From b5971baa4ff2e4487feed53339b310336a93bfda Mon Sep 17 00:00:00 2001 From: Emily Date: Thu, 31 Jul 2025 15:33:32 +0100 Subject: [PATCH] libstore: default to `/nix/var/nix/b` for `build-dir` MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The minimum build directory length on Darwin with default settings when we were still using `/tmp` was 22 bytes. Deriving build directory names from my local store, the median and mode were 43, the mean was around 44½, and the maximum was 127. The switch to `/nix/var/nix/builds` over `/tmp` added a 15 byte penalty, and the additional `/b` directory added another 2. Now that we use opaque build directory names, the length is 48, so we’re still at a ~3½–5 byte penalty over the previous status quo. This change brings us down to 43, matching the previous median. Note that these calculations do not take into account the fact that `/tmp` is a symbolic link to `/private/tmp` on Darwin. Anything that was canonicalizing paths would have had an additional 8 byte penalty in the previous status quo that is not applicable here, so we may already be ahead even without this change. If the more opaque directory name here is undesirable, then that factor could potentially help us squeeze by without. Alternatively, in combination with dropping the `/b` on Darwin we could use `/nix/var/nix/bld` or similar, but I feel that the paths in general are sufficiently opaque that it should be okay to go with the shorter option here. Given that some projects already had to reduce filename lengths to avoid this limit even before the recent changes, I think it is best to try and improve on the previous status quo. Note that `/nix/var/nix/builds` will unfortunately not be cleaned up on Darwin. However, we don’t clean up the directories inside it on Darwin anyway, so hopefully that’s okay for now? Closes: #913 Change-Id: I6a6a6964bffce7194bcddcaefb4c4a37569c7df5 --- doc/manual/rl-next/build-dir-mandatory.md | 12 ++++++++++++ lix/libstore/settings/build-dir.md | 6 +++--- misc/systemd/nix-daemon.conf.in | 4 +++- 3 files changed, 18 insertions(+), 4 deletions(-) create mode 100644 doc/manual/rl-next/build-dir-mandatory.md diff --git a/doc/manual/rl-next/build-dir-mandatory.md b/doc/manual/rl-next/build-dir-mandatory.md new file mode 100644 index 000000000..a4b92f4a8 --- /dev/null +++ b/doc/manual/rl-next/build-dir-mandatory.md @@ -0,0 +1,12 @@ +--- +synopsis: "`build-dir` no longer defaults to `temp-dir`" +cls: [3453] +category: "Fixes" +credits: [horrors] +--- + +The directory in which temporary build directories are created no longer defaults +to the value of the `temp-dir` setting to avoid builders making their directories +world-accessible. This behavior has been used to escape the build sandbox and can +cause build impurities even when not used maliciously. We now default to `builds` +in `NIX_STATE_DIR` (which is `/nix/var/nix/b` in the default configuration). diff --git a/lix/libstore/settings/build-dir.md b/lix/libstore/settings/build-dir.md index 738368622..020443f53 100644 --- a/lix/libstore/settings/build-dir.md +++ b/lix/libstore/settings/build-dir.md @@ -2,12 +2,12 @@ name: build-dir internalName: buildDir settingType: PathsSetting -defaultText: "`«nixStateDir»/builds`" -defaultExpr: nixStateDir + "/builds" +defaultText: "`«nixStateDir»/b`" +defaultExpr: nixStateDir + "/b" --- The directory on the host, in which derivations' temporary build directories are created. -If not set, Lix will use the `builds` subdirectory of its configured state directory. +If not set, Lix will use the `b` subdirectory of its configured state directory. Lix will create this directory automatically with suitable permissions if it does not exist, otherwise its permissions must allow all users to traverse the directory (i.e. it must have `o+x` set, in unix parlance) for non-sandboxed builds to work correctly. diff --git a/misc/systemd/nix-daemon.conf.in b/misc/systemd/nix-daemon.conf.in index a0ddc4019..ee8087d24 100644 --- a/misc/systemd/nix-daemon.conf.in +++ b/misc/systemd/nix-daemon.conf.in @@ -1,2 +1,4 @@ d @localstatedir@/nix/daemon-socket 0755 root root - - -d @localstatedir@/nix/builds 0755 root root 7d - +d @localstatedir@/nix/b 0755 root root 7d - +# TODO: Remove this after (at least) August 2026. +R! @localstatedir@/nix/builds - - - - -