max/nix-super
1
0
Fork 0
mirror of https://github.com/privatevoid-net/nix-super.git synced 2024-11-27 16:16:16 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions
1405 commits 7 branches 0 tags 64 MiB
Commit graph

107 commits

Author SHA1 Message Date
Eelco Dolstra
e25fad691a * Move addTempRoot() to the store API, and add another function 
syncWithGC() to allow clients to register GC roots without needing
  write access to the global roots directory or the GC lock.
 2006-12-02 16:41:36 +00:00
Eelco Dolstra
536595b072 * Remove most of the old setuid code. 
* Much simpler setuid code for the worker in slave mode.
 2006-12-02 15:45:51 +00:00
Eelco Dolstra
9c9cdb06d0 * Remove SwitchToOriginalUser, we're not going to need it anymore. 2006-12-02 14:34:14 +00:00
Eelco Dolstra
0565b5f2b3 * More remote operations. 
* Added new operation hasSubstitutes(), which is more efficient than
  querySubstitutes().size() > 0.
 2006-11-30 22:43:55 +00:00
Eelco Dolstra
765bdfe542 * When NIX_REMOTE is set to "slave", fork off nix-worker in slave 
mode.  Presumably nix-worker would be setuid to the Nix store user.
  The worker performs all operations on the Nix store and database, so
  the caller can be completely unprivileged.

  This is already much more secure than the old setuid scheme, since
  the worker doesn't need to do Nix expression evaluation and so on.
  Most importantly, this means that it doesn't need to access any user
  files, with all resulting security risks; it only performs pure
  store operations.

  Once this works, it is easy to move to a daemon model that forks off
  a worker for connections established through a Unix domain socket.
  That would be even more secure.
 2006-11-30 19:54:43 +00:00
Eelco Dolstra
40b3f64b55 * Skeleton of the privileged worker program. 
* Some refactoring: put the NAR archive integer/string serialisation
  code in a separate file so it can be reused by the worker protocol
  implementation.
 2006-11-30 19:19:59 +00:00
Eelco Dolstra
80b742dd52 * Don't spam. 2006-11-29 22:07:49 +00:00
Roy van den Broek
92417600a1 * Example script to set permissions for setuid operation. 2006-11-29 21:58:09 +00:00
Eelco Dolstra
71e867c5f5 * Remove --enable-setuid, --with-nix-user and --with-nix-group. 
Rather, setuid support is now always compiled in (at least on
  platforms that have the setresuid system call, e.g., Linux and
  FreeBSD), but it must enabled by chowning/chmodding the Nix
  binaries.
 2006-11-29 21:06:58 +00:00
Eelco Dolstra
c6a97e3b74 * Doh! Path sizes need to be computed recursively of course. 
(NIX-70)
 2006-11-24 20:24:14 +00:00
Eelco Dolstra
8478cd260f * readFile: don't overflow the stack on large files. 2006-10-30 11:56:09 +00:00
Eelco Dolstra
d7efd76394 * Big cleanup of the semantics of paths, strings, contexts, string 
concatenation and string coercion.  This was a big mess (see
  e.g. NIX-67).  Contexts are now folded into strings, so that they
  don't cause evaluation errors when they're not expected.  The
  semantics of paths has been clarified (see nixexpr-ast.def).
  toString() and coerceToString() have been merged.

  Semantic change: paths are now copied to the store when they're in a
  concatenation (and in most other situations - that's the
  formalisation of the meaning of a path).  So

    "foo " + ./bla

  evaluates to "foo /nix/store/hash...-bla", not "foo
  /path/to/current-dir/bla".  This prevents accidental impurities, and
  is more consistent with the treatment of derivation outputs, e.g.,
  `"foo " + bla' where `bla' is a derivation.  (Here `bla' would be
  replaced by the output path of `bla'.)
 2006-10-16 15:55:34 +00:00
Eelco Dolstra
4ad6fb7ea3 * Fix setuid builds. 2006-09-27 21:04:07 +00:00
Eelco Dolstra
0623359fbc * Print a better error message for wrong hashes (NIX-49). 2006-09-20 16:15:32 +00:00
Eelco Dolstra
bafc1690fc * Move setuid stuff to libutil. 
* Install libexpr header files.
 2006-09-04 22:55:28 +00:00
Eelco Dolstra
e5a6c09b12 * Install header files in /nix/include/nix. 2006-09-04 22:41:36 +00:00
Eelco Dolstra
4be5443882 * Remove unnecessary inclusions of aterm2.h. 2006-09-04 22:08:40 +00:00
Eelco Dolstra
2382a729e0 * Don't need extern "C". 2006-09-04 21:50:39 +00:00
Eelco Dolstra
75068e7d75 * Use a proper namespace. 
* Optimise header file usage a bit.
* Compile the parser as C++.
 2006-09-04 21:06:23 +00:00
Eelco Dolstra
aab8812732 * Store the Nix libraries in ${libdir}/nix instead of ${libdir}. 2006-09-04 15:12:24 +00:00
Eelco Dolstra
c25f688e23 * Doh! Doh! Doh! 2006-08-31 15:38:43 +00:00
Eelco Dolstra
354d58b3d7 * Better error checking. 2006-08-31 11:40:39 +00:00
Eelco Dolstra
2132d9ddeb * Fix the ~ operator. 2006-08-29 15:29:38 +00:00
Eelco Dolstra
8a6080eb14 * Refactoring. 2006-08-26 16:48:01 +00:00
Eelco Dolstra
3e8dccf6ab * Escape newlines in XML attributes to prevent them from being 
normalised away.
 2006-08-24 15:02:39 +00:00
Eelco Dolstra
18e4ac0fc6 * `nix-instantiate --{eval|parse}-only --xml': print an XML 
representation instead of an ATerm.
* Indent XML output.
 2006-08-16 10:32:30 +00:00
Eelco Dolstra
dcff8cdb76 * Weird issue on Cygwin with the include file order. 2006-08-04 16:01:26 +00:00
Eelco Dolstra
339e6f0e1d * `nix-env -q --xml': show query result in XML format for easier 
automated processing.
 2006-08-03 15:52:09 +00:00
Eelco Dolstra
0e267e2625 * `nix-instantiate --print-args': produce XML output so that the 
result can be used more easily by scripts.
 2006-08-03 14:49:57 +00:00
Eelco Dolstra
4750f6c5ed * Simple class for writing XML files. 2006-08-03 13:21:21 +00:00
Eelco Dolstra
c15f544356 * Call find-runtime-roots.pl from the garbage collector to prevent 
running applications etc. from being garbage collected.
 2006-07-20 12:17:25 +00:00
Eelco Dolstra
d51aede4af * Allow the canonical system name to be specified at runtime in the 
Nix config file.
 2006-07-06 15:30:37 +00:00
Eelco Dolstra
0e783e5579 * Write messages to stderr in a slightly more atomic way. Useful when 
there are several parallel processes.
 2006-06-19 14:37:35 +00:00
Eelco Dolstra
b454977909 * Fix for a problem with BSD's group ownership semantics when the user 
is not in the "wheel" group.
 2006-06-14 11:53:55 +00:00
Eelco Dolstra
d764409d97 * Some Cygwin fixes. 2006-05-24 13:23:20 +00:00
Eelco Dolstra
b5988004d6 * Support for srcdir != builddir (NIX-41). 2006-05-12 11:47:45 +00:00
Eelco Dolstra
9d72bf8835 * 64-bit compatibility fixes (for problems revealed by building on an Athlon 
64 running 64-bit SUSE).  A patched ATerm library is required to run Nix
  succesfully.
 2006-05-11 02:19:43 +00:00
Eelco Dolstra
c54287eafe * GCC 2.95 compatibility. 2006-05-08 15:15:13 +00:00
Eelco Dolstra
5cabd47394 * Allow function argument default values to refer to other arguments 
of the function.  Implements NIX-45.
 2006-05-08 12:52:47 +00:00
Eelco Dolstra
310e605995 * Show evaluation stats when NIX_SHOW_STATS=1. 2006-05-08 10:00:37 +00:00
Eelco Dolstra
0832956089 * Use the new ATermMap. 2006-05-04 12:21:08 +00:00
Eelco Dolstra
18c321308d * Ugh, printHash() was very inefficient because it used 
ostringstreams.  Around 11% of execution time was spent here (now
  it's 0.5%).
 2006-03-09 17:07:25 +00:00
Eelco Dolstra
9088dee9e2 * Some refactoring of the exception handling code so that we can catch 
Nix expression assertion failures.
 2006-03-08 14:11:19 +00:00
Eelco Dolstra
e136532800 * Ouch, parseHash32 was completely broken. All digits >= 4 were 
parsed as 4.

  For a moment I worried that printHash32 was broken, and that would
  have been really, *really* bad ;-)
 2006-03-01 17:59:08 +00:00
Eelco Dolstra
d6f586d0ea * Optional switch "--with-openssl=<PATH>" to use OpenSSL's 
implementations of MD5, SHA-1 and SHA-256.  The main benefit is that
  we get assembler-optimised implementations of MD5 and SHA-1 (though
  not SHA-256 (at least on x86), unfortunately).  OpenSSL's SHA-1
  implementation on Intel is twice as fast as ours.
 2006-02-13 19:52:43 +00:00
Eelco Dolstra
e8475bbd5b * Use a union. 2006-02-13 18:00:08 +00:00
Eelco Dolstra
8291f6d968 * bsdiff updated to 4.3. This makes Nix depend on libbz2. 2006-02-01 16:48:49 +00:00
Eelco Dolstra
5b527901ae * dirOf: return "/", not "", for paths in the root directory. Fixes NIX-26. 2006-01-09 14:52:46 +00:00
Eelco Dolstra
04be39734f * Resolve all symlink components in the location of the temporary 
build directory (TMPDIR, i.e., /tmp).  Fixes NIX-26.
 2006-01-08 17:16:03 +00:00
Eelco Dolstra
530b27df1e * `nix-store --gc' prints out the number of bytes freed on stdout 
(even when it is interrupted by a signal).
 2005-12-15 21:11:39 +00:00