Nix, the purely functional package manager
Go to file
Eelco Dolstra 8b11eb672a Put the chroot inside a directory that isn't group/world-accessible
Previously, the .chroot directory had permission 750 or 755 (depending
on the uid-range system feature) and was owned by root/nixbld. This
makes it possible for any nixbld user (if uid-range is disabled) or
any user (if uid-range is enabled) to inspect the contents of the
chroot of an active build and maybe interfere with it (e.g. via /tmp
in the chroot, which has 1777 permission).

To prevent this, the root is now a subdirectory of .chroot, which has
permission 700 and is owned by root/root.

(cherry picked from commit af280e72fa0e62e1c2eaccfb992c0dbb6f27f895)
2024-06-21 16:40:03 +02:00
.github build(deps): bump zeebe-io/backport-action from 2.1.0 to 2.1.1 2023-11-13 22:01:50 +00:00
config Run autoupdate 2021-06-01 11:42:38 +02:00
contrib function-trace: always show the trace 2019-09-18 23:23:21 +02:00
doc Add a release note for the build-dir hardening 2024-04-22 15:38:04 +02:00
m4 Add configure test to ensure GCC bug is fixed 2023-10-31 12:09:46 -04:00
maintainers maintainers: refine the mission statement phrasing 2023-11-07 01:12:39 +01:00
misc Choose a reasonable number similar to LimitNOFile 2023-07-07 07:52:16 -07:00
mk Move tests to separate directories, and document 2023-12-01 11:37:01 -05:00
perl Split up util.{hh,cc} 2023-11-05 12:20:02 -05:00
scripts Fix "unbound variable" errors in bash 2023-11-21 14:12:50 +00:00
src Put the chroot inside a directory that isn't group/world-accessible 2024-06-21 16:40:03 +02:00
tests Run the builds in a daemon-controled directory 2024-04-22 15:38:04 +02:00
.dir-locals.el .dir-locals.el: Set c-block-comment-prefix 2020-07-10 11:21:06 +02:00
.editorconfig .editorconfig: Also affect Perl FFI xs file 2023-11-09 23:11:52 -05:00
.gitignore Move tests to separate directories, and document 2023-12-01 11:37:01 -05:00
.version Bump version 2024-03-07 15:43:55 +01:00
boehmgc-coroutine-sp-fallback.diff Fix boehmgc-coroutine-sp-fallback.diff for FreeBSD 2023-09-20 09:04:42 -04:00
configure.ac Allow installing unit tests 2023-11-16 09:55:42 -05:00
CONTRIBUTING.md Merge pull request #9182 from fricklerhandwerk/popular-issues 2023-10-19 16:25:36 -04:00
COPYING * Change this to LGPL to keep the government happy. 2006-04-25 16:41:06 +00:00
default.nix add flake-compat to flake.nix and use sha256 in default.nix 2023-03-06 21:11:24 +01:00
docker.nix fix "add an option to include flake-registry..." 2023-05-16 14:35:31 +02:00
flake.lock flake.lock: Update 2023-12-01 11:01:20 -05:00
flake.nix add tests for showing help 2024-03-04 21:06:51 +01:00
local.mk Use positive source filtering for the standalone functional tests job 2023-10-09 08:29:27 -04:00
Makefile Move tests to separate directories, and document 2023-12-01 11:37:01 -05:00
Makefile.config.in Allow installing unit tests 2023-11-16 09:55:42 -05:00
precompiled-headers.h Config: Use nlohmann/json 2020-08-20 11:02:16 +02:00
README.md fix: Remove extra to from README.md (#9213) 2023-10-23 19:20:23 +02:00
shell.nix Remove url literals 2022-01-24 13:28:21 +01:00

Nix

Open Collective supporters Test

Nix is a powerful package manager for Linux and other Unix systems that makes package management reliable and reproducible. Please refer to the Nix manual for more details.

Installation and first steps

Visit nix.dev for installation instructions and beginner tutorials.

Full reference documentation can be found in the Nix manual.

Building And Developing

See our Hacking guide in our manual for instruction on how to set up a development environment and build Nix from source.

Contributing

Check the contributing guide if you want to get involved with developing Nix.

Additional Resources

License

Nix is released under the LGPL v2.1.