2024-05-28 16:43:04 +00:00
|
|
|
#!/usr/bin/env bash
|
|
|
|
|
2016-04-14 13:24:06 +00:00
|
|
|
source common.sh
|
|
|
|
|
2024-06-16 15:56:50 +00:00
|
|
|
clearStoreIfPossible
|
2016-04-14 13:24:06 +00:00
|
|
|
|
2017-11-20 16:50:49 +00:00
|
|
|
nix-instantiate --restrict-eval --eval -E '1 + 2'
|
2022-12-07 11:58:58 +00:00
|
|
|
(! nix-instantiate --eval --restrict-eval ./restricted.nix)
|
2018-01-16 17:50:38 +00:00
|
|
|
(! nix-instantiate --eval --restrict-eval <(echo '1 + 2'))
|
2024-11-01 13:56:50 +00:00
|
|
|
|
|
|
|
mkdir -p "$TEST_ROOT/nix"
|
|
|
|
cp ./simple.nix "$TEST_ROOT/nix"
|
|
|
|
cp ./simple.builder.sh "$TEST_ROOT/nix"
|
|
|
|
cp "${config_nix}" "$TEST_ROOT/nix"
|
|
|
|
cd "$TEST_ROOT/nix"
|
|
|
|
|
2017-11-20 16:50:49 +00:00
|
|
|
nix-instantiate --restrict-eval ./simple.nix -I src=.
|
2024-11-01 13:56:50 +00:00
|
|
|
nix-instantiate --restrict-eval ./simple.nix -I src1=./simple.nix -I src2=./config.nix -I src3=./simple.builder.sh
|
2016-04-14 13:24:06 +00:00
|
|
|
|
2024-07-24 21:17:15 +00:00
|
|
|
# no default NIX_PATH
|
|
|
|
(unset NIX_PATH; ! nix-instantiate --restrict-eval --find-file .)
|
|
|
|
|
2017-11-20 16:50:49 +00:00
|
|
|
(! nix-instantiate --restrict-eval --eval -E 'builtins.readFile ./simple.nix')
|
2023-10-05 16:12:18 +00:00
|
|
|
nix-instantiate --restrict-eval --eval -E 'builtins.readFile ./simple.nix' -I src=../..
|
2016-04-14 13:24:06 +00:00
|
|
|
|
2023-12-06 13:05:32 +00:00
|
|
|
expectStderr 1 nix-instantiate --restrict-eval --eval -E 'let __nixPath = [ { prefix = "foo"; path = ./.; } ]; in builtins.readFile <foo/simple.nix>' | grepQuiet "forbidden in restricted mode"
|
2023-11-30 15:16:17 +00:00
|
|
|
nix-instantiate --restrict-eval --eval -E 'let __nixPath = [ { prefix = "foo"; path = ./.; } ]; in builtins.readFile <foo/simple.nix>' -I src=.
|
2016-04-14 13:24:06 +00:00
|
|
|
|
2024-11-01 13:56:50 +00:00
|
|
|
p=$(nix eval --raw --expr "builtins.fetchurl file://${_NIX_TEST_SOURCE_DIR}/restricted.sh" --impure --restrict-eval --allowed-uris "file://${_NIX_TEST_SOURCE_DIR}")
|
|
|
|
cmp "$p" "${_NIX_TEST_SOURCE_DIR}/restricted.sh"
|
2017-10-30 11:39:59 +00:00
|
|
|
|
2024-11-01 13:56:50 +00:00
|
|
|
(! nix eval --raw --expr "builtins.fetchurl file://${_NIX_TEST_SOURCE_DIR}/restricted.sh" --impure --restrict-eval)
|
2017-10-30 11:39:59 +00:00
|
|
|
|
2024-11-01 13:56:50 +00:00
|
|
|
(! nix eval --raw --expr "builtins.fetchurl file://${_NIX_TEST_SOURCE_DIR}/restricted.sh" --impure --restrict-eval --allowed-uris "file://${_NIX_TEST_SOURCE_DIR}/restricted.sh/")
|
2017-10-30 11:39:59 +00:00
|
|
|
|
2024-11-01 13:56:50 +00:00
|
|
|
nix eval --raw --expr "builtins.fetchurl file://${_NIX_TEST_SOURCE_DIR}/restricted.sh" --impure --restrict-eval --allowed-uris "file://${_NIX_TEST_SOURCE_DIR}/restricted.sh"
|
2017-10-30 11:39:59 +00:00
|
|
|
|
2019-11-26 23:05:30 +00:00
|
|
|
(! nix eval --raw --expr "builtins.fetchurl https://github.com/NixOS/patchelf/archive/master.tar.gz" --impure --restrict-eval)
|
|
|
|
(! nix eval --raw --expr "builtins.fetchTarball https://github.com/NixOS/patchelf/archive/master.tar.gz" --impure --restrict-eval)
|
|
|
|
(! nix eval --raw --expr "fetchGit git://github.com/NixOS/patchelf.git" --impure --restrict-eval)
|
2018-01-16 17:50:38 +00:00
|
|
|
|
2024-11-01 13:56:50 +00:00
|
|
|
ln -sfn "${_NIX_TEST_SOURCE_DIR}/restricted.nix" "$TEST_ROOT/restricted.nix"
|
2018-01-16 17:50:38 +00:00
|
|
|
[[ $(nix-instantiate --eval $TEST_ROOT/restricted.nix) == 3 ]]
|
|
|
|
(! nix-instantiate --eval --restrict-eval $TEST_ROOT/restricted.nix)
|
|
|
|
(! nix-instantiate --eval --restrict-eval $TEST_ROOT/restricted.nix -I $TEST_ROOT)
|
|
|
|
(! nix-instantiate --eval --restrict-eval $TEST_ROOT/restricted.nix -I .)
|
2024-11-01 13:56:50 +00:00
|
|
|
nix-instantiate --eval --restrict-eval "$TEST_ROOT/restricted.nix" -I "$TEST_ROOT" -I "${_NIX_TEST_SOURCE_DIR}"
|
2018-02-06 14:38:45 +00:00
|
|
|
|
2019-11-26 23:05:30 +00:00
|
|
|
[[ $(nix eval --raw --impure --restrict-eval -I . --expr 'builtins.readFile "${import ./simple.nix}/hello"') == 'Hello World!' ]]
|
2018-08-03 04:24:57 +00:00
|
|
|
|
2023-12-05 14:14:28 +00:00
|
|
|
# Check that we can't follow a symlink outside of the allowed paths.
|
2023-12-05 22:02:59 +00:00
|
|
|
mkdir -p $TEST_ROOT/tunnel.d $TEST_ROOT/foo2
|
2023-12-05 14:14:28 +00:00
|
|
|
ln -sfn .. $TEST_ROOT/tunnel.d/tunnel
|
|
|
|
echo foo > $TEST_ROOT/bar
|
|
|
|
|
|
|
|
expectStderr 1 nix-instantiate --restrict-eval --eval -E "let __nixPath = [ { prefix = \"foo\"; path = $TEST_ROOT/tunnel.d; } ]; in builtins.readFile <foo/tunnel/bar>" -I $TEST_ROOT/tunnel.d | grepQuiet "forbidden in restricted mode"
|
|
|
|
|
2023-12-05 22:02:59 +00:00
|
|
|
expectStderr 1 nix-instantiate --restrict-eval --eval -E "let __nixPath = [ { prefix = \"foo\"; path = $TEST_ROOT/tunnel.d; } ]; in builtins.readDir <foo/tunnel/foo2>" -I $TEST_ROOT/tunnel.d | grepQuiet "forbidden in restricted mode"
|
|
|
|
|
|
|
|
# Reading the parents of allowed paths should show only the ancestors of the allowed paths.
|
|
|
|
[[ $(nix-instantiate --restrict-eval --eval -E "let __nixPath = [ { prefix = \"foo\"; path = $TEST_ROOT/tunnel.d; } ]; in builtins.readDir <foo/tunnel>" -I $TEST_ROOT/tunnel.d) == '{ "tunnel.d" = "directory"; }' ]]
|
2023-12-05 14:14:28 +00:00
|
|
|
|
2018-08-03 04:24:57 +00:00
|
|
|
# Check whether we can leak symlink information through directory traversal.
|
2024-11-01 13:56:50 +00:00
|
|
|
traverseDir="${_NIX_TEST_SOURCE_DIR}/restricted-traverse-me"
|
|
|
|
ln -sfn "${_NIX_TEST_SOURCE_DIR}/restricted-secret" "${_NIX_TEST_SOURCE_DIR}/restricted-innocent"
|
2018-08-03 04:24:57 +00:00
|
|
|
mkdir -p "$traverseDir"
|
|
|
|
goUp="..$(echo "$traverseDir" | sed -e 's,[^/]\+,..,g')"
|
|
|
|
output="$(nix eval --raw --restrict-eval -I "$traverseDir" \
|
2024-11-01 13:56:50 +00:00
|
|
|
--expr "builtins.readFile \"$traverseDir/$goUp${_NIX_TEST_SOURCE_DIR}/restricted-innocent\"" \
|
2018-08-03 04:24:57 +00:00
|
|
|
2>&1 || :)"
|
|
|
|
echo "$output" | grep "is forbidden"
|
2021-12-09 15:26:46 +00:00
|
|
|
echo "$output" | grepInverse -F restricted-secret
|
2015-09-04 20:23:08 +00:00
|
|
|
|
|
|
|
expectStderr 1 nix-instantiate --restrict-eval true ./dependencies.nix | grepQuiet "forbidden in restricted mode"
|