Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updating to nix >=2.16 fails during tests #659

Open
Artturin opened this issue Nov 1, 2023 · 0 comments
Open

Updating to nix >=2.16 fails during tests #659

Artturin opened this issue Nov 1, 2023 · 0 comments

Comments

@Artturin
Copy link
Member

Artturin commented Nov 1, 2023

sandbox-violation = derivation {

---- nix::tests::strict_sandboxing stdout ----
thread 'nix::tests::strict_sandboxing' panicked at '

The run was expected to Fail, but did not.

   | this derivation will be built:
   |   /nix/store/ih4kj08w3x1vavdy40n08qis00ilrbjy-sandbox-violation.drv
   | building '/nix/store/ih4kj08w3x1vavdy40n08qis00ilrbjy-sandbox-violation.drv'...
   | /nix/store/002bqs9cx1zavfag41xngiih1f2ari27-sandbox-violation


0 out of 2 required lines matched.

 - Err("access to absolute path")
 - Err("is forbidden in restricted mode")
', ofborg/src/nix.rs:545:13
stack backtrace:
   0: rust_begin_unwind
   1: core::panicking::panic_fmt
   2: core::panicking::panic_display
             at /build/rustc-1.72.0-src/library/core/src/panicking.rs:150:5
   3: ofborg::nix::tests::assert_run
             at ./src/nix.rs:545:13
   4: ofborg::nix::tests::strict_sandboxing
             at ./src/nix.rs:848:9
   5: ofborg::nix::tests::strict_sandboxing::{{closure}}
             at ./src/nix.rs:841:28
   6: core::ops::function::FnOnce::call_once
             at /build/rustc-1.72.0-src/library/core/src/ops/function.rs:250:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

Can't repro locally

derivation {
  name = "sandbox-violation";
  system = builtins.currentSystem;
  src = ./../../../lib;
  builder = builtins.storePath <bash>;
  args = [ "-c" "echo hi; echo ${toString builtins.currentTime} > $out" ];
}

in depth0/depth1/depth3/default.nix in nixpkgs

$ nix shell "nixpkgs#nixVersions.nix_2_16" --command nix-build depth0/depth1/depth3/default.nix -I "bash=$(command -v bash)" --option restrict-eval true
error: access to absolute path '/home/artturin/nixgits/my-nixpkgs/depth0/depth1/depth3/default.nix' is forbidden in restricted mode
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant