Skip to content
Snippets Groups Projects
  1. Oct 20, 2004
  2. Oct 18, 2004
  3. Oct 14, 2004
  4. Oct 13, 2004
  5. Sep 22, 2004
  6. Sep 19, 2004
  7. Sep 12, 2004
    • Eelco Dolstra's avatar
      * Fallback didn't work for subderivations of an unnormalised the main · b357284a
      Eelco Dolstra authored
        derivation, since NormalisationGoal would first run a
        NormalisationGoal on the subderivation (a no-op, since in a
        situation where we need fallback the successor is known), and then
        runs a RealisationGoal on the normal form, which then cannot do a
        fallback because it doesn't know the derivation expression for which
        it is a normal form.
      
        Tossed out the 2-phase normalisation/realisation in
        NormalisationGoal and SubstitutionGoal since it's no longer needed -
        a RealisationGoal will run a NormalisationGoal if necessary.
      b357284a
  8. Sep 10, 2004
  9. Sep 09, 2004
    • Eelco Dolstra's avatar
      * Remove write permission from store objects after they have been · c16be6ac
      Eelco Dolstra authored
        added to the store.  Bug reported by Martin.
      c16be6ac
    • Eelco Dolstra's avatar
      * A very dirty hack to make setuid installations a bit nicer to use. · 47f87072
      Eelco Dolstra authored
        Previously there was the problem that all files read by nix-env
        etc. should be reachable and readable by the Nix user.  So for
        instance building a Nix expression in your home directory meant that
        the home directory should have at least g+x or o+x permission so
        that the Nix user could reach the Nix expression.  Now we just
        switch back to the original user just prior to reading sources and
        the like.  The places where this happens are somewhat arbitrary,
        however.  Any scope that has a live SwitchToOriginalUser object in
        it is executed as the original user.
      
      * Back out r1385.  setreuid() sets the saved uid to the new
        real/effective uid, which prevents us from switching back to the
        original uid.  setresuid() doesn't have this problem (although the
        manpage has a bug: specifying -1 for the saved uid doesn't leave it
        unchanged; an explicit value must be specified).
      47f87072
    • Eelco Dolstra's avatar
      * Use setre[ug]id() instead of setres[ug]id(), since the former is · 5396304c
      Eelco Dolstra authored
        more common than the latter (which exists only on Linux and
        FreeBSD).  We don't really care about dropping the saved IDs since
        there apparently is no way to quiry them in any case, so it can't
        influence the build (unlike the effective IDs which are checked by
        Perl for instance).
      5396304c
    • Eelco Dolstra's avatar
      * Set the umask to known value (0022). This is important in a · e043fc7d
      Eelco Dolstra authored
        setuid installation, since the calling user may have a more fascist
        umask (say, 0077), which would cause the store objects built by Nix
        to be unreadable to anyone other than the Nix user.
      e043fc7d
  10. Sep 08, 2004
  11. Sep 06, 2004
  12. Aug 31, 2004
  13. Aug 30, 2004
  14. Aug 25, 2004
    • Eelco Dolstra's avatar
      * `--min-age' flag in nix-store and nix-collect-garbage to only delete · eb233e72
      Eelco Dolstra authored
        unreachable paths that haven't been used for N hours.  For instance,
        `nix-collect-garbage --min-age 168' only deletes paths that haven't
        been accessed in the last week.
      
        This is useful for instance in the build farm where many derivations
        can be shared between consecutive builds, and we wouldn't want a
        garbage collect to throw them all away.  We could of course register
        them as roots, but then we'd to unregister them at some point, which
        would be a pain to manage.  The `--min-age' flag gives us a sort of
        MRU caching scheme.
      
        BUG: this really shouldn't be in gc.cc since that violates
        mechanism/policy separation.
      eb233e72
    • Eelco Dolstra's avatar
      * `nix-collect-garbage' now actually performs a garbage collection, it · fdec72c6
      Eelco Dolstra authored
        doesn't just print the set of paths that should be deleted.  So
        there is no more need to pipe the result into `nix-store --delete'
        (which doesn't even exist anymore).
      fdec72c6
    • Eelco Dolstra's avatar
      * Put the garbage collector in nix-store: operation `--gc', · 81804788
      Eelco Dolstra authored
        suboperations `--print-live', `--print-dead', and `--delete'.  The
        roots are not determined by nix-store; they are read from standard
        input.  This is to make it easy to customise what the roots are.
      
        The collector now no longer fails when store expressions are missing
        (which legally happens when using substitutes).  It never tries to
        fetch paths through substitutes.
      
        TODO: acquire a global lock on the store while garbage collecting.
        
      * Removed `nix-store --delete'.
      
      81804788
  15. Aug 24, 2004
  16. Aug 20, 2004
    • Eelco Dolstra's avatar
      * The gid should also match. · 8f58733e
      Eelco Dolstra authored
      8f58733e
    • Eelco Dolstra's avatar
    • Eelco Dolstra's avatar
      * On systems that have the setresuid() and setresgid() system calls to · e77fbe0f
      Eelco Dolstra authored
        set the real uid and gid to the effective uid and gid, the Nix
        binaries can be installed as owned by the Nix user and group instead
        of root, so no root involvement of any kind is necessary.
      
        Linux and FreeBSD have these functions.
      e77fbe0f
    • Eelco Dolstra's avatar
      * Setuid support for sharing a Nix installation between multiple · 2d35116c
      Eelco Dolstra authored
        users.
      
        If the configure flag `--enable-setuid' is used, the Nix programs
        nix-env, nix-store, etc. are installed with the setuid bit turned on
        so that they are executed as the user and group specified by
        `--with-nix-user=USER' and `--with-nix-group=GROUP', respectively
        (with defaults `nix' and `nix').
      
        The setuid programs drop all special privileges if they are executed
        by a user who is not a member of the Nix group.
      
        The setuid feature is a quick hack to enable sharing of a Nix
        installation between users who trust each other.  It is not
        generally secure, since any user in the Nix group can modify (by
        building an appropriate derivation) any object in the store, and for
        instance inject trojans into binaries used by other users.
      
        The setuid programs are owned by root, not the Nix user.  This is
        because on Unix normal users cannot change the real uid, only the
        effective uid.  Many programs don't work properly when the real uid
        differs from the effective uid.  For instance, Perl will turn on
        taint mode.  However, the setuid programs drop all root privileges
        immediately, changing all uids and gids to the Nix user and group.
      
      2d35116c
  17. Aug 19, 2004
  18. Aug 18, 2004
  19. Aug 13, 2004
  20. Aug 11, 2004
  21. Aug 05, 2004
  22. Aug 04, 2004
  23. Jul 30, 2004
Loading