Skip to content
Snippets Groups Projects
  1. Feb 22, 2006
  2. Feb 13, 2006
    • Eelco Dolstra's avatar
      * Optional switch "--with-openssl=<PATH>" to use OpenSSL's · d6f586d0
      Eelco Dolstra authored
        implementations of MD5, SHA-1 and SHA-256.  The main benefit is that
        we get assembler-optimised implementations of MD5 and SHA-1 (though
        not SHA-256 (at least on x86), unfortunately).  OpenSSL's SHA-1
        implementation on Intel is twice as fast as ours.
      d6f586d0
  3. Feb 01, 2006
  4. Oct 05, 2005
  5. Sep 21, 2005
  6. Sep 16, 2005
  7. Sep 15, 2005
  8. Jul 22, 2005
  9. May 07, 2005
  10. Apr 11, 2005
  11. Apr 08, 2005
  12. Mar 21, 2005
  13. Mar 15, 2005
  14. Jan 12, 2005
  15. Dec 29, 2004
  16. Dec 20, 2004
  17. Nov 14, 2004
  18. Oct 27, 2004
  19. Oct 25, 2004
  20. Sep 09, 2004
    • Eelco Dolstra's avatar
      * A very dirty hack to make setuid installations a bit nicer to use. · 47f87072
      Eelco Dolstra authored
        Previously there was the problem that all files read by nix-env
        etc. should be reachable and readable by the Nix user.  So for
        instance building a Nix expression in your home directory meant that
        the home directory should have at least g+x or o+x permission so
        that the Nix user could reach the Nix expression.  Now we just
        switch back to the original user just prior to reading sources and
        the like.  The places where this happens are somewhat arbitrary,
        however.  Any scope that has a live SwitchToOriginalUser object in
        it is executed as the original user.
      
      * Back out r1385.  setreuid() sets the saved uid to the new
        real/effective uid, which prevents us from switching back to the
        original uid.  setresuid() doesn't have this problem (although the
        manpage has a bug: specifying -1 for the saved uid doesn't leave it
        unchanged; an explicit value must be specified).
      47f87072
    • Eelco Dolstra's avatar
      * Use setre[ug]id() instead of setres[ug]id(), since the former is · 5396304c
      Eelco Dolstra authored
        more common than the latter (which exists only on Linux and
        FreeBSD).  We don't really care about dropping the saved IDs since
        there apparently is no way to quiry them in any case, so it can't
        influence the build (unlike the effective IDs which are checked by
        Perl for instance).
      5396304c
  21. Aug 20, 2004
    • Eelco Dolstra's avatar
      * On systems that have the setresuid() and setresgid() system calls to · e77fbe0f
      Eelco Dolstra authored
        set the real uid and gid to the effective uid and gid, the Nix
        binaries can be installed as owned by the Nix user and group instead
        of root, so no root involvement of any kind is necessary.
      
        Linux and FreeBSD have these functions.
      e77fbe0f
    • Eelco Dolstra's avatar
      * Setuid support for sharing a Nix installation between multiple · 2d35116c
      Eelco Dolstra authored
        users.
      
        If the configure flag `--enable-setuid' is used, the Nix programs
        nix-env, nix-store, etc. are installed with the setuid bit turned on
        so that they are executed as the user and group specified by
        `--with-nix-user=USER' and `--with-nix-group=GROUP', respectively
        (with defaults `nix' and `nix').
      
        The setuid programs drop all special privileges if they are executed
        by a user who is not a member of the Nix group.
      
        The setuid feature is a quick hack to enable sharing of a Nix
        installation between users who trust each other.  It is not
        generally secure, since any user in the Nix group can modify (by
        building an appropriate derivation) any object in the store, and for
        instance inject trojans into binaries used by other users.
      
        The setuid programs are owned by root, not the Nix user.  This is
        because on Unix normal users cannot change the real uid, only the
        effective uid.  Many programs don't work properly when the real uid
        differs from the effective uid.  For instance, Perl will turn on
        taint mode.  However, the setuid programs drop all root privileges
        immediately, changing all uids and gids to the Nix user and group.
      
      2d35116c
  22. Aug 13, 2004
  23. Jul 18, 2004
  24. Jun 21, 2004
  25. Jun 04, 2004
  26. May 18, 2004
  27. May 04, 2004
  28. Apr 26, 2004
  29. Apr 23, 2004
  30. Apr 21, 2004
    • Eelco Dolstra's avatar
      * Channels. These allow you to stay current with an evolving set of · 21655a70
      Eelco Dolstra authored
        Nix expressions.
      
        To subscribe to a channel (needs to be done only once):
      
          nix-channel --add \
            http://catamaran.labs.cs.uu.nl/dist/nix/channels/nixpkgs-unstable
      
        This just adds the given URL to ~/.nix-channels (which can also be
        edited manually).
      
        To update from all channels:
      
          nix-channel --update
      
        This fetches the latest expressions and pulls cache manifests.  The
        default Nix expression (~/.nix-defexpr) is made to point to the
        conjunction of the expressions downloaded from all channels.
      
        So to update all installed derivations in the current user
        environment:
      
          nix-channel --update
          nix-env --upgrade '*'
      
        If you are really courageous, you can put this in a cronjob or
        something.
      
        You can subscribe to multiple channels.  It is not entirely clear
        what happens when there are name clashes between derivations from
        different channels.  From nix-env/main.cc it appears that the one
        with the lowest (highest?) hash will be used, which is pretty
        meaningless.
      21655a70
    • Eelco Dolstra's avatar
      * Do initialise state (the DB etc.) when doing a `make install', · f79e9c2d
      Eelco Dolstra authored
        unless `--disable-init-state' is passed to configure.
      f79e9c2d
  31. Apr 08, 2004
  32. Apr 06, 2004
Loading