cafkafk/lix
cafkafk/lix
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

simplify build.cc using modern C++ features

Browse source
This commit is contained in:
Jude Taylor 2015-11-14 14:09:52 -08:00
parent 4876bb012e
commit bd09a4c967
1 changed files with 28 additions and 30 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

58
src/libstore/build.cc
View file

@ -1921,35 +1921,35 @@ void DerivationGoal::startBuilder()
for (auto & i : closure) for (auto & i : closure)
dirsInChroot[i] = i; dirsInChroot[i] = i;
if(!SANDBOX_ENABLED) { #if SANDBOX_ENABLED
string allowed = settings.get("allowed-impure-host-deps", string(DEFAULT_ALLOWED_IMPURE_PREFIXES)); additionalSandboxProfile = get(drv->env, "__sandboxProfile");
PathSet allowedPaths = tokenizeString<StringSet>(allowed); #else
string allowed = settings.get("allowed-impure-host-deps", string(DEFAULT_ALLOWED_IMPURE_PREFIXES));
PathSet allowedPaths = tokenizeString<StringSet>(allowed);
/* This works like the above, except on a per-derivation level */ /* This works like the above, except on a per-derivation level */
Strings impurePaths = tokenizeString<Strings>(get(drv->env, "__impureHostDeps")); Strings impurePaths = tokenizeString<Strings>(get(drv->env, "__impureHostDeps"));
for (auto & i : impurePaths) { for (auto & i : impurePaths) {
bool found = false; bool found = false;
/* Note: we're not resolving symlinks here to prevent /* Note: we're not resolving symlinks here to prevent
giving a non-root user info about inaccessible giving a non-root user info about inaccessible
files. */ files. */
Path canonI = canonPath(i); Path canonI = canonPath(i);
/* If only we had a trie to do this more efficiently :) luckily, these are generally going to be pretty small */ /* If only we had a trie to do this more efficiently :) luckily, these are generally going to be pretty small */
for (auto & a : allowedPaths) { for (auto & a : allowedPaths) {
Path canonA = canonPath(a); Path canonA = canonPath(a);
if (canonI == canonA || isInDir(canonI, canonA)) { if (canonI == canonA || isInDir(canonI, canonA)) {
found = true; found = true;
break; break;
} }
} }
if (!found) if (!found)
throw Error(format("derivation '%1%' requested impure path ‘%2%’, but it was not in allowed-impure-host-deps (‘%3%’)") % drvPath % i % allowed); throw Error(format("derivation '%1%' requested impure path ‘%2%’, but it was not in allowed-impure-host-deps (‘%3%’)") % drvPath % i % allowed);
dirsInChroot[i] = i; dirsInChroot[i] = i;
}
} else {
additionalSandboxProfile = get(drv->env, "__sandboxProfile");
} }
#endif
#if CHROOT_ENABLED #if CHROOT_ENABLED
/* Create a temporary directory in which we set up the chroot /* Create a temporary directory in which we set up the chroot
@ -2527,17 +2527,15 @@ void DerivationGoal::runChild()
debug("Generated sandbox profile:"); debug("Generated sandbox profile:");
debug(sandboxProfile); debug(sandboxProfile);
char *tmpProfile = strdup((format("%1%/nix-sandboxXXXXXX.sb") % globalTmpDir).str().c_str()); Path tmpProfile = createTempDir() + "/profile.sb";
int profileFd = mkstemps(tmpProfile, 3); writeFile(tmpProfile, sandboxProfile);
closeOnExec(profileFd);
writeFull(profileFd, sandboxProfile);
builder = "/usr/bin/sandbox-exec"; builder = "/usr/bin/sandbox-exec";
args.push_back("sandbox-exec"); args.push_back("sandbox-exec");
args.push_back("-f"); args.push_back("-f");
args.push_back(tmpProfile); args.push_back(tmpProfile);
args.push_back("-D"); args.push_back("-D");
args.push_back((format("_GLOBAL_TMP_DIR=%1%") % globalTmpDir).str()); args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir);
args.push_back(drv->builder); args.push_back(drv->builder);
} else { } else {
builder = drv->builder.c_str(); builder = drv->builder.c_str();