about summary refs log tree commit diff
diff options
context:
space:
mode:
authorDaniel Peebles <pumpkin@me.com>2015-01-15T07·49-0500
committerShea Levy <shea@shealevy.com>2015-01-19T04·25-0500
commitf46e329a1332738694973d67d70dc5e32c5eda40 (patch)
tree885dc0845b67cec1ca00c0d3dcc0336b43808eaf
parentf6716e95bb5ea6fc267f228880b46e9509fc4801 (diff)
Make inputs writeable in the sandbox (builds still can’t actually write due to user permissions)
-rw-r--r--src/libstore/build.cc9
1 files changed, 7 insertions, 2 deletions
diff --git a/src/libstore/build.cc b/src/libstore/build.cc
index 5285d39df2d6..e0398e2fb4a3 100644
--- a/src/libstore/build.cc
+++ b/src/libstore/build.cc
@@ -2271,8 +2271,13 @@ void DerivationGoal::runChild()
             }
             sandboxProfile += ")\n";
 
-            /* Our inputs (transitive dependencies and any impurities computed above) */
-            sandboxProfile += "(allow file-read* process-exec\n";
+            /* Our inputs (transitive dependencies and any impurities computed above)
+               Note that the sandbox profile allows file-write* even though it isn't seemingly necessary. First of all, nix's standard user permissioning
+               mechanism still prevents builders from writing to input directories, so no security/purity is lost. The reason we allow file-write* is that
+               denying it means the `access` syscall will return EPERM instead of EACCESS, which confuses a few programs that assume (understandably, since
+               it appears to be a violation of the POSIX spec) that `access` won't do that, and don't deal with it nicely if it does. The most notable of
+               these is the entire GHC Haskell ecosystem. */
+            sandboxProfile += "(allow file-read* file-write* process-exec\n";
             for (auto & i : dirsInChroot) {
                 if (i.first != i.second)
                     throw SysError(format("can't map '%1%' to '%2%': mismatched impure paths not supported on darwin"));