about summary refs log tree commit diff
path: root/src/libstore/build.cc
AgeCommit message (Collapse)AuthorFilesLines
2017-10-12 Add option to disable the seccomp filterEelco Dolstra1-0/+2
I needed this to test ACL/xattr removal in canonicalisePathMetaData(). Might also be useful if you need to build old Nixpkgs that doesn't have the required patches to remove setuid/setgid creation.
2017-09-08 Communicate the structured log FD to buildersEelco Dolstra1-1/+6
Since we may use a dedicated file descriptor in the future, this allows us to change it. So builders can do if [[ -n $NIX_LOG_FD ]]; then echo "@nix { message... }" >&$NIX_LOG_FD fi
2017-09-05 Add automatic garbage collectionEelco Dolstra1-0/+5
Nix can now automatically run the garbage collector during builds or while adding paths to the store. The option "min-free = <bytes>" specifies that Nix should run the garbage collector whenever free space in the Nix store drops below <bytes>. It will then delete garbage until "max-free" bytes are available. Garbage collection during builds is asynchronous; running builds are not paused and new builds are not blocked. However, there also is a synchronous GC run prior to the first build/substitution. Currently, no old GC roots are deleted (as in "nix-collect-garbage -d").
2017-08-31 Call queryMissing() prior to buildingEelco Dolstra1-0/+12
Without this, substitute info is fetched sequentially, which is superslow. In the old UI (e.g. nix-build), we call printMissing(), which calls queryMissing(), thereby preheating the binary cache cache. But the new UI doesn't do that.
2017-08-31 Rename a few configuration optionsEelco Dolstra1-3/+3
In particular, drop the "build-" and "gc-" prefixes which are pointless. So now you can say nix build --no-sandbox instead of nix build --no-build-use-sandbox
2017-08-28 Give activities a verbosity level againEelco Dolstra1-4/+6
And print them (separately from the progress bar) given sufficient -v flags.
2017-08-25 SimplifyEelco Dolstra1-10/+36
2017-08-25 Allow derivations to update the build phaseEelco Dolstra1-0/+5
So the progress bar can show [1/0/1 built, 0.0 MiB DL] building hello-2.10 (configuring): checking whether pread is declared without a macro... yes
2017-08-25 Allow activities to be nestedEelco Dolstra1-3/+6
In particular, this allows more relevant activities ("substituting X") to supersede inferior ones ("downloading X").
2017-08-25 Restore activity metadataEelco Dolstra1-2/+5
This allows the progress bar to display "building perl-5.22.3" instead of "building /nix/store/<hash>-perl-5.22.3.drv".
2017-08-21 Clean up JSON constructionEelco Dolstra1-3/+18
2017-08-21 Allow builders to create activitiesEelco Dolstra1-6/+72
Actually, currently they can only create download activities. Thus, downloads by builtins.fetchurl show up in the progress bar.
2017-08-16 nix optimise-store: Show how much space has been freedEelco Dolstra1-1/+1
2017-08-16 Progress indicator: CleanupEelco Dolstra1-7/+7
2017-08-16 Progress indicator: More improvementsEelco Dolstra1-9/+47
2017-08-16 Progress indicator: Show number of active itemsEelco Dolstra1-12/+8
2017-08-16 Progress indicator: Unify "copying" and "substituting"Eelco Dolstra1-6/+13
They're the same thing after all. Example: $ nix build --store local?root=/tmp/nix nixpkgs.firefox-unwrapped [0/1 built, 49/98 copied, 16.3/92.8 MiB DL, 55.8/309.2 MiB copied] downloading 'https://cache.nixos.org/nar/0pl9li1jigcj2dany47hpmn0r3r48wc4nz48v5mqhh426lgz3bz6.nar.xz'
2017-08-16 Improve substitution progress indicatorEelco Dolstra1-1/+54
E.g. $ nix build --store local?root=/tmp/nix nixpkgs.firefox-unwrapped [0/1 built, 1/97/98 fetched, 65.8/92.8 MiB DL, 203.2/309.2 MiB copied] downloading 'https://cache.nixos.org/nar/1czm9fk0svacy4h6a3fzkpafi4f7a9gml36kk8cq1igaghbspg3k.nar.xz'
2017-08-09 Use /proc/self/fd to efficiently close all FDs on LinuxEelco Dolstra1-1/+1
Issue #1506.
2017-07-30 Replace Unicode quotes in user-facing strings by ASCIIJörg Thalheim1-102/+102
Relevant RFC: NixOS/rfcs#4 $ ag -l | xargs sed -i -e "/\"/s/’/'/g;/\"/s/‘/'/g"
2017-07-20 FD_SETSIZE check: BuildError -> ErrorEelco Dolstra1-3/+2
BuildError denotes a permanent build failure, which is not the case here.
2017-07-18 Do not try to fill fd_set with fd>=FD_SETSIZEDmitry Kalinkin1-0/+3
This is UB and causes buffer overflow and crash on linux.
2017-07-04 Add X32 to the seccomp filterEelco Dolstra1-0/+4
Fixes #1432.
2017-07-04 Add allow-new-privileges optionEelco Dolstra1-0/+3
This allows builds to call setuid binaries. This was previously possible until we started using seccomp. Turns out that seccomp by default disallows processes from acquiring new privileges. Generally, any use of setuid binaries (except those created by the builder itself) is by definition impure, but some people were relying on this ability for certain tests. Example: $ nix build '(with import <nixpkgs> {}; runCommand "foo" {} "/run/wrappers/bin/ping -c 1 8.8.8.8; exit 1")' --no-allow-new-privileges builder for ‘/nix/store/j0nd8kv85hd6r4kxgnwzvr0k65ykf6fv-foo.drv’ failed with exit code 1; last 2 log lines: cannot raise the capability into the Ambient set : Operation not permitted $ nix build '(with import <nixpkgs> {}; runCommand "foo" {} "/run/wrappers/bin/ping -c 1 8.8.8.8; exit 1")' --allow-new-privileges builder for ‘/nix/store/j0nd8kv85hd6r4kxgnwzvr0k65ykf6fv-foo.drv’ failed with exit code 1; last 6 log lines: PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=46 time=15.2 ms Fixes #1429.
2017-07-04 Support base-64 hashesEelco Dolstra1-1/+1
Also simplify the Hash API. Fixes #1437.
2017-07-03 Replace a few bool flags with enumsEelco Dolstra1-9/+9
Functions like copyClosure() had 3 bool arguments, which creates a severe risk of mixing up arguments. Also, implement copyClosure() using copyPaths().
2017-06-19 macOS: Ugly hack to make the tests succeedEelco Dolstra1-3/+2
Sandboxes cannot be nested, so if Nix's build runs inside a sandbox, it cannot use a sandbox itself. I don't see a clean way to detect whether we're in a sandbox, so use a test-specific hack. https://github.com/NixOS/nix/issues/1413
2017-06-12 Don't run pre-build-hook if we don't have a derivationEelco Dolstra1-1/+1
This fixes a build failure on OS X when using Hydra or Nix 1.12's build-remote (since they don't copy the derivation to the build machine).
2017-06-06 Disable the build user mechanism on all platforms except Linux and OS XEelco Dolstra1-0/+6
2017-06-06 Always use the Darwin sandboxEelco Dolstra1-81/+87
Even with "build-use-sandbox = false", we now use sandboxing with a permissive profile that allows everything except the creation of setuid/setgid binaries.
2017-05-31 OS X sandbox: Improve builtin sandbox profileEelco Dolstra1-3/+10
Also, add rules to allow fixed-output derivations to access the network. These rules are sufficient to build stdenvDarwin without any __sandboxProfile magic.
2017-05-31 OS X sandbox: Don't use a deterministic $TMPDIREelco Dolstra1-3/+0
This doesn't work because the OS X sandbox cannot bind-mount path to a different location.
2017-05-31 OS X sandbox: Store .sb file in $TMPDIR rather than the Nix storeEelco Dolstra1-4/+1
The filename used was not unique and owned by the build user, so builds could fail with error: while setting up the build environment: cannot unlink ‘/nix/store/99i210ihnsjacajaw8r33fmgjvzpg6nr-bison-3.0.4.drv.sb’: Permission denied
2017-05-30 Darwin sandbox: Use sandbox-defaults.sbEelco Dolstra1-3/+3
Issue #759. Also, remove nix.conf from the sandbox since I don't really see a legitimate reason for builders to access the Nix configuration.
2017-05-30 Darwin sandbox: Disallow creating setuid/setgid binariesEelco Dolstra1-0/+4
Suggested by Daiderd Jordan.
2017-05-30 Fix seccomp build failure on clangEelco Dolstra1-3/+3
Fixes src/libstore/build.cc:2321:45: error: non-constant-expression cannot be narrowed from type 'int' to 'scmp_datum_t' (aka 'unsigned long') in initializer list [-Wc++11-narrowing]
2017-05-30 Shut up some clang warningsEelco Dolstra1-7/+7
2017-05-30 Add a seccomp rule to disallow setxattr()Eelco Dolstra1-1/+9
2017-05-30 Require seccomp only in multi-user setupsEelco Dolstra1-1/+5
2017-05-29 Fix seccomp initialisation on i686-linuxEelco Dolstra1-1/+2
2017-05-29 Add a seccomp filter to prevent creating setuid/setgid binariesEelco Dolstra1-0/+39
This prevents builders from setting the S_ISUID or S_ISGID bits, preventing users from using a nixbld* user to create a setuid/setgid binary to interfere with subsequent builds under the same nixbld* uid. This is based on aszlig's seccomp code (47f587700d646f5b03a42f2fa57c28875a31efbe). Reported by Linus Heckemann.
2017-05-16 Improve progress indicatorEelco Dolstra1-3/+28
2017-05-15 Simplify fixed-output checkEelco Dolstra1-6/+2
2017-05-15 Linux sandbox: Don't barf on invalid pathsEelco Dolstra1-0/+1
This is useful when we're using a diverted store (e.g. "--store local?root=/tmp/nix") in conjunction with a statically-linked sh from the host store (e.g. "sandbox-paths =/bin/sh=/nix/store/.../bin/busybox").
2017-05-08 Linux sandbox: Fix compatibility with older kernelsEelco Dolstra1-15/+23
2017-05-08 Remove superfluous #ifdefEelco Dolstra1-2/+0
2017-05-05 Make the location of the build directory in the sandbox configurableEelco Dolstra1-5/+2
This is mostly for use in the sandbox tests, since if the Nix store is under /build, then we can't use /build as the build directory.
2017-05-04 Linux sandbox: Use /build instead of /tmp as $TMPDIREelco Dolstra1-5/+15
There is a security issue when a build accidentally stores its $TMPDIR in some critical place, such as an RPATH. If TMPDIR=/tmp/nix-build-..., then any user on the system can recreate that directory and inject libraries into the RPATH of programs executed by other users. Since /build probably doesn't exist (or isn't world-writable), this mitigates the issue.
2017-05-02 Add an option for specifying remote buildersEelco Dolstra1-1/+2
This is useful for one-off situations where you want to specify a builder on the command line instead of having to mess with nix.machines. E.g. $ nix-build -A hello --argstr system x86_64-darwin \ --option builders 'root@macstadium1 x86_64-darwin' will perform the specified build on "macstadium1". It also removes the need for a separate nix.machines file since you can specify builders in nix.conf directly. (In fact nix.machines is yet another hack that predates the general nix.conf configuration file, IIRC.) Note: this option is supported by the daemon for trusted users. The fact that this allows trusted users to specify paths to SSH keys to which they don't normally have access is maybe a bit too much trust...
2017-05-02 build-hook: If there are no machines defined, quit permanentlyEelco Dolstra1-2/+9
generated by cgit-pink 1.4.1 (git 2.44.2) at 2024-12-27T20·48+0000