libstore: default to /nix/var/nix/b for build-dir

The minimum build directory length on Darwin with default settings
when we were still using `/tmp` was 22 bytes. Deriving build directory
names from my local store, the median and mode were 43, the mean was
around 44½, and the maximum was 127.

The switch to `/nix/var/nix/builds` over `/tmp` added a 15 byte
penalty, and the additional `/b` directory added another 2.

Now that we use opaque build directory names, the length is 48, so
we’re still at a ~3½–5 byte penalty over the previous status
quo. This change brings us down to 43, matching the previous median.

Note that these calculations do not take into account the fact that
`/tmp` is a symbolic link to `/private/tmp` on Darwin. Anything
that was canonicalizing paths would have had an additional 8 byte
penalty in the previous status quo that is not applicable here,
so we may already be ahead even without this change. If the more
opaque directory name here is undesirable, then that factor could
potentially help us squeeze by without. Alternatively, in combination
with dropping the `/b` on Darwin we could use `/nix/var/nix/bld` or
similar, but I feel that the paths in general are sufficiently opaque
that it should be okay to go with the shorter option here. Given that
some projects already had to reduce filename lengths to avoid this
limit even before the recent changes, I think it is best to try and
improve on the previous status quo.

Note that `/nix/var/nix/builds` will unfortunately not be cleaned up
on Darwin. However, we don’t clean up the directories inside it on
Darwin anyway, so hopefully that’s okay for now?

Closes: #913
Change-Id: I6a6a6964bffce7194bcddcaefb4c4a37569c7df5

doc/manual/rl-next/build-dir-mandatory.md

@@ -0,0 +1,12 @@
+---
+synopsis: "`build-dir` no longer defaults to `temp-dir`"
+cls: [3453]
+category: "Fixes"
+credits: [horrors]
+---
+
+The directory in which temporary build directories are created no longer defaults
+to the value of the `temp-dir` setting to avoid builders making their directories
+world-accessible. This behavior has been used to escape the build sandbox and can
+cause build impurities even when not used maliciously. We now default to `builds`
+in `NIX_STATE_DIR` (which is `/nix/var/nix/b` in the default configuration).

lix/libstore/settings/build-dir.md

@@ -2,12 +2,12 @@
 name: build-dir
 internalName: buildDir
 settingType: PathsSetting<Path>
-defaultText: "`«nixStateDir»/builds`"
-defaultExpr: nixStateDir + "/builds"
+defaultText: "`«nixStateDir»/b`"
+defaultExpr: nixStateDir + "/b"
 ---
 The directory on the host, in which derivations' temporary build directories are created.
 
-If not set, Lix will use the `builds` subdirectory of its configured state directory.
+If not set, Lix will use the `b` subdirectory of its configured state directory.
 Lix will create this directory automatically with suitable permissions if it does not
 exist, otherwise its permissions must allow all users to traverse the directory (i.e.
 it must have `o+x` set, in unix parlance) for non-sandboxed builds to work correctly.

misc/systemd/nix-daemon.conf.in

@@ -1,2 +1,4 @@
 d @localstatedir@/nix/daemon-socket 0755 root root -  -
-d @localstatedir@/nix/builds        0755 root root 7d -
+d @localstatedir@/nix/b             0755 root root 7d -
+# TODO: Remove this after (at least) August 2026.
+R! @localstatedir@/nix/builds       -    -    -    -  -