about summary refs log tree commit diff
path: root/src/libutil/Makefile.am
diff options
context:
space:
mode:
authorEelco Dolstra <e.dolstra@tudelft.nl>2012-02-15T00·31+0100
committerEelco Dolstra <e.dolstra@tudelft.nl>2012-02-15T00·31+0100
commitbd013b6f987c23c3b99b639ba7cdbc7b694a13f5 (patch)
treeb1726c5b26371a9ee0666ab0b6aff9b1df5755c5 /src/libutil/Makefile.am
parent5e57047d874e0f01dcb3bbc8b809fcc1aa82755b (diff)
On Linux, make the Nix store really read-only by using the immutable bit
I was bitten one time too many by Python modifying the Nix store by
creating *.pyc files when run as root.  On Linux, we can prevent this
by setting the immutable bit on files and directories (as in ‘chattr
+i’).  This isn't supported by all filesystems, so it's not an error
if setting the bit fails.  The immutable bit is cleared by the garbage
collector before deleting a path.  The only tricky aspect is in
optimiseStore(), since it's forbidden to create hard links to an
immutable file.  Thus optimiseStore() temporarily clears the immutable
bit before creating the link.
Diffstat (limited to 'src/libutil/Makefile.am')
-rw-r--r--src/libutil/Makefile.am4
1 files changed, 2 insertions, 2 deletions
diff --git a/src/libutil/Makefile.am b/src/libutil/Makefile.am
index 98f32633b894..a326060cfea9 100644
--- a/src/libutil/Makefile.am
+++ b/src/libutil/Makefile.am
@@ -1,12 +1,12 @@
 pkglib_LTLIBRARIES = libutil.la
 
 libutil_la_SOURCES = util.cc hash.cc serialise.cc \
-  archive.cc xml-writer.cc
+  archive.cc xml-writer.cc immutable.cc
 
 libutil_la_LIBADD = ../boost/format/libformat.la ${aterm_lib} ${sqlite_lib}
 
 pkginclude_HEADERS = util.hh hash.hh serialise.hh \
-  archive.hh xml-writer.hh types.hh
+  archive.hh xml-writer.hh types.hh immutable.hh
 
 if !HAVE_OPENSSL
 libutil_la_SOURCES += \