wroclaw-git-backups/nix
1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-07-07 10:11:47 +02:00
Code Activity

Add restricted evaluation mode

Browse source 
If ‘--option restrict-eval true’ is given, the evaluator will throw an
exception if an attempt is made to access any file outside of the Nix
search path. This is primarily intended for Hydra, where we don't want
people doing ‘builtins.readFile ~/.ssh/id_dsa’ or stuff like that.
This commit is contained in:
Eelco Dolstra 2015-02-23 14:41:53 +01:00
parent 47bdc52c1b
commit 15d2d3c34e
6 changed files with 65 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

15
doc/manual/command-ref/conf-file.xml
View file

@ -539,6 +539,21 @@ flag, e.g. <literal>--option gc-keep-outputs false</literal>.</para>
</varlistentry>
<varlistentry xml:id="conf-restrict-eval"><term><literal>restrict-eval</literal></term>
<listitem>
<para>If set to <literal>true</literal>, the Nix evaluator will
not allow access to any files outside of the Nix search path (as
set via the <envar>NIX_PATH</envar> environment variable or the
<option>-I</option> option). The default is
<literal>false</literal>.</para>
</listitem>
</varlistentry>
</variablelist>
</para>