat()
while readlink() returned the relative size.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Tested-by: John Ericson <Ericson2314@Yahoo.com>
2015-01-02 12:53:42 +01:00
Eelco Dolstra 411b237ee5 edition -> subtitle
For some reason, docbook-xsl doesn't render edition.
2015-01-02 12:53:32 +01:00
Shea Levy 3d97b8d1e7 LocalStore initialization: Don't die if build-users-group doesn't exist
See NixOS/nixpkgs@9245516
2014-12-29 14:40:13 +01:00
Eelco Dolstra bd0f362d2f Revive running builds in a PID namespace 2014-12-23 17:25:06 +01:00
Eelco Dolstra f16b8786a2 Belatedly add contributors 2014-12-16 18:58:04 +01:00
Eelco Dolstra 2162a9c1c7 Bump version number 2014-12-15 18:05:56 +01:00
Eelco Dolstra ccde347eb8 Merge pull request #420 from linquize/cygwin
Add exe, dll to .gitignore
2014-12-15 16:38:05 +01:00
Linquize 4579a44617 Add exe, dll to .gitignore 2014-12-15 23:34:13 +08:00
Eelco Dolstra c2384052e3 Grmbl 2014-12-14 03:38:54 +01:00
Eelco Dolstra 47ed06a290 Add a section on nix-serve 2014-12-14 03:37:41 +01:00
Eelco Dolstra 2142f47c06 Add section on SSH substituter 2014-12-14 03:19:15 +01:00
Eelco Dolstra 4e0607369e Pedantry 2014-12-14 01:51:14 +01:00
Eelco Dolstra 8bdff8c100 Merge branch 'cygwin-master' of https://github.com/ternaris/nix 2014-12-14 01:49:14 +01:00
Eelco Dolstra 14955c297d Merge commit '36c67860363c93eb00cf5b8e2ad34f6f775e6901' 2014-12-14 01:47:06 +01:00
Eelco Dolstra 68b4717873 Delete the stdenv section
It's outdated and better covered in the Nixpkgs manual.
2014-12-14 01:39:32 +01:00
Eelco Dolstra 6466d56f42 Bla 2014-12-14 01:33:16 +01:00
Eelco Dolstra e90e7b5e0a Fix build
http://hydra.nixos.org/build/17894500
2014-12-14 01:29:35 +01:00
Eelco Dolstra eb53f592b8 Fix image in PDF
Closes #415.
2014-12-14 01:23:06 +01:00
Eelco Dolstra 9c830394ec Rename files 2014-12-14 01:07:23 +01:00
Eelco Dolstra 4c4e891652 Update .nixpkg description 2014-12-13 23:27:22 +01:00
Eelco Dolstra be79773542 ReiserFS -> ext4 2014-12-13 23:23:19 +01:00
Eelco Dolstra 4eace5adda Style 2014-12-13 23:21:14 +01:00
Eelco Dolstra 751ae181a1 Undocument nix-generate-patches 2014-12-13 23:17:26 +01:00
Eelco Dolstra 3b88d03714 Document channel format and excise most mentions of manifests and nix-pull 2014-12-13 23:16:08 +01:00
Eelco Dolstra e5a51fab24 Style 2014-12-13 21:50:01 +01:00
Eelco Dolstra fa2063ca35 Better error message 2014-12-13 16:54:40 +01:00
Eelco Dolstra c2a552b075 Install cacert before running nix-channel
Also, make it more robust against incorrent SSL_CERT_FILE values.
2014-12-13 16:53:21 +01:00