wroclaw-git-backups/nix
1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-06-28 09:31:16 +02:00
Code Activity

Shift Darwin sandbox to separate installed files

Browse source 
This makes it slightly more manageable to see at a glance what in a
build's sandbox profile is unique to the build and what is standard. Also
a first step to factoring more of our Darwin logic into scheme functions
that will allow us a bit more flexibility. And of course less of that
nasty codegen in C++! 😀
This commit is contained in:
Dan Peebles 2017-10-17 19:15:51 -04:00
parent 1dd29d7aeb
commit 6e5165b773
2 changed files with 11 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/libstore/build.cc
View file

@ -2774,14 +2774,10 @@ void DerivationGoal::runChild()
sandboxProfile += "(deny default (with no-log))\n";
}
sandboxProfile +=
#include "sandbox-defaults.sb.gen.hh"
;
sandboxProfile += "(import \"sandbox-defaults.sb\")";
if (fixedOutput)
sandboxProfile +=
#include "sandbox-network.sb.gen.hh"
;
sandboxProfile += "(import \"sandbox-network.sb\")";
/* Our rwx outputs */
sandboxProfile += "(allow file-read* file-write* process-exec\n";
@ -2824,9 +2820,7 @@ void DerivationGoal::runChild()
sandboxProfile += additionalSandboxProfile;
} else
sandboxProfile +=
#include "sandbox-minimal.sb.gen.hh"
;
sandboxProfile += "(import \"sandbox-minimal.sb\")";
debug("Generated sandbox profile:");
debug(sandboxProfile);
@ -2848,6 +2842,8 @@ void DerivationGoal::runChild()
args.push_back(sandboxFile);
args.push_back("-D");
args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir);
args.push_back("-D");
args.push_back("IMPORT_DIR=" + settings.nixDataDir + "/nix/sandbox/");
args.push_back(drv->builder);
}
#endif