Fix path access control

src/libexpr/eval.cc

@@ -450,7 +450,10 @@ EvalState::EvalState(
     , sPrefix(symbols.create("prefix"))
     , repair(NoRepair)
     , emptyBindings(0)
-    , rootFS(makeFSInputAccessor(""))
+    , rootFS(makeFSInputAccessor("",
+            evalSettings.restrictEval || evalSettings.pureEval
+            ? std::optional<PathSet>(PathSet())
+            : std::nullopt))
     , corepkgsFS(makeMemoryInputAccessor())
     , store(store)
     , buildStore(buildStore ? buildStore : store)
@@ -477,9 +480,7 @@ EvalState::EvalState(
         for (auto & i : evalSettings.nixPath.get()) addToSearchPath(i);
     }
 
-    if (evalSettings.restrictEval || evalSettings.pureEval) {
-        allowedPaths = PathSet();
-
+    if (rootFS->hasAccessControl()) {
         for (auto & i : searchPath) {
             auto r = resolveSearchPathElem(i);
             if (!r.first) continue;
@@ -516,14 +517,12 @@ EvalState::~EvalState()
 
 void EvalState::allowPath(const Path & path)
 {
-    if (allowedPaths)
-        allowedPaths->insert(path);
+    rootFS->allowPath(path);
 }
 
 void EvalState::allowPath(const StorePath & storePath)
 {
-    if (allowedPaths)
-        allowedPaths->insert(store->toRealPath(storePath));
+    rootFS->allowPath(store->toRealPath(storePath));
 }
 
 void EvalState::allowAndSetStorePathString(const StorePath &storePath, Value & v)
@@ -602,14 +601,12 @@ void EvalState::checkURI(const std::string & uri)
     /* If the URI is a path, then check it against allowedPaths as
        well. */
     if (hasPrefix(uri, "/")) {
-        // FIXME: use rootPath
-        //checkSourcePath(uri);
+        rootFS->checkAllowed(uri);
         return;
     }
 
     if (hasPrefix(uri, "file://")) {
-        // FIXME: use rootPath
-        //checkSourcePath(std::string(uri, 7));
+        rootFS->checkAllowed(uri.substr(7));
         return;
     }
 

src/libexpr/eval.hh

@@ -91,13 +91,9 @@ public:
        already exist there. */
     RepairFlag repair;
 
-    /* The allowed filesystem paths in restricted or pure evaluation
-       mode. */
-    std::optional<PathSet> allowedPaths;
-
     Bindings emptyBindings;
 
-    ref<InputAccessor> rootFS;
+    ref<FSInputAccessor> rootFS;
     ref<MemoryInputAccessor> corepkgsFS;
 
     std::unordered_map<size_t, ref<InputAccessor>> inputAccessors;

src/libexpr/primops.cc

@@ -82,7 +82,7 @@ StringMap EvalState::realiseContext(const PathSet & context)
 
     /* Add the output of this derivations to the allowed
        paths. */
-    if (allowedPaths) {
+    if (rootFS->hasAccessControl()) {
         for (auto & [_placeholder, outputPath] : res) {
             allowPath(store->toRealPath(outputPath));
         }
@@ -91,6 +91,7 @@ StringMap EvalState::realiseContext(const PathSet & context)
     return res;
 }
 
+// FIXME: remove?
 struct RealisePathFlags {
     // Whether to check that the path is allowed in pure eval mode
     bool checkForPureEval = true;
@@ -110,22 +111,19 @@ static SourcePath realisePath(EvalState & state, const Pos & pos, Value & v, con
         }
     }();
 
-    return path;
-
-    #if 0
     try {
-        StringMap rewrites = state.realiseContext(context);
-
-        auto realPath = state.toRealPath(rewriteStrings(path, rewrites), context);
-
-        return flags.checkForPureEval
-            ? state.checkSourcePath(realPath)
-            : realPath;
+        if (!context.empty()) {
+            auto rewrites = state.realiseContext(context);
+            // FIXME: check that path.accessor == rootFS?
+            auto realPath = state.toRealPath(rewriteStrings(path.path, rewrites), context);
+            // FIXME: return store accessor
+            return state.rootPath(realPath);
+        } else
+            return path;
     } catch (Error & e) {
         e.addTrace(pos, "while realising the context of path '%s'", path);
         throw;
     }
-    #endif
 }
 
 /* Add and attribute to the given attribute map from the output name to