Support sandbox builds by non-root users

This allows an unprivileged user to perform builds on a diverted store
(i.e. where the physical store location differs from the logical
location).

Example:

  $ NIX_LOG_DIR=/tmp/log NIX_REMOTE="local?real=/tmp/store&state=/tmp/var" nix-build -E \
    'with import <nixpkgs> {}; runCommand "foo" { buildInputs = [procps nettools]; } "id; ps; ifconfig; echo $out > $out"'

will do a build in the Nix store physically in /tmp/store but
logically in /nix/store (and thus using substituters for the latter).

1 files changed, 5 insertions, 0 deletions

diff --git a/src/libstore/store-api.hh b/src/libstore/store-api.hh
index 7ef01ea93ed0..75caab7ea388 100644
--- a/src/libstore/store-api.hh
+++ b/src/libstore/store-api.hh
@@ -503,6 +503,11 @@ public:
         const Path & gcRoot, bool indirect, bool allowOutsideRootsDir = false);
 
     virtual Path getRealStoreDir() { return storeDir; }
+
+    Path toRealPath(const Path & storePath)
+    {
+        return getRealStoreDir() + "/" + baseNameOf(storePath);
+    }
 };