lix/tests/functional/linux-sandbox.sh

84 lines
3.1 KiB
Bash
Raw Normal View History

2017-05-02 15:09:35 +02:00
source common.sh
needLocalStore "the sandbox only runs on the builder side, so it makes no sense to test it with the daemon"
2017-05-02 15:09:35 +02:00
clearStore
requireSandboxSupport
2017-05-02 15:09:35 +02:00
# Note: we need to bind-mount $SHELL into the chroot. Currently we
# only support the case where $SHELL is in the Nix store, because
# otherwise things get complicated (e.g. if it's in /bin, do we need
# /lib as well?).
if [[ ! $SHELL =~ /nix/store ]]; then skipTest "Shell is not from Nix store"; fi
# An alias to automatically bind-mount the $SHELL on nix-build invocations
nix-sandbox-build () { nix-build --no-out-link --sandbox-paths /nix/store "$@"; }
2017-05-02 15:09:35 +02:00
chmod -R u+w $TEST_ROOT/store0 || true
rm -rf $TEST_ROOT/store0
export NIX_STORE_DIR=/my/store
export NIX_REMOTE=$TEST_ROOT/store0
2017-05-02 15:09:35 +02:00
outPath=$(nix-sandbox-build dependencies.nix)
2017-05-02 15:09:35 +02:00
[[ $outPath =~ /my/store/.*-dependencies ]]
nix path-info -r $outPath | grep input-2
2020-07-24 20:42:24 +02:00
nix store ls -R -l $outPath | grep foobar
2017-05-02 15:09:35 +02:00
2020-07-24 20:42:24 +02:00
nix store cat $outPath/foobar | grep FOOBAR
2019-05-12 16:46:21 +02:00
# Test --check without hash rewriting.
nix-sandbox-build dependencies.nix --check
# Test that sandboxed builds with --check and -K can move .check directory to store
nix-sandbox-build check.nix -A nondeterministic
# `100 + 4` means non-determinstic, see doc/manual/src/command-ref/status-build-failure.md
expectStderr 104 nix-sandbox-build check.nix -A nondeterministic --check -K > $TEST_ROOT/log
grepQuietInverse 'error: renaming' $TEST_ROOT/log
grepQuiet 'may not be deterministic' $TEST_ROOT/log
2023-02-14 12:03:34 +01:00
# Test that sandboxed builds cannot write to /etc easily
# `100` means build failure without extra info, see doc/manual/src/command-ref/status-build-failure.md
expectStderr 100 nix-sandbox-build -E 'with import ./config.nix; mkDerivation { name = "etc-write"; buildCommand = "echo > /etc/test"; }' |
grepQuiet "/etc/test: Permission denied"
## Test mounting of SSL certificates into the sandbox
testCert () {
expectation=$1 # "missing" | "present"
mode=$2 # "normal" | "fixed-output"
certFile=$3 # a string that can be the path to a cert file
# `100` means build failure without extra info, see doc/manual/src/command-ref/status-build-failure.md
[ "$mode" == fixed-output ] && ret=1 || ret=100
expectStderr $ret nix-sandbox-build linux-sandbox-cert-test.nix --argstr mode "$mode" --option ssl-cert-file "$certFile" |
grepQuiet "CERT_${expectation}_IN_SANDBOX"
}
nocert=$TEST_ROOT/no-cert-file.pem
cert=$TEST_ROOT/some-cert-file.pem
certsymlink=$TEST_ROOT/cert-symlink.pem
echo -n "CERT_CONTENT" > $cert
ln -s $cert $certsymlink
# No cert in sandbox when not a fixed-output derivation
testCert missing normal "$cert"
# No cert in sandbox when ssl-cert-file is empty
testCert missing fixed-output ""
# No cert in sandbox when ssl-cert-file is a nonexistent file
testCert missing fixed-output "$nocert"
# Cert in sandbox when ssl-cert-file is set to an existing file
testCert present fixed-output "$cert"
# Cert in sandbox when ssl-cert-file is set to a symlink
testCert present fixed-output "$certsymlink"
# Symlinks should be added in the sandbox directly and not followed
nix-sandbox-build symlink-derivation.nix