aboutsummaryrefslogtreecommitdiff
path: root/src/nix
diff options
context:
space:
mode:
Diffstat (limited to 'src/nix')
-rw-r--r--src/nix/app.cc27
-rw-r--r--src/nix/bundle.cc1
-rw-r--r--src/nix/daemon.cc52
-rw-r--r--src/nix/develop.cc1
-rw-r--r--src/nix/diff-closures.cc2
-rw-r--r--src/nix/edit.cc1
-rw-r--r--src/nix/eval.cc4
-rw-r--r--src/nix/flake.cc1
-rw-r--r--src/nix/profile.cc1
-rw-r--r--src/nix/repl.cc95
-rw-r--r--src/nix/show-derivation.cc52
-rw-r--r--src/nix/why-depends.cc2
12 files changed, 149 insertions, 90 deletions
diff --git a/src/nix/app.cc b/src/nix/app.cc
index 08cd0ccd4..5cd65136f 100644
--- a/src/nix/app.cc
+++ b/src/nix/app.cc
@@ -1,4 +1,5 @@
#include "installables.hh"
+#include "installable-derived-path.hh"
#include "store-api.hh"
#include "eval-inline.hh"
#include "eval-cache.hh"
@@ -8,30 +9,6 @@
namespace nix {
-struct InstallableDerivedPath : Installable
-{
- ref<Store> store;
- const DerivedPath derivedPath;
-
- InstallableDerivedPath(ref<Store> store, const DerivedPath & derivedPath)
- : store(store)
- , derivedPath(derivedPath)
- {
- }
-
- std::string what() const override { return derivedPath.to_string(*store); }
-
- DerivedPathsWithInfo toDerivedPaths() override
- {
- return {{derivedPath}};
- }
-
- std::optional<StorePath> getStorePath() override
- {
- return std::nullopt;
- }
-};
-
/**
* Return the rewrites that are needed to resolve a string whose context is
* included in `dependencies`.
@@ -146,7 +123,7 @@ App UnresolvedApp::resolve(ref<Store> evalStore, ref<Store> store)
for (auto & ctxElt : unresolved.context)
installableContext.push_back(
- std::make_shared<InstallableDerivedPath>(store, ctxElt));
+ std::make_shared<InstallableDerivedPath>(store, DerivedPath { ctxElt }));
auto builtContext = Installable::build(evalStore, store, Realise::Outputs, installableContext);
res.program = resolveString(*store, unresolved.program, builtContext);
diff --git a/src/nix/bundle.cc b/src/nix/bundle.cc
index 6ae9460f6..dcf9a6f2d 100644
--- a/src/nix/bundle.cc
+++ b/src/nix/bundle.cc
@@ -1,4 +1,5 @@
#include "command.hh"
+#include "installable-flake.hh"
#include "common-args.hh"
#include "shared.hh"
#include "store-api.hh"
diff --git a/src/nix/daemon.cc b/src/nix/daemon.cc
index 19fbbf155..a22bccba1 100644
--- a/src/nix/daemon.cc
+++ b/src/nix/daemon.cc
@@ -34,6 +34,43 @@
using namespace nix;
using namespace nix::daemon;
+struct AuthorizationSettings : Config {
+
+ Setting<Strings> trustedUsers{
+ this, {"root"}, "trusted-users",
+ R"(
+ A list of names of users (separated by whitespace) that have
+ additional rights when connecting to the Nix daemon, such as the
+ ability to specify additional binary caches, or to import unsigned
+ NARs. You can also specify groups by prefixing them with `@`; for
+ instance, `@wheel` means all users in the `wheel` group. The default
+ is `root`.
+
+ > **Warning**
+ >
+ > Adding a user to `trusted-users` is essentially equivalent to
+ > giving that user root access to the system. For example, the user
+ > can set `sandbox-paths` and thereby obtain read access to
+ > directories that are otherwise inacessible to them.
+ )"};
+
+ /* ?Who we trust to use the daemon in safe ways */
+ Setting<Strings> allowedUsers{
+ this, {"*"}, "allowed-users",
+ R"(
+ A list of names of users (separated by whitespace) that are allowed
+ to connect to the Nix daemon. As with the `trusted-users` option,
+ you can specify groups by prefixing them with `@`. Also, you can
+ allow all users by specifying `*`. The default is `*`.
+
+ Note that trusted users are always allowed to connect.
+ )"};
+};
+
+AuthorizationSettings authorizationSettings;
+
+static GlobalConfig::Register rSettings(&authorizationSettings);
+
#ifndef __linux__
#define SPLICE_F_MOVE 0
static ssize_t splice(int fd_in, void *off_in, int fd_out, void *off_out, size_t len, unsigned int flags)
@@ -203,8 +240,8 @@ static void daemonLoop()
struct group * gr = peer.gidKnown ? getgrgid(peer.gid) : 0;
std::string group = gr ? gr->gr_name : std::to_string(peer.gid);
- Strings trustedUsers = settings.trustedUsers;
- Strings allowedUsers = settings.allowedUsers;
+ Strings trustedUsers = authorizationSettings.trustedUsers;
+ Strings allowedUsers = authorizationSettings.allowedUsers;
if (matchUser(user, group, trustedUsers))
trusted = Trusted;
@@ -241,14 +278,7 @@ static void daemonLoop()
// Handle the connection.
FdSource from(remote.get());
FdSink to(remote.get());
- processConnection(openUncachedStore(), from, to, trusted, NotRecursive, [&](Store & store) {
-#if 0
- /* Prevent users from doing something very dangerous. */
- if (geteuid() == 0 &&
- querySetting("build-users-group", "") == "")
- throw Error("if you run 'nix-daemon' as root, then you MUST set 'build-users-group'!");
-#endif
- });
+ processConnection(openUncachedStore(), from, to, trusted, NotRecursive);
exit(0);
}, options);
@@ -301,7 +331,7 @@ static void runDaemon(bool stdio)
/* Auth hook is empty because in this mode we blindly trust the
standard streams. Limiting access to those is explicitly
not `nix-daemon`'s responsibility. */
- processConnection(openUncachedStore(), from, to, Trusted, NotRecursive, [&](Store & _){});
+ processConnection(openUncachedStore(), from, to, Trusted, NotRecursive);
}
} else
daemonLoop();
diff --git a/src/nix/develop.cc b/src/nix/develop.cc
index 16bbd8613..9d07a7a85 100644
--- a/src/nix/develop.cc
+++ b/src/nix/develop.cc
@@ -1,5 +1,6 @@
#include "eval.hh"
#include "command.hh"
+#include "installable-flake.hh"
#include "common-args.hh"
#include "shared.hh"
#include "store-api.hh"
diff --git a/src/nix/diff-closures.cc b/src/nix/diff-closures.cc
index 0621d662c..3489cc132 100644
--- a/src/nix/diff-closures.cc
+++ b/src/nix/diff-closures.cc
@@ -106,7 +106,7 @@ void printClosureDiff(
using namespace nix;
-struct CmdDiffClosures : SourceExprCommand
+struct CmdDiffClosures : SourceExprCommand, MixOperateOnOptions
{
std::string _before, _after;
diff --git a/src/nix/edit.cc b/src/nix/edit.cc
index 76a134b1f..dfe75fbdf 100644
--- a/src/nix/edit.cc
+++ b/src/nix/edit.cc
@@ -3,6 +3,7 @@
#include "eval.hh"
#include "attr-path.hh"
#include "progress-bar.hh"
+#include "editor-for.hh"
#include <unistd.h>
diff --git a/src/nix/eval.cc b/src/nix/eval.cc
index ccee074e9..a579213fd 100644
--- a/src/nix/eval.cc
+++ b/src/nix/eval.cc
@@ -11,13 +11,13 @@
using namespace nix;
-struct CmdEval : MixJSON, InstallableCommand
+struct CmdEval : MixJSON, InstallableCommand, MixReadOnlyOption
{
bool raw = false;
std::optional<std::string> apply;
std::optional<Path> writeTo;
- CmdEval() : InstallableCommand(true /* supportReadOnlyMode */)
+ CmdEval() : InstallableCommand()
{
addFlag({
.longName = "raw",
diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index c025bc7a6..053a9c9e1 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -1,4 +1,5 @@
#include "command.hh"
+#include "installable-flake.hh"
#include "common-args.hh"
#include "shared.hh"
#include "eval.hh"
diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index e552e8975..28c7fe32d 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -1,4 +1,5 @@
#include "command.hh"
+#include "installable-flake.hh"
#include "common-args.hh"
#include "shared.hh"
#include "store-api.hh"
diff --git a/src/nix/repl.cc b/src/nix/repl.cc
new file mode 100644
index 000000000..679bdea77
--- /dev/null
+++ b/src/nix/repl.cc
@@ -0,0 +1,95 @@
+#include "eval.hh"
+#include "globals.hh"
+#include "command.hh"
+#include "repl.hh"
+
+namespace nix {
+
+struct CmdRepl : InstallablesCommand
+{
+ CmdRepl() {
+ evalSettings.pureEval = false;
+ }
+
+ void prepare() override
+ {
+ if (!settings.isExperimentalFeatureEnabled(Xp::ReplFlake) && !(file) && this->_installables.size() >= 1) {
+ warn("future versions of Nix will require using `--file` to load a file");
+ if (this->_installables.size() > 1)
+ warn("more than one input file is not currently supported");
+ auto filePath = this->_installables[0].data();
+ file = std::optional(filePath);
+ _installables.front() = _installables.back();
+ _installables.pop_back();
+ }
+ installables = InstallablesCommand::load();
+ }
+
+ std::vector<std::string> files;
+
+ Strings getDefaultFlakeAttrPaths() override
+ {
+ return {""};
+ }
+
+ bool useDefaultInstallables() override
+ {
+ return file.has_value() or expr.has_value();
+ }
+
+ bool forceImpureByDefault() override
+ {
+ return true;
+ }
+
+ std::string description() override
+ {
+ return "start an interactive environment for evaluating Nix expressions";
+ }
+
+ std::string doc() override
+ {
+ return
+ #include "repl.md"
+ ;
+ }
+
+ void run(ref<Store> store) override
+ {
+ auto state = getEvalState();
+ auto getValues = [&]()->AbstractNixRepl::AnnotatedValues{
+ auto installables = load();
+ AbstractNixRepl::AnnotatedValues values;
+ for (auto & installable: installables){
+ auto what = installable->what();
+ if (file){
+ auto [val, pos] = installable->toValue(*state);
+ auto what = installable->what();
+ state->forceValue(*val, pos);
+ auto autoArgs = getAutoArgs(*state);
+ auto valPost = state->allocValue();
+ state->autoCallFunction(*autoArgs, *val, *valPost);
+ state->forceValue(*valPost, pos);
+ values.push_back( {valPost, what });
+ } else {
+ auto [val, pos] = installable->toValue(*state);
+ values.push_back( {val, what} );
+ }
+ }
+ return values;
+ };
+ auto repl = AbstractNixRepl::create(
+ searchPath,
+ openStore(),
+ state,
+ getValues
+ );
+ repl->autoArgs = getAutoArgs(*repl->state);
+ repl->initEnv();
+ repl->mainLoop();
+ }
+};
+
+static auto rCmdRepl = registerCommand<CmdRepl>("repl");
+
+}
diff --git a/src/nix/show-derivation.cc b/src/nix/show-derivation.cc
index af2e676a4..d1a516cad 100644
--- a/src/nix/show-derivation.cc
+++ b/src/nix/show-derivation.cc
@@ -54,56 +54,8 @@ struct CmdShowDerivation : InstallablesCommand
for (auto & drvPath : drvPaths) {
if (!drvPath.isDerivation()) continue;
- json& drvObj = jsonRoot[store->printStorePath(drvPath)];
-
- auto drv = store->readDerivation(drvPath);
-
- {
- json& outputsObj = drvObj["outputs"];
- outputsObj = json::object();
- for (auto & [_outputName, output] : drv.outputs) {
- auto & outputName = _outputName; // work around clang bug
- auto& outputObj = outputsObj[outputName];
- outputObj = json::object();
- std::visit(overloaded {
- [&](const DerivationOutput::InputAddressed & doi) {
- outputObj["path"] = store->printStorePath(doi.path);
- },
- [&](const DerivationOutput::CAFixed & dof) {
- outputObj["path"] = store->printStorePath(dof.path(*store, drv.name, outputName));
- outputObj["hashAlgo"] = dof.hash.printMethodAlgo();
- outputObj["hash"] = dof.hash.hash.to_string(Base16, false);
- },
- [&](const DerivationOutput::CAFloating & dof) {
- outputObj["hashAlgo"] = makeFileIngestionPrefix(dof.method) + printHashType(dof.hashType);
- },
- [&](const DerivationOutput::Deferred &) {},
- [&](const DerivationOutput::Impure & doi) {
- outputObj["hashAlgo"] = makeFileIngestionPrefix(doi.method) + printHashType(doi.hashType);
- outputObj["impure"] = true;
- },
- }, output.raw());
- }
- }
-
- {
- auto& inputsList = drvObj["inputSrcs"];
- inputsList = json::array();
- for (auto & input : drv.inputSrcs)
- inputsList.emplace_back(store->printStorePath(input));
- }
-
- {
- auto& inputDrvsObj = drvObj["inputDrvs"];
- inputDrvsObj = json::object();
- for (auto & input : drv.inputDrvs)
- inputDrvsObj[store->printStorePath(input.first)] = input.second;
- }
-
- drvObj["system"] = drv.platform;
- drvObj["builder"] = drv.builder;
- drvObj["args"] = drv.args;
- drvObj["env"] = drv.env;
+ jsonRoot[store->printStorePath(drvPath)] =
+ store->readDerivation(drvPath).toJSON(*store);
}
std::cout << jsonRoot.dump(2) << std::endl;
}
diff --git a/src/nix/why-depends.cc b/src/nix/why-depends.cc
index 76125e5e4..a3a9dc698 100644
--- a/src/nix/why-depends.cc
+++ b/src/nix/why-depends.cc
@@ -27,7 +27,7 @@ static std::string filterPrintable(const std::string & s)
return res;
}
-struct CmdWhyDepends : SourceExprCommand
+struct CmdWhyDepends : SourceExprCommand, MixOperateOnOptions
{
std::string _package, _dependency;
bool all = false;
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 10:49:53 +0000