diff options
| author | Eelco Dolstra <e.dolstra@tudelft.nl> | 2004-08-20T14·49+0000 |
|---|---|---|
| committer | Eelco Dolstra <e.dolstra@tudelft.nl> | 2004-08-20T14·49+0000 |
| commit | 2d35116c13e0c11210cb712f9ce6e8a38058f350 (patch) | |
| tree | 62c38ca3f7a11691c54a630a4a78f0ad8810a5ad /Makefile.am | |
| parent | 8f1dcdfc0ae05c403fe59b592093d3e61e87f1b0 (diff) | |
* Setuid support for sharing a Nix installation between multiple
users. If the configure flag `--enable-setuid' is used, the Nix programs nix-env, nix-store, etc. are installed with the setuid bit turned on so that they are executed as the user and group specified by `--with-nix-user=USER' and `--with-nix-group=GROUP', respectively (with defaults `nix' and `nix'). The setuid programs drop all special privileges if they are executed by a user who is not a member of the Nix group. The setuid feature is a quick hack to enable sharing of a Nix installation between users who trust each other. It is not generally secure, since any user in the Nix group can modify (by building an appropriate derivation) any object in the store, and for instance inject trojans into binaries used by other users. The setuid programs are owned by root, not the Nix user. This is because on Unix normal users cannot change the real uid, only the effective uid. Many programs don't work properly when the real uid differs from the effective uid. For instance, Perl will turn on taint mode. However, the setuid programs drop all root privileges immediately, changing all uids and gids to the Nix user and group.
Diffstat (limited to 'Makefile.am')
| -rw-r--r-- | Makefile.am | 17 |
1 files changed, 10 insertions, 7 deletions
diff --git a/Makefile.am b/Makefile.am index 2213a81ddd5d..9f9f9e0a9386 100644 --- a/Makefile.am +++ b/Makefile.am @@ -14,16 +14,19 @@ relname: install-data-local: init-state if INIT_STATE +if SETUID_HACK +INIT_FLAGS = -g @NIX_GROUP@ -o @NIX_USER@ +endif init-state: - $(INSTALL) -d $(DESTDIR)$(localstatedir)/nix - $(INSTALL) -d $(DESTDIR)$(localstatedir)/nix/db - $(INSTALL) -d $(DESTDIR)$(localstatedir)/log/nix - $(INSTALL) -d $(DESTDIR)$(localstatedir)/nix/profiles - $(INSTALL) -d $(DESTDIR)$(localstatedir)/nix/gcroots - $(INSTALL) -d $(DESTDIR)$(localstatedir)/nix/gcroots/tmp + $(INSTALL) $(INIT_FLAGS) -d $(DESTDIR)$(localstatedir)/nix + $(INSTALL) $(INIT_FLAGS) -d $(DESTDIR)$(localstatedir)/nix/db + $(INSTALL) $(INIT_FLAGS) -d $(DESTDIR)$(localstatedir)/log/nix + $(INSTALL) $(INIT_FLAGS) -d $(DESTDIR)$(localstatedir)/nix/profiles + $(INSTALL) $(INIT_FLAGS) -d $(DESTDIR)$(localstatedir)/nix/gcroots + $(INSTALL) $(INIT_FLAGS) -d $(DESTDIR)$(localstatedir)/nix/gcroots/tmp rm -f $(DESTDIR)$(localstatedir)/nix/gcroots/profiles ln -s $(localstatedir)/nix/profiles $(DESTDIR)$(localstatedir)/nix/gcroots/profiles - $(INSTALL) -d $(DESTDIR)$(prefix)/store + $(INSTALL) $(INIT_FLAGS) -d $(DESTDIR)$(prefix)/store # $(bindir)/nix-store --init else init-state: |