mirror of
https://github.com/NixOS/nix
synced 2025-07-07 22:33:57 +02:00
Restore 'forbidden in restricted mode' errors
This commit is contained in:
parent
1564c8f9d9
commit
4e0346dcc1
2 changed files with 13 additions and 3 deletions
|
@ -3073,6 +3073,11 @@ SourcePath EvalState::findFile(const LookupPath & lookupPath, const std::string_
|
||||||
|
|
||||||
auto res = (r / CanonPath(suffix)).resolveSymlinks();
|
auto res = (r / CanonPath(suffix)).resolveSymlinks();
|
||||||
if (res.pathExists()) return res;
|
if (res.pathExists()) return res;
|
||||||
|
|
||||||
|
// Backward compatibility hack: throw an exception if access
|
||||||
|
// to this path is not allowed.
|
||||||
|
if (auto accessor = res.accessor.dynamic_pointer_cast<FilteringSourceAccessor>())
|
||||||
|
accessor->checkAccess(res.path);
|
||||||
}
|
}
|
||||||
|
|
||||||
if (hasPrefix(path, "nix/"))
|
if (hasPrefix(path, "nix/"))
|
||||||
|
@ -3143,6 +3148,11 @@ std::optional<SourcePath> EvalState::resolveLookupPathPath(const LookupPath::Pat
|
||||||
if (path.resolveSymlinks().pathExists())
|
if (path.resolveSymlinks().pathExists())
|
||||||
return finish(std::move(path));
|
return finish(std::move(path));
|
||||||
else {
|
else {
|
||||||
|
// Backward compatibility hack: throw an exception if access
|
||||||
|
// to this path is not allowed.
|
||||||
|
if (auto accessor = path.accessor.dynamic_pointer_cast<FilteringSourceAccessor>())
|
||||||
|
accessor->checkAccess(path.path);
|
||||||
|
|
||||||
logWarning({
|
logWarning({
|
||||||
.msg = HintFmt("Nix search path entry '%1%' does not exist, ignoring", value)
|
.msg = HintFmt("Nix search path entry '%1%' does not exist, ignoring", value)
|
||||||
});
|
});
|
||||||
|
|
|
@ -23,7 +23,7 @@ nix-instantiate --restrict-eval ./simple.nix -I src1=./simple.nix -I src2=./conf
|
||||||
(! nix-instantiate --restrict-eval --eval -E 'builtins.readFile ./simple.nix')
|
(! nix-instantiate --restrict-eval --eval -E 'builtins.readFile ./simple.nix')
|
||||||
nix-instantiate --restrict-eval --eval -E 'builtins.readFile ./simple.nix' -I src=../..
|
nix-instantiate --restrict-eval --eval -E 'builtins.readFile ./simple.nix' -I src=../..
|
||||||
|
|
||||||
expectStderr 1 nix-instantiate --restrict-eval --eval -E 'let __nixPath = [ { prefix = "foo"; path = ./.; } ]; in builtins.readFile <foo/simple.nix>' #| grepQuiet "forbidden in restricted mode"
|
expectStderr 1 nix-instantiate --restrict-eval --eval -E 'let __nixPath = [ { prefix = "foo"; path = ./.; } ]; in builtins.readFile <foo/simple.nix>' | grepQuiet "forbidden in restricted mode"
|
||||||
nix-instantiate --restrict-eval --eval -E 'let __nixPath = [ { prefix = "foo"; path = ./.; } ]; in builtins.readFile <foo/simple.nix>' -I src=.
|
nix-instantiate --restrict-eval --eval -E 'let __nixPath = [ { prefix = "foo"; path = ./.; } ]; in builtins.readFile <foo/simple.nix>' -I src=.
|
||||||
|
|
||||||
p=$(nix eval --raw --expr "builtins.fetchurl file://${_NIX_TEST_SOURCE_DIR}/restricted.sh" --impure --restrict-eval --allowed-uris "file://${_NIX_TEST_SOURCE_DIR}")
|
p=$(nix eval --raw --expr "builtins.fetchurl file://${_NIX_TEST_SOURCE_DIR}/restricted.sh" --impure --restrict-eval --allowed-uris "file://${_NIX_TEST_SOURCE_DIR}")
|
||||||
|
@ -53,9 +53,9 @@ mkdir -p $TEST_ROOT/tunnel.d $TEST_ROOT/foo2
|
||||||
ln -sfn .. $TEST_ROOT/tunnel.d/tunnel
|
ln -sfn .. $TEST_ROOT/tunnel.d/tunnel
|
||||||
echo foo > $TEST_ROOT/bar
|
echo foo > $TEST_ROOT/bar
|
||||||
|
|
||||||
expectStderr 1 nix-instantiate --restrict-eval --eval -E "let __nixPath = [ { prefix = \"foo\"; path = $TEST_ROOT/tunnel.d; } ]; in builtins.readFile <foo/tunnel/bar>" -I $TEST_ROOT/tunnel.d #| grepQuiet "forbidden in restricted mode"
|
expectStderr 1 nix-instantiate --restrict-eval --eval -E "let __nixPath = [ { prefix = \"foo\"; path = $TEST_ROOT/tunnel.d; } ]; in builtins.readFile <foo/tunnel/bar>" -I $TEST_ROOT/tunnel.d | grepQuiet "forbidden in restricted mode"
|
||||||
|
|
||||||
expectStderr 1 nix-instantiate --restrict-eval --eval -E "let __nixPath = [ { prefix = \"foo\"; path = $TEST_ROOT/tunnel.d; } ]; in builtins.readDir <foo/tunnel/foo2>" -I $TEST_ROOT/tunnel.d #| grepQuiet "forbidden in restricted mode"
|
expectStderr 1 nix-instantiate --restrict-eval --eval -E "let __nixPath = [ { prefix = \"foo\"; path = $TEST_ROOT/tunnel.d; } ]; in builtins.readDir <foo/tunnel/foo2>" -I $TEST_ROOT/tunnel.d | grepQuiet "forbidden in restricted mode"
|
||||||
|
|
||||||
# Reading the parents of allowed paths should show only the ancestors of the allowed paths.
|
# Reading the parents of allowed paths should show only the ancestors of the allowed paths.
|
||||||
[[ $(nix-instantiate --restrict-eval --eval -E "let __nixPath = [ { prefix = \"foo\"; path = $TEST_ROOT/tunnel.d; } ]; in builtins.readDir <foo/tunnel>" -I $TEST_ROOT/tunnel.d) == '{ "tunnel.d" = "directory"; }' ]]
|
[[ $(nix-instantiate --restrict-eval --eval -E "let __nixPath = [ { prefix = \"foo\"; path = $TEST_ROOT/tunnel.d; } ]; in builtins.readDir <foo/tunnel>" -I $TEST_ROOT/tunnel.d) == '{ "tunnel.d" = "directory"; }' ]]
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue