lix -

Age	Commit message (Collapse)	Author
2015-04-07	Revert /nix/store permission back to 01775	Eelco Dolstra
	This broke NixOS VM tests. Mostly reverts 27b7b94923d2f207781b438bb7a57669bddf7d2b, 5ce50cd99e740d0d0f18c30327ae687be9356553, afa433e58c3fe6029660a43fdc2073c9d15b4210.
2015-04-02	Chroot builds: Provide world-readable /nix/store	Eelco Dolstra
	This was causing NixOS VM tests to fail mysteriously since 5ce50cd99e740d0d0f18c30327ae687be9356553. Nscd could (sometimes) no longer read /etc/hosts: open("/etc/hosts", O_RDONLY\|O_CLOEXEC) = -1 EACCES (Permission denied) Probably there was some wacky interaction between the guest kernel and the 9pfs implementation in QEMU.
2015-03-25	addToStore(): Take explicit name argument	Eelco Dolstra

2015-03-24	Improve setting the default chroot dirs	Eelco Dolstra

2015-03-24	Add the closure of store paths to the chroot	Eelco Dolstra
	Thus, for example, to get /bin/sh in a chroot, you only need to specify /bin/sh=${pkgs.bash}/bin/sh in build-chroot-dirs. The dependencies of sh will be added automatically.
2015-03-24	Tighten permissions on chroot directories	Eelco Dolstra

2015-03-06	Fix typos: s/the the/the/	Daniel Hahler

2015-03-04	Don't use vfork() before clone()	Eelco Dolstra
	I'm seeing hangs in Glibc's setxid_mark_thread() again. This is probably because the use of an intermediate process to make clone() safe from a multi-threaded program (see 524f89f1399724e596f61faba2c6861b1bb7b9c5) is defeated by the use of vfork(), since the intermediate process will have a copy of Glibc's threading data structures due to the vfork(). So use a regular fork() again.
2015-03-03	Merge branch 'allow-system-library' of git://github.com/copumpkin/nix	Shea Levy
	Make the default impure prefix include all of /System/Library
2015-03-02	Make the default impure prefix (not actual allowed impurities!) include all ↵	Dan Peebles
	of /System/Library, since we also want PrivateFrameworks from there and (briefly) TextEncodings, and who knows what else. Yay infectious impurities?
2015-03-02	Allow local networking in the darwin sandbox to appease tests	Dan Peebles

2015-02-23	More graceful fallback for chroots on Linux < 2.13	Eelco Dolstra

2015-02-23	Use chroots for all derivations	Eelco Dolstra
	If ‘build-use-chroot’ is set to ‘true’, fixed-output derivations are now also chrooted. However, unlike normal derivations, they don't get a private network namespace, so they can still access the network. Also, the use of the ‘__noChroot’ derivation attribute is no longer allowed. Setting ‘build-use-chroot’ to ‘relaxed’ gives the old behaviour.
2015-02-17	Use $<attr>Path instead of $<attr> for passAsFile	Eelco Dolstra

2015-02-17	Allow passing attributes via files instead of environment variables	Eelco Dolstra
	Closes #473.
2015-02-16	Use pivot_root in addition to chroot when possible	Harald van Dijk
	chroot only changes the process root directory, not the mount namespace root directory, and it is well-known that any process with chroot capability can break out of a chroot "jail". By using pivot_root as well, and unmounting the original mount namespace root directory, breaking out becomes impossible. Non-root processes typically have no ability to use chroot() anyway, but they can gain that capability through the use of clone() or unshare(). For security reasons, these syscalls are limited in functionality when used inside a normal chroot environment. Using pivot_root() this way does allow those syscalls to be put to their full use.
2015-02-04	Require linux 3.13 or later for chroot	Shea Levy
	Fixes #453
2015-01-18	Make inputs writeable in the sandbox (builds still can’t actually write ↵	Daniel Peebles
	due to user permissions)
2015-01-13	Allow using /bin and /usr/bin as impure prefixes on non-darwin by default	Shea Levy
	These directories are generally world-readable anyway, and give us the two most common linux impurities (env and sh)
2015-01-13	SysError -> Error	Eelco Dolstra

2015-01-13	Don't resolve symlinks while checking __impureHostDeps	Eelco Dolstra
	Since these come from untrusted users, we shouldn't do any I/O on them before we've checked that they're in an allowed prefix.
2015-01-12	Add basic Apple sandbox support	Daniel Peebles

2015-01-08	Doh^2	Eelco Dolstra

2015-01-08	Doh	Eelco Dolstra

2015-01-08	Set /nix/store permission to 1737	Eelco Dolstra
	I.e., not readable to the nixbld group. This improves purity a bit for non-chroot builds, because it prevents a builder from enumerating store paths (i.e. it can only access paths it knows about).
2015-01-06	Fix building on Darwin	Eelco Dolstra
	Fixes #433.
2014-12-29	LocalStore initialization: Don't die if build-users-group doesn't exist	Shea Levy
	See NixOS/nixpkgs@9245516
2014-12-23	Revive running builds in a PID namespace	Eelco Dolstra

2014-12-14	Pedantry	Eelco Dolstra

2014-12-14	Merge branch 'cygwin-master' of https://github.com/ternaris/nix	Eelco Dolstra

2014-12-13	Better error message	Eelco Dolstra

2014-12-12	Silence some warnings on GCC 4.9	Eelco Dolstra

2014-12-12	Shut up a Valgrind warning	Eelco Dolstra

2014-12-12	Fix some memory leaks	Eelco Dolstra

2014-12-12	Ensure we're writing to stderr in the builder	Eelco Dolstra
	http://hydra.nixos.org/build/17862041
2014-12-12	Remove chatty message	Eelco Dolstra
	This broke building with "-vv", because the builder is not allowed to write to stderr at this point.
2014-12-12	Doh	Eelco Dolstra

2014-12-10	Don't do vfork in conjunction with setuid	Eelco Dolstra

2014-12-10	Rename function	Eelco Dolstra

2014-12-10	Don't wait for PID -1	Eelco Dolstra
	The pid field can be -1 if forking the substituter process failed.
2014-12-09	Explicitly include required C headers	Marko Durkovic

2014-11-24	Build derivations in a more predictable order	Eelco Dolstra
	Derivations are now built in order of derivation name, so a package named "aardvark" is built before "baboon". Fixes #399.
2014-11-24	Don't create unnecessary substitution goals for derivations	Eelco Dolstra

2014-11-19	Disable vacuuming the DB after garbage collection	Eelco Dolstra
	Especially in WAL mode on a highly loaded machine, this is not a good idea because it results in a WAL file of approximately the same size ad the database, which apparently cannot be deleted while anybody is accessing it.
2014-11-19	Clean up temp roots in a more C++ way	Eelco Dolstra

2014-11-17	Fix message	Eelco Dolstra

2014-11-14	Don't use ADDR_LIMIT_3GB	Eelco Dolstra
	This gives 32-bit builds on x86_64-linux more memory.
2014-11-12	Make ~DerivationGoal more reliable	Eelco Dolstra

2014-11-04	nix-store --gc: Don't warn about missing manifests directory	Eelco Dolstra

2014-10-31	Improve error message if the daemon worker fails to start	Eelco Dolstra