max/nix-super
1
0
Fork 0
mirror of https://github.com/privatevoid-net/nix-super.git synced 2024-11-26 15:56:18 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Use AutoDelete for sandbox profile file

Browse source
This commit is contained in:
Shea Levy 2015-11-15 06:08:50 -05:00
parent bd09a4c967
commit 4390142315
1 changed files with 14 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
src/libstore/build.cc
View file

@ -778,9 +778,13 @@ private:
DirsInChroot dirsInChroot; DirsInChroot dirsInChroot;
typedef map<string, string> Environment; typedef map<string, string> Environment;
Environment env; Environment env;
#if SANDBOX_ENABLED
typedef string SandboxProfile; typedef string SandboxProfile;
SandboxProfile additionalSandboxProfile; SandboxProfile additionalSandboxProfile;
AutoDelete autoDelSandbox;
#endif
/* Hash rewriting. */ /* Hash rewriting. */
HashRewrites rewritesToTmp, rewritesFromTmp; HashRewrites rewritesToTmp, rewritesFromTmp;
typedef map<Path, Path> RedirectedOutputs; typedef map<Path, Path> RedirectedOutputs;
@ -2445,9 +2449,10 @@ void DerivationGoal::runChild()
const char *builder = "invalid"; const char *builder = "invalid";
string sandboxProfile; string sandboxProfile;
if (isBuiltin(*drv)) if (isBuiltin(*drv)) {
; ;
else if (useChroot && SANDBOX_ENABLED) { #if SANDBOX_ENABLED
} else if (useChroot) {
/* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */ /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */
PathSet ancestry; PathSet ancestry;
@ -2527,16 +2532,20 @@ void DerivationGoal::runChild()
debug("Generated sandbox profile:"); debug("Generated sandbox profile:");
debug(sandboxProfile); debug(sandboxProfile);
Path tmpProfile = createTempDir() + "/profile.sb"; Path sandboxFile = drvPath + ".sb";
writeFile(tmpProfile, sandboxProfile); if (pathExists(sandboxFile)) deletePath(sandboxFile);
autoDelSandbox = AutoDelete(sandboxFile);
writeFile(sandboxFile, sandboxProfile);
builder = "/usr/bin/sandbox-exec"; builder = "/usr/bin/sandbox-exec";
args.push_back("sandbox-exec"); args.push_back("sandbox-exec");
args.push_back("-f"); args.push_back("-f");
args.push_back(tmpProfile); args.push_back(sandboxFile);
args.push_back("-D"); args.push_back("-D");
args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir); args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir);
args.push_back(drv->builder); args.push_back(drv->builder);
#endif
} else { } else {
builder = drv->builder.c_str(); builder = drv->builder.c_str();
string builderBasename = baseNameOf(drv->builder); string builderBasename = baseNameOf(drv->builder);