the-distro/ofborg
2
0
Fork 1
Code Issues 1 Pull requests 1 Packages Projects Releases Wiki Activity

Merge pull request #189 from LnL7/nixpkgs-restricted-mode

Browse source 
eval-checker: use explicit 'nixpkgs' argument for release.nix expressions
This commit is contained in:
Graham Christensen 2018-11-21 19:21:25 -05:00 committed by GitHub
parent 7d368c2baf b8975bca4e
commit da43bc05b7
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 53 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
ofborg/src/nix.rs
View file

@ -675,7 +675,7 @@ mod tests {
}
#[test]
fn instantiation() {
fn instantiation_success() {
let ret: Result<File, File> = nix().safely(
Operation::Instantiate,
passing_eval_path().as_path(),
@ -693,4 +693,23 @@ mod tests {
],
);
}
#[test]
fn instantiation_nixpkgs_restricted_mode() {
let ret: Result<File, File> = nix().safely(
Operation::Instantiate,
individual_eval_path().as_path(),
vec![String::from("-A"), String::from("nixpkgs-restricted-mode")],
true,
);
assert_run(
ret,
Expect::Fail,
vec![
"access to path '/fake'",
"is forbidden in restricted mode",
],
);
}
}

15
ofborg/src/tasks/massrebuilder.rs
View file

@ -348,6 +348,9 @@ impl<E: stats::SysEvents + 'static> worker::SimpleWorker for MassRebuildWorker<E
"nixos-options",
nix::Operation::Instantiate,
vec![
String::from("--arg"),
String::from("nixpkgs"),
String::from("./."),
String::from("./nixos/release.nix"),
String::from("-A"),
String::from("options"),
@ -359,6 +362,9 @@ impl<E: stats::SysEvents + 'static> worker::SimpleWorker for MassRebuildWorker<E
"nixos-manual",
nix::Operation::Instantiate,
vec![
String::from("--arg"),
String::from("nixpkgs"),
String::from("./."),
String::from("./nixos/release.nix"),
String::from("-A"),
String::from("manual"),
@ -370,6 +376,9 @@ impl<E: stats::SysEvents + 'static> worker::SimpleWorker for MassRebuildWorker<E
"nixpkgs-manual",
nix::Operation::Instantiate,
vec![
String::from("--arg"),
String::from("nixpkgs"),
String::from("./."),
String::from("./pkgs/top-level/release.nix"),
String::from("-A"),
String::from("manual"),
@ -381,6 +390,9 @@ impl<E: stats::SysEvents + 'static> worker::SimpleWorker for MassRebuildWorker<E
"nixpkgs-tarball",
nix::Operation::Instantiate,
vec![
String::from("--arg"),
String::from("nixpkgs"),
String::from("./."),
String::from("./pkgs/top-level/release.nix"),
String::from("-A"),
String::from("tarball"),
@ -392,6 +404,9 @@ impl<E: stats::SysEvents + 'static> worker::SimpleWorker for MassRebuildWorker<E
"nixpkgs-unstable-jobset",
nix::Operation::Instantiate,
vec![
String::from("--arg"),
String::from("nixpkgs"),
String::from("./."),
String::from("./pkgs/top-level/release.nix"),
String::from("-A"),
String::from("unstable"),

19
ofborg/test-srcs/eval-mixed-failure/default.nix
View file

@ -1,6 +1,14 @@
let
fetchGit = builtins.fetchGit or (path: assert builtins.trace ''
error: access to path '/fake' is forbidden in restricted mode
'' false; path);
nix = import <nix/config.nix>;
in rec {
in
{ nixpkgs ? fetchGit /fake }:
rec {
success = derivation {
name = "success";
system = builtins.currentSystem;
@ -28,6 +36,15 @@ in rec {
"echo this ones cool" ];
};
nixpkgs-restricted-mode = derivation {
name = "nixpkgs-restricted-mode-fetchgit";
system = builtins.currentSystem;
builder = nix.shell;
args = [
"-c"
"echo hi; echo ${toString nixpkgs} > $out" ];
};
fails-instantiation = assert builtins.trace ''
You just can't frooble the frozz on this particular system.
'' false; {};