Skip to content

Commit

Permalink
Merge pull request #11044 from NixOS/backport-11031-to-2.22-maintenance
Browse files Browse the repository at this point in the history
[Backport 2.22-maintenance] libstore: fix sandboxed builds on macOS
  • Loading branch information
edolstra authored Jul 5, 2024
2 parents 5911f66 + a500c90 commit fcaa72b
Show file tree
Hide file tree
Showing 2 changed files with 23 additions and 6 deletions.
21 changes: 16 additions & 5 deletions src/libstore/unix/build/local-derivation-goal.cc
Original file line number Diff line number Diff line change
Expand Up @@ -501,13 +501,23 @@ void LocalDerivationGoal::startBuilder()

/* Create a temporary directory where the build will take
place. */
tmpDir = createTempDir(settings.buildDir.get().value_or(""), "nix-build-" + std::string(drvPath.name()), false, false, 0700);
topTmpDir = createTempDir(settings.buildDir.get().value_or(""), "nix-build-" + std::string(drvPath.name()), false, false, 0700);
#if __APPLE__
if (false) {
#else
if (useChroot) {
#endif
/* If sandboxing is enabled, put the actual TMPDIR underneath
an inaccessible root-owned directory, to prevent outside
access. */
tmpDir = tmpDir + "/build";
access.
On macOS, we don't use an actual chroot, so this isn't
possible. Any mitigation along these lines would have to be
done directly in the sandbox profile. */
tmpDir = topTmpDir + "/build";
createDir(tmpDir, 0700);
} else {
tmpDir = topTmpDir;
}
chownToBuilder(tmpDir);

Expand Down Expand Up @@ -2961,15 +2971,16 @@ void LocalDerivationGoal::checkOutputs(const std::map<std::string, ValidPathInfo

void LocalDerivationGoal::deleteTmpDir(bool force)
{
if (tmpDir != "") {
if (topTmpDir != "") {
/* Don't keep temporary directories for builtins because they
might have privileged stuff (like a copy of netrc). */
if (settings.keepFailed && !force && !drv->isBuiltin()) {
printError("note: keeping build directory '%s'", tmpDir);
chmod(tmpDir.c_str(), 0755);
}
else
deletePath(tmpDir);
deletePath(topTmpDir);
topTmpDir = "";
tmpDir = "";
}
}
Expand Down
8 changes: 7 additions & 1 deletion src/libstore/unix/build/local-derivation-goal.hh
Original file line number Diff line number Diff line change
Expand Up @@ -27,10 +27,16 @@ struct LocalDerivationGoal : public DerivationGoal
std::optional<Path> cgroup;

/**
* The temporary directory.
* The temporary directory used for the build.
*/
Path tmpDir;

/**
* The top-level temporary directory. `tmpDir` is either equal to
* or a child of this directory.
*/
Path topTmpDir;

/**
* The path of the temporary directory in the sandbox.
*/
Expand Down

0 comments on commit fcaa72b

Please sign in to comment.