12 commits

Author	SHA1	Message	Date
Eelco Dolstra	ff12d1c1a1	Check that auto-allocated UIDs don't clash with existing accounts	2022-11-28 20:49:17 +01:00
Eelco Dolstra	3d23b9d032	SimpleUserLock::getSupplementaryGIDs(): Filter out main gid ... This avoids having the user's gid in the supplementary group list as well.	2022-11-22 10:26:17 +01:00
Eelco Dolstra	9d17ce07e8	AutoUserLock: If sandboxing is disabled, use the build users group ... We have to use a gid that has write access to the Nix store.	2022-11-21 12:55:49 +01:00
Eelco Dolstra	128910ba23	Separate cgroup support from auto-uid-allocation ... The new experimental feature 'cgroups' enables the use of cgroups for all builds. This allows better containment and enables setting resource limits and getting some build stats.	2022-11-18 10:39:28 +01:00
Eelco Dolstra	05d258667d	Fix build on macOS	2022-11-08 08:00:29 -08:00
Eelco Dolstra	2fde7e0108	Split auto UID allocation from cgroups ... Cgroups are now only used for derivations that require the uid-range range feature. This allows auto UID allocation even on systems that don't have cgroups (like macOS). Also, make things work on modern systems that use cgroups v2 (where there is a single hierarchy and no "systemd" controller).	2022-11-08 16:03:42 +01:00
Eelco Dolstra	b95faccf03	Merge remote-tracking branch 'origin/master' into auto-uid-allocation	2022-11-03 17:43:40 +01:00
Bernardo Meurer	931930feb1	fix(libstore/lock): support users that belong to more than 10 groups ... The manpage for `getgrouplist` says: > If the number of groups of which user is a member is less than or > equal to *ngroups, then the value *ngroups is returned. > > If the user is a member of more than *ngroups groups, then > getgrouplist() returns -1. In this case, the value returned in > *ngroups can be used to resize the buffer passed to a further > call getgrouplist(). In our original code, however, we allocated a list of size `10` and, if `getgrouplist` returned `-1` threw an exception. In practice, this caused the code to fail for any user belonging to more than 10 groups. While unusual for single-user systems, large companies commonly have a huge number of POSIX groups users belong to, causing this issue to crop up and make multi-user Nix unusable in such settings. The fix is relatively simple, when `getgrouplist` fails, it stores the real number of GIDs in `ngroups`, so we must resize our list and retry. Only then, if it errors once more, we can raise an exception. This should be backported to, at least, 2.9.x.	2022-06-08 13:45:41 -04:00
John Ericson	dc92b01885	Merge remote-tracking branch 'upstream/master' into auto-uid-allocation	2022-02-28 23:54:20 +00:00
John Ericson	801e6d96d8	Merge commit 'd334fd48824b41b57e267cd2926fa9619b7718e3' into auto-uid-allocation	2020-10-17 19:31:06 +00:00
John Ericson	bcb67e1ed8	Trim lock.cc	2020-10-11 16:44:19 +00:00
John Ericson	e0be04129b	Rename to hand-hold git (lock.cc)	2020-10-11 16:44:14 +00:00

Renamed from src/libstore/build.cc (Browse further)