GNU bug report logs - #75810
[PATCH 0/6] Rootless guix-daemon

Previous Next

Full log

Message #382 received at 75810 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: 75810 <at> debbugs.gnu.org
Cc: Ludovic Courtès <ludo <at> gnu.org>
Subject: [PATCH v7 10/16] daemon: Move comments where they belong.
Date: Thu, 20 Mar 2025 21:54:43 +0100

* nix/libstore/build.cc (DerivationGoal::startBuilder): Shuffle
comments for clarity.

Change-Id: I6557c103ade4a3ab046354548ea193c68f8c9c05
---
 nix/libstore/build.cc | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/nix/libstore/build.cc b/nix/libstore/build.cc
index fa0f293aac..1733322316 100644
--- a/nix/libstore/build.cc
+++ b/nix/libstore/build.cc
@@ -1870,18 +1870,19 @@ void DerivationGoal::startBuilder()
         }
         dirsInChroot[tmpDirInSandbox] = tmpDir;
 
-        /* Make the closure of the inputs available in the chroot,
-           rather than the whole store.  This prevents any access
-           to undeclared dependencies.  !!! As an extra security
-           precaution, make the fake store only writable by the
-           build user. */
+	/* Create the fake store.  */
         Path chrootStoreDir = chrootRootDir + settings.nixStore;
         createDirs(chrootStoreDir);
         chmod_(chrootStoreDir, 01775);
 
         if (buildUser.enabled() && chown(chrootStoreDir.c_str(), 0, buildUser.getGID()) == -1)
-            throw SysError(format("cannot change ownership of ‘%1%’") % chrootStoreDir);
+	     /* As an extra security precaution, make the fake store only
+		writable by the build user.  */
+	     throw SysError(format("cannot change ownership of ‘%1%’") % chrootStoreDir);
 
+        /* Make the closure of the inputs available in the chroot, rather than
+           the whole store.  This prevents any access to undeclared
+           dependencies. */
         foreach (PathSet::iterator, i, inputPaths) {
 	    struct stat st;
             if (lstat(i->c_str(), &st))
-- 
2.48.1

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.