In pure eval mode, restrict rootFS to just the Nix store

Note that in pure mode, we don't need to use the union FS even when
using a chroot store, since the user shouldn't have access to the
physical /nix/store.

src/libexpr/eval.cc

@@ -247,22 +247,27 @@ EvalState::EvalState(
     , emptyBindings(0)
     , rootFS(
         ({
+            /* In pure eval mode, we provide a filesystem that only
+               contains the Nix store.
+
+               If we have a chroot store and pure eval is not enabled,
+               use a union accessor to make the chroot store available
+               at its logical location while still having the
+               underlying directory available. This is necessary for
+               instance if we're evaluating a file from the physical
+               /nix/store while using a chroot store. */
             auto accessor = getFSSourceAccessor();
 
-            /* If we have a chroot store, make a union accessor to
-               make the chroot store available at its logical location
-               while still having the underlying directory
-               available. This is necessary for instance if we're
-               evaluating a file from the physical /nix/store while
-               using a chroot store. */
             auto realStoreDir = dirOf(store->toRealPath(StorePath::dummy));
-            if (store->storeDir != realStoreDir) {
+            if (settings.pureEval || store->storeDir != realStoreDir) {
                 auto storeFS = makeMountedSourceAccessor(
                     {
                         {CanonPath::root, makeEmptySourceAccessor()},
                         {CanonPath(store->storeDir), makeFSSourceAccessor(realStoreDir)}
                     });
-                accessor = makeUnionSourceAccessor({accessor, storeFS});
+                accessor = settings.pureEval
+                    ? storeFS
+                    : makeUnionSourceAccessor({accessor, storeFS});
             }
 
             /* Apply access control if needed. */

src/libutil/mounted-source-accessor.cc

@@ -63,6 +63,12 @@ struct MountedSourceAccessor : SourceAccessor
             path.pop();
         }
     }
+
+    std::optional<std::filesystem::path> getPhysicalPath(const CanonPath & path) override
+    {
+        auto [accessor, subpath] = resolve(path);
+        return accessor->getPhysicalPath(subpath);
+    }
 };
 
 ref<SourceAccessor> makeMountedSourceAccessor(std::map<CanonPath, ref<SourceAccessor>> mounts)