forked from lix-project/lix
ba50c3efa3
"uid-range" provides 65536 UIDs to a build and runs the build as root in its user namespace. "systemd-cgroup" allows the build to mount the systemd cgroup controller (needed for running systemd-nspawn and NixOS containers). Also, add a configuration option "auto-allocate-uids" which is needed to enable these features, and some experimental feature gates. So to enable support for containers you need the following in nix.conf: experimental-features = auto-allocate-uids systemd-cgroup auto-allocate-uids = true system-features = uid-range systemd-cgroup
40 lines
777 B
C++
40 lines
777 B
C++
#pragma once
|
|
|
|
#include "types.hh"
|
|
|
|
namespace nix {
|
|
|
|
struct UserLock
|
|
{
|
|
virtual ~UserLock() { }
|
|
|
|
/* Get the first and last UID. */
|
|
virtual std::pair<uid_t, uid_t> getUIDRange() = 0;
|
|
|
|
/* Get the first UID. */
|
|
uid_t getUID()
|
|
{
|
|
return getUIDRange().first;
|
|
}
|
|
|
|
uid_t getUIDCount()
|
|
{
|
|
return getUIDRange().second - getUIDRange().first + 1;
|
|
}
|
|
|
|
virtual gid_t getGID() = 0;
|
|
|
|
virtual std::vector<gid_t> getSupplementaryGIDs() = 0;
|
|
|
|
/* Kill any processes currently executing as this user. */
|
|
virtual void kill() = 0;
|
|
|
|
virtual std::optional<Path> getCgroup() { return {}; };
|
|
};
|
|
|
|
/* Acquire a user lock. Note that this may return nullptr if no user
|
|
is available. */
|
|
std::unique_ptr<UserLock> acquireUserLock();
|
|
|
|
}
|