From 62519f8d831268c474e7339d6e0e2cd6a5aeaf3e Mon Sep 17 00:00:00 2001
From: Raito Bezarius <raito@lix.systems>
Date: Fri, 2 Jan 2026 21:09:21 +0100
Subject: [PATCH] libstore/local-store: remove xattrs all the time

xattrs scrubbing was gated behind Linux platforms, but Lix can safely
assume that POSIX APIs are available.

macOS implements these APIs modulo some creative ideas.

Fixes #1008.

Change-Id: I1566df4923bf24092d3fd32ccf6a96e4256e87b2
Signed-off-by: Raito Bezarius <raito@lix.systems>
---
 lix/libstore/local-store.cc           |  4 +---
 lix/libstore/settings/ignored-acls.md |  9 +++++++--
 lix/libutil/c-calls.cc                | 17 +++++++++++++++++
 lix/libutil/c-calls.hh                |  2 +-
 4 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/lix/libstore/local-store.cc b/lix/libstore/local-store.cc
index 8e854111a..4b0180815 100644
--- a/lix/libstore/local-store.cc
+++ b/lix/libstore/local-store.cc
@@ -544,7 +544,6 @@ static void canonicalisePathMetaData_(
         return;
     }
 
-#if __linux__
     /* Remove extended attributes / ACLs. */
     ssize_t eaSize = sys::llistxattr(path, nullptr, 0);
 
@@ -573,8 +572,7 @@ static void canonicalisePathMetaData_(
             (void) sys::chmod(path, st.st_mode);
             resetMode = false;
         }
-     }
-#endif
+    }
 
     inodesSeen.insert(Inode(st.st_dev, st.st_ino));
 
diff --git a/lix/libstore/settings/ignored-acls.md b/lix/libstore/settings/ignored-acls.md
index 825426d0d..4b8fc444e 100644
--- a/lix/libstore/settings/ignored-acls.md
+++ b/lix/libstore/settings/ignored-acls.md
@@ -1,9 +1,14 @@
 ---
 name: ignored-acls
 internalName: ignoredAcls
-platforms: [linux]
 type: StringSet
-default: [security.csm, security.selinux, system.nfs4_acl]
+defaultExpr: |
+  #if __linux__
+    {"security.csm", "security.selinux", "system.nfs4_acl"}
+  #else
+    {}
+  #endif
+defaultText: '*Linux:* `security.csm, security.selinux, system.nfs4_acl`, *other platforms:* nothing.'
 ---
 A list of ACLs that should be ignored, normally Lix attempts to
 remove all ACLs from files and directories in the Nix store, but
diff --git a/lix/libutil/c-calls.cc b/lix/libutil/c-calls.cc
index bfc851849..545570479 100644
--- a/lix/libutil/c-calls.cc
+++ b/lix/libutil/c-calls.cc
@@ -187,6 +187,23 @@ ssize_t getxattr(const std::string & path, const std::string & name, void * valu
 }
 #endif
 
+#if __APPLE__
+ssize_t llistxattr(const std::string & path, char * list, size_t size)
+{
+    return ::listxattr(requireCString(path), list, size, XATTR_NOFOLLOW);
+}
+
+ssize_t lremovexattr(const std::string & path, const std::string & name)
+{
+    return ::removexattr(requireCString(path), requireCString(name), XATTR_NOFOLLOW);
+}
+
+ssize_t getxattr(const std::string & path, const std::string & name, void * value, size_t size)
+{
+    return ::getxattr(requireCString(path), requireCString(name), value, size, 0, XATTR_NOFOLLOW);
+}
+#endif
+
 int chdir(const std::string & path)
 {
     return ::chdir(requireCString(path));
diff --git a/lix/libutil/c-calls.hh b/lix/libutil/c-calls.hh
index 8e9bccdfb..4fc520302 100644
--- a/lix/libutil/c-calls.hh
+++ b/lix/libutil/c-calls.hh
@@ -113,6 +113,7 @@ int mount(
     unsigned long mountflags,
     const void * data
 );
+#endif
 
 [[nodiscard]]
 ssize_t llistxattr(const std::string & path, char * list, size_t size);
@@ -122,7 +123,6 @@ ssize_t lremovexattr(const std::string & path, const std::string & name);
 
 [[nodiscard]]
 ssize_t getxattr(const std::string & path, const std::string & name, void * value, size_t size);
-#endif
 
 [[nodiscard]]
 int chdir(const std::string & path);