diff options
| author | Jade Lovelace <lix@jade.fyi> | 2024-06-10 19:55:40 -0700 |
|---|---|---|
| committer | Jade Lovelace <lix@jade.fyi> | 2024-06-12 15:34:23 -0700 |
| commit | 5f6eb6eb446d911228e830f45edb8ced8413bb58 (patch) | |
| tree | 5f62581234bde47f9525da70950724526818392e /src/nix | |
| parent | d9345d8836d295a205eab19ce9e969bcc9a35b42 (diff) | |
doc: rewrite the multi-user documentation to actually talk about security
It's in the security section, and it was totally outdated anyway.
I took the opportunity to write down the stuff we already believed.
Change-Id: I73e62ae85a82dad13ef846e31f377c3efce13cb0
Diffstat (limited to 'src/nix')
| -rw-r--r-- | src/nix/flake.md | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/src/nix/flake.md b/src/nix/flake.md index 9188bca74..8f0163717 100644 --- a/src/nix/flake.md +++ b/src/nix/flake.md @@ -394,15 +394,17 @@ The following attributes are supported in `flake.nix`: value (e.g. `packages.x86_64-linux` must be an attribute set of derivations built for the `x86_64-linux` platform). -* `nixConfig`: a set of `nix.conf` options to be set when evaluating any - part of a flake. In the interests of security, only a small set of - set of options is allowed to be set without confirmation so long as [`accept-flake-config`](@docroot@/command-ref/conf-file.md#conf-accept-flake-config) is not enabled in the global configuration: +* `nixConfig`: a set of `nix.conf` options to be set when evaluating any part of a flake. + This attribute is only considered if the flake is at top-level (i.e. if it is passed directly to `nix build`, `nix run`, etc, rather than as an input of another flake). + In the interests of security, only a small set of set of options is allowed to be set without confirmation so long as [`accept-flake-config`](@docroot@/command-ref/conf-file.md#conf-accept-flake-config) is not enabled in the global configuration: - [`bash-prompt`](@docroot@/command-ref/conf-file.md#conf-bash-prompt) - [`bash-prompt-prefix`](@docroot@/command-ref/conf-file.md#conf-bash-prompt-prefix) - [`bash-prompt-suffix`](@docroot@/command-ref/conf-file.md#conf-bash-prompt-suffix) - [`flake-registry`](@docroot@/command-ref/conf-file.md#conf-flake-registry) - [`commit-lockfile-summary`](@docroot@/command-ref/conf-file.md#conf-commit-lockfile-summary) + For the avoidance of doubt, setting `accept-flake-config` in `nix.conf` or passing `--accept-flake-config` *allows root access to your machine* if you are running as a trusted user and don't read `nixConfig` in every flake you build. + ## Flake inputs The attribute `inputs` specifies the dependencies of a flake, as an |