wroclaw-git-backups/nix
1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-07-07 22:33:57 +02:00
Code Activity

Make /etc writability conditional on uid-range feature

Browse source 
(cherry picked from commit 49fd72a903)
This commit is contained in:
Yorick van Pelt 2023-02-14 13:29:30 +01:00 • committed by github-actions[bot]
parent 459832e5c2
commit bca7075edc
2 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/libstore/build/local-derivation-goal.cc
View file

@ -663,6 +663,8 @@ void LocalDerivationGoal::startBuilder()
nobody account. The latter is kind of a hack to support nobody account. The latter is kind of a hack to support
Samba-in-QEMU. */ Samba-in-QEMU. */
createDirs(chrootRootDir + "/etc"); createDirs(chrootRootDir + "/etc");
if (parsedDrv->useUidRange())
chownToBuilder(chrootRootDir + "/etc");
if (parsedDrv->useUidRange() && (!buildUser || buildUser->getUIDCount() < 65536)) if (parsedDrv->useUidRange() && (!buildUser || buildUser->getUIDCount() < 65536))
throw Error("feature 'uid-range' requires the setting '%s' to be enabled", settings.autoAllocateUids.name); throw Error("feature 'uid-range' requires the setting '%s' to be enabled", settings.autoAllocateUids.name);
@ -1023,7 +1025,8 @@ void LocalDerivationGoal::startBuilder()
sandboxUid(), sandboxGid(), settings.sandboxBuildDir)); sandboxUid(), sandboxGid(), settings.sandboxBuildDir));
/* Make /etc unwritable */ /* Make /etc unwritable */
chmod_(chrootRootDir + "/etc", 0555); if (!parsedDrv->useUidRange())
chmod_(chrootRootDir + "/etc", 0555);
/* Save the mount- and user namespace of the child. We have to do this /* Save the mount- and user namespace of the child. We have to do this
*before* the child does a chroot. */ *before* the child does a chroot. */

1
tests/systemd-nspawn.nix
View file

@ -56,7 +56,6 @@ runCommand "test"
# Make /run a tmpfs to shut up a systemd warning. # Make /run a tmpfs to shut up a systemd warning.
mkdir /run mkdir /run
mount -t tmpfs none /run mount -t tmpfs none /run
chmod 0700 /run
mount -t cgroup2 none /sys/fs/cgroup mount -t cgroup2 none /sys/fs/cgroup