24542a7b96
If you have the Nix store mounted from a nonlocal filesystem whose
exporter is not running as root, making the directory mode 000 makes it
inaccessible to that remote unprivileged user and therefore breaks the
build. (Specifically, I am running into this with a virtiofs mount using
Apple Virtualization.framework as a non-root user, but I expect the
same thing would happen with virtiofs in qemu on Linux as a non-root
user or with various userspace network file servers.)
Make the directory mode 500 (dr-x------) to make the sandbox work in
this use case, which explicitly conveys our intention to read and search
the directory. The code only works because root can already bypass
directory checks, so this does not actually grant more permissions to
the directory owner / does not make the sandbox less secure.
(cherry picked from commit
|
||
|---|---|---|
| .github | ||
| build-utils-meson | ||
| config | ||
| contrib | ||
| doc/manual | ||
| m4 | ||
| maintainers | ||
| misc | ||
| mk | ||
| packaging | ||
| scripts | ||
| src | ||
| tests | ||
| .clang-format | ||
| .clang-tidy | ||
| .dir-locals.el | ||
| .editorconfig | ||
| .gitignore | ||
| .mergify.yml | ||
| .shellcheckrc | ||
| .version | ||
| CITATION.cff | ||
| configure.ac | ||
| CONTRIBUTING.md | ||
| COPYING | ||
| default.nix | ||
| docker.nix | ||
| flake.lock | ||
| flake.nix | ||
| local.mk | ||
| Makefile | ||
| Makefile.config.in | ||
| meson.build | ||
| package.nix | ||
| precompiled-headers.h | ||
| README.md | ||
| shell.nix | ||
Nix
Nix is a powerful package manager for Linux and other Unix systems that makes package management reliable and reproducible. Please refer to the Nix manual for more details.
Installation and first steps
Visit nix.dev for installation instructions and beginner tutorials.
Full reference documentation can be found in the Nix manual.
Building and developing
Follow instructions in the Nix reference manual to set up a development environment and build Nix from source.
Contributing
Check the contributing guide if you want to get involved with developing Nix.
Additional resources
Nix was created by Eelco Dolstra and developed as the subject of his PhD thesis The Purely Functional Software Deployment Model, published 2006. Today, a world-wide developer community contributes to Nix and the ecosystem that has grown around it.
- The Nix, Nixpkgs, NixOS Community on nixos.org
- Official documentation on nix.dev
- Nixpkgs is the largest, most up-to-date free software repository in the world
- NixOS is a Linux distribution that can be configured fully declaratively
- Discourse
- Matrix
License
Nix is released under the LGPL v2.1.