tomberek

#!/usr/bin/env bash
# Test matrix for NixOS/nix #2596 fix: `allowed-uris` under `restrict-eval`
# should grant readFile/readDir/readFileType/pathExists/hashFile/import access,
# not just fetchers (fetchurl/fetchGit/fetchMercurial).
#
# Covers: leaf symlinks (inside/outside an allowed dir), ancestor/alias
# symlinks, both `allowed-uris` forms (bare path and file://), and the
# `import`-via-symlink case.
#
# Usage: adjust NIX below to point at your built `nix` binary, then run.

tomberek

allowed-uris fix for #2596: symlink/path-builtin test matrix + import bugfix repro

Test matrix (before / after)

Tested against built nix binaries before (pre-fix, commit 4306952f9) and after (fixed, commit deef692d6) the fix for NixOS/nix#2596 (allowed-uris not respected by readFile/readDir/etc. under restrict-eval), including two follow-up bugs found while testing symlink handling: grant-ordering relative to symlink resolution, and file://-form matching for path builtins.

tomberek

let
  some-derivation = derivation {
    name = "hello-world";
    system = "x86_64-linux";
    builder = "/bin/sh";
    args = ["-c" "echo hello world > $out"];
  };
  a = derivation {
  name = "something.nar";
  builder = "/bin/sh";

tomberek

#include <iostream>
#include <string>
#include <vector>
#include <cstring>
#include <unistd.h>
#include <sys/wait.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sched.h>

tomberek

# built with AI
package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
	"path/filepath"
	"strings"

tomberek

#!/usr/bin/env bash
# https://github.com/NixOS/nix/pull/11075
set -x

((NEW_NIX_FIRST_BUILD_UID=331))
((TEMP_NIX_FIRST_BUILD_UID=31000))

nix_user_n() {
	printf "_nixbld%d" "$1"
}

tomberek

{}

tomberek

Hi

tomberek

     default = {
          type = "app";
          program = with args.unstable.legacyPackages.x86_64-linux;
            (writeShellApplication {
              name = "hash-me.sh";
              runtimeInputs = [coreutils];
              text = ''
                self=$(echo ${self.outPath} | cut -d/ -f4)
                rev=${builtins.toString (self.revCount or 0)}
                lastMod=${builtins.toString (self.lastModified or 0)}

tomberek

...
08:36:47 read(3, "", 512)               = 0
08:36:47 newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=62, ...}, AT_EMPTY_PATH) = 0
08:36:47 close(3)                       = 0
08:36:47 openat(AT_FDCWD, "/nix/store/mij848h2x5wiqkwhg027byvmf9x3gx7y-glibc-2.33-50/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
08:36:47 openat(AT_FDCWD, "/nix/store/mij848h2x5wiqkwhg027byvmf9x3gx7y-glibc-2.33-50/lib/libnss_mymachines.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
08:36:47 openat(AT_FDCWD, "/nix/store/mij848h2x5wiqkwhg027byvmf9x3gx7y-glibc-2.33-50/lib/libnss_mdns_minimal.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
08:36:47 openat(AT_FDCWD, "/nix/store/mij848h2x5wiqkwhg027byvmf9x3gx7y-glibc-2.33-50/lib/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 3
08:36:47 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\3202\0\0\0\0\0\0"..., 832) = 832
08:36:47 newfstatat(3, "", {st_mode=S_IFREG|0555, st_size=56000, ...}, AT_EMPTY_PATH) = 0