mirror of
https://github.com/NixOS/nix.git
synced 2024-11-26 16:52:27 +00:00
90e847698b
https://github.com/NixOS/nix/pull/10456 fixed the addition of symlink store paths to the sandbox, but also made it so that the hardcoded sandbox paths (like `/etc/hosts`) were now bind-mounted without following the possible symlinks. This made these files unreadable if there were symlinks (because the sandbox would now contain a symlink to an unreachable file rather than the underlying file). In particular, this broke FOD derivations on NixOS as `/etc/hosts` is a symlink there. Fix that by canonicalizing all these hardcoded sandbox paths before adding them to the sandbox. (cherry picked from commitacbb1523c1) (cherry picked from commit1cc79f1343) # Conflicts: # tests/functional/linux-sandbox.sh
105 lines
4.0 KiB
Bash
105 lines
4.0 KiB
Bash
source common.sh
|
|
|
|
needLocalStore "the sandbox only runs on the builder side, so it makes no sense to test it with the daemon"
|
|
|
|
clearStore
|
|
|
|
requireSandboxSupport
|
|
|
|
# Note: we need to bind-mount $SHELL into the chroot. Currently we
|
|
# only support the case where $SHELL is in the Nix store, because
|
|
# otherwise things get complicated (e.g. if it's in /bin, do we need
|
|
# /lib as well?).
|
|
if [[ ! $SHELL =~ /nix/store ]]; then skipTest "Shell is not from Nix store"; fi
|
|
# An alias to automatically bind-mount the $SHELL on nix-build invocations
|
|
nix-sandbox-build () { nix-build --no-out-link --sandbox-paths /nix/store "$@"; }
|
|
|
|
chmod -R u+w $TEST_ROOT/store0 || true
|
|
rm -rf $TEST_ROOT/store0
|
|
|
|
export NIX_STORE_DIR=/my/store
|
|
export NIX_REMOTE=$TEST_ROOT/store0
|
|
|
|
outPath=$(nix-sandbox-build dependencies.nix)
|
|
|
|
[[ $outPath =~ /my/store/.*-dependencies ]]
|
|
|
|
nix path-info -r $outPath | grep input-2
|
|
|
|
nix store ls -R -l $outPath | grep foobar
|
|
|
|
nix store cat $outPath/foobar | grep FOOBAR
|
|
|
|
# Test --check without hash rewriting.
|
|
nix-sandbox-build dependencies.nix --check
|
|
|
|
# Test that sandboxed builds with --check and -K can move .check directory to store
|
|
nix-sandbox-build check.nix -A nondeterministic
|
|
|
|
# `100 + 4` means non-determinstic, see doc/manual/src/command-ref/status-build-failure.md
|
|
expectStderr 104 nix-sandbox-build check.nix -A nondeterministic --check -K > $TEST_ROOT/log
|
|
grepQuietInverse 'error: renaming' $TEST_ROOT/log
|
|
grepQuiet 'may not be deterministic' $TEST_ROOT/log
|
|
|
|
# Test that sandboxed builds cannot write to /etc easily
|
|
# `100` means build failure without extra info, see doc/manual/src/command-ref/status-build-failure.md
|
|
expectStderr 100 nix-sandbox-build -E 'with import ./config.nix; mkDerivation { name = "etc-write"; buildCommand = "echo > /etc/test"; }' |
|
|
grepQuiet "/etc/test: Permission denied"
|
|
|
|
|
|
## Test mounting of SSL certificates into the sandbox
|
|
testCert () {
|
|
expectation=$1 # "missing" | "present"
|
|
mode=$2 # "normal" | "fixed-output"
|
|
certFile=$3 # a string that can be the path to a cert file
|
|
# `100` means build failure without extra info, see doc/manual/src/command-ref/status-build-failure.md
|
|
[ "$mode" == fixed-output ] && ret=1 || ret=100
|
|
expectStderr $ret nix-sandbox-build linux-sandbox-cert-test.nix --argstr mode "$mode" --option ssl-cert-file "$certFile" |
|
|
grepQuiet "CERT_${expectation}_IN_SANDBOX"
|
|
}
|
|
|
|
nocert=$TEST_ROOT/no-cert-file.pem
|
|
cert=$TEST_ROOT/some-cert-file.pem
|
|
symlinkcert=$TEST_ROOT/symlink-cert-file.pem
|
|
<<<<<<< HEAD
|
|
transitivesymlinkcert=$TEST_ROOT/transitive-symlink-cert-file.pem
|
|
symlinkDir=$TEST_ROOT/symlink-dir
|
|
echo -n "CERT_CONTENT" > $cert
|
|
ln -s $cert $symlinkcert
|
|
ln -s $symlinkcert $transitivesymlinkcert
|
|
=======
|
|
symlinkDir=$TEST_ROOT/symlink-dir
|
|
echo -n "CERT_CONTENT" > $cert
|
|
ln -s $cert $symlinkcert
|
|
>>>>>>> 1cc79f134 (Fix the access of symlinks to host files in the sandbox)
|
|
ln -s $TEST_ROOT $symlinkDir
|
|
|
|
# No cert in sandbox when not a fixed-output derivation
|
|
testCert missing normal "$cert"
|
|
|
|
# No cert in sandbox when ssl-cert-file is empty
|
|
testCert missing fixed-output ""
|
|
|
|
# No cert in sandbox when ssl-cert-file is a nonexistent file
|
|
testCert missing fixed-output "$nocert"
|
|
|
|
# Cert in sandbox when ssl-cert-file is set to an existing file
|
|
testCert present fixed-output "$cert"
|
|
|
|
<<<<<<< HEAD
|
|
# Cert in sandbox when ssl-cert-file is set to a (potentially transitive) symlink to an existing file
|
|
testCert present fixed-output "$symlinkcert"
|
|
testCert present fixed-output "$transitivesymlinkcert"
|
|
=======
|
|
# Cert in sandbox when ssl-cert-file is set to a symlink to an existing file
|
|
testCert present fixed-output "$symlinkcert"
|
|
>>>>>>> 1cc79f134 (Fix the access of symlinks to host files in the sandbox)
|
|
|
|
# Symlinks should be added in the sandbox directly and not followed
|
|
nix-sandbox-build symlink-derivation.nix -A depends_on_symlink
|
|
nix-sandbox-build symlink-derivation.nix -A test_sandbox_paths \
|
|
--option extra-sandbox-paths "/file=$cert" \
|
|
--option extra-sandbox-paths "/dir=$TEST_ROOT" \
|
|
--option extra-sandbox-paths "/symlinkDir=$symlinkDir" \
|
|
--option extra-sandbox-paths "/symlink=$symlinkcert"
|