release: 2.93.3 "Bici Bici"

Release produced with releng/create_release.xsh

Change-Id: I49a2c0c8bd79e864809b64d4c8d2b0049d570c02

doc/manual/rl-next/deprecated-derivation-types.md

@@ -1,16 +0,0 @@
----
-synopsis: Deprecation of CA derivations, dynamic derivations, and impure derivations
-issues: [fj#815]
-cls: []
-significance: significant
-category: Miscellany
-credits: []
----
-
-Content-addressed derivations are now deprecated and slated for removal in Lix 2.94.
-We're doing this because the CA derivation system has been a known cause of problems
-and inconsistencies, is unmaintained, habitually makes improving the store code very
-difficult (or blocks such improvements outright), and is beset by a number of design
-flaws that in our opinion cannot be fixed without a full reimplementation from zero.
-Dynamic derivations and impure derivations are built on the CA derivation framework,
-and owing to this they too are deprecated and slated for removal in another release.

doc/manual/rl-next/reliance-on-bash-for-ssh.md

@@ -1,21 +0,0 @@
----
-synopsis: Remove reliance on Bash for remote stores via SSH
-issues: [fj#830, fj#805, fj#304]
-cls: [3159]
-category: "Fixes"
-credits: [raito]
----
-
-The pre-flight `echo started` handshake -- added years ago to catch race conditions -- has been removed.
-
-After removal of connection sharing in Lix 2.93, it required a Bash-compatible shell and a standard `echo`, so it failed on:
-
-  * builders protected by `ForceCommand` wrappers (e.g. `nix-remote-build`),
-  * BusyBox / initrd images with no Bash,
-  * hosts using non-POSIX shells such as Nushell.
-
-The race the probe once addressed was tied to SSH connection-sharing -- since connection-sharing code has already been removed, the probe is now pointless.
-
-Real connection or protocol errors are now left to SSH/Nix to report directly.
-
-This is technically a breaking change if you had scripts that relied on the literal "started" which needs to be updated to rely on other signals, e.g., exit codes.

doc/manual/src/release-notes/rl-2.93.md

@@ -1,4 +1,159 @@
 # Lix 2.93 "Bici Bici" (2025-05-09)
+# Lix 2.93.3 (2025-07-22)
+## Improvements
+
+- `--keep-failed` chowns the build directory to the user that request the build [cl/3678](https://gerrit.lix.systems/c/lix/+/3678)
+
+  Running a build with `--keep-failed` now chowns the temporary directory from the
+  builder user and group to the user that request the build if the build came from
+  a local user connected to the daemon. This makes inspecting failed derivations a
+  lot easier. On Linux the build directory made visible to the user will not be in
+  the same path as it was in the sandbox and continuing builds will usually break.
+
+  Many thanks to [eldritch horrors](https://git.lix.systems/pennae) for this.
+
+
+
+
+# Lix 2.93.2 (2025-06-30)
+## Fixes
+
+- Revert CVE-2025-52992 failed mitigation [fj#883](https://git.lix.systems/lix-project/lix/issues/883) [fj#887](https://git.lix.systems/lix-project/lix/issues/887) [cl/3444](https://gerrit.lix.systems/c/lix/+/3444) [cl/3528](https://gerrit.lix.systems/c/lix/+/3528)
+
+  Following the initial mitigation of **CVE-2025-52992** in `cl/3444`, we
+  received reports of **unexpected deletion of in-use store paths**.
+
+  Upon investigation, we found that the patch did **not correctly cancel all
+  automatic deleters**, resulting in potentially critical path loss during normal
+  operation.
+
+  Given the severity and time-sensitive nature of the situation ([see incident
+  report](https://lix.systems/blog/2025-06-27-lix-critical-bug/)), we evaluated
+  possible options to repair the behavior safely. However, we concluded that a
+  rushed fix would either
+
+  * **Overdelete**, i.e. breaking running systems, or,
+  * **Underdelete**, effectively **reopening CVE-2025-52992** while leaving
+    orphaned paths behind.
+
+  As **CVE-2025-52992 has no known exploit vector**, and correctness is critical
+  in the Lix project, we have **fully reverted the previous mitigations**.
+
+  The affected patches (`cl/3444`) have been rolled back for the time being.
+
+  Moving forward, the Lix team will rework this code path in a **long-term,
+  correctness-first fix** on the main branch. We will explore backporting it to
+  stable channels once its safety is assured.
+
+  We are deeply sorry for the stability incident and the Lix team remain
+  available for assisting you in recovering your systems.
+
+  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) and [eldritch horrors](https://git.lix.systems/pennae) for this.
+
+- Fallback to safe temp dir when build-dir is unwritable [fj#876](https://git.lix.systems/lix-project/lix/issues/876) [cl/3501](https://gerrit.lix.systems/c/lix/+/3501)
+
+  Non-daemon builds started failing with a permission error after introducing the `build-dir` option:
+
+  ```
+  $ nix build --store ~/scratch nixpkgs#hello --rebuild
+  error: creating directory '/nix/var/nix/builds/nix-build-hello-2.12.2.drv-0': Permission denied
+  ```
+
+  This happens because:
+
+  1. These builds are not run via the daemon, which owns `/nix/var/nix/builds`.
+  2. The user lacks permissions for that path.
+
+  We considered making `build-dir` a store-level option and defaulting it to `<chroot-root>/nix/var/nix/builds` for chroot stores, but opted instead for a fallback: if the default fails, Nix now creates a safe build directory under `/tmp`.
+
+  To avoid CVE-2025-52991, the fallback uses an extra path component between `/tmp` and the build dir.
+
+  **Note**: this fallback clutters `/tmp` with build directories that are not cleaned up. To prevent this, explicitly set `build-dir` to a path managed by Lix, even for local workloads.
+
+  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) and [eldritch horrors](https://git.lix.systems/pennae) for this.
+
+
+
+
+# Lix 2.93.1 (2025-06-23)
+## Breaking Changes
+
+- Fixed output derivations can be run using `pasta` network isolation [fj#285](https://git.lix.systems/lix-project/lix/issues/285) [cl/3442](https://gerrit.lix.systems/c/lix/+/3442)
+
+  Fixed output derivations traditionally run in the host network namespace.
+  On Linux this allows such derivations to communicate with other sandboxes
+  or the host using the abstract Unix domains socket namespace; this hasn't
+  been unproblematic in the past and has been used in two distinct exploits
+  to break out of the sandbox. For this reason fixed output derivations can
+  now run in a network namespace (provided by [`pasta`]), restricted to TCP
+  and UDP communication with the rest of the world. When enabled this could
+  be a breaking change and we classify it as such, even though we don't yet
+  enable or require such isolation by default. We may enforce this in later
+  releases of Lix once we have sufficient confidence that breakage is rare.
+
+  [`pasta`]: https://passt.top/
+
+  Many thanks to [eldritch horrors](https://git.lix.systems/pennae) and [puck](https://git.lix.systems/puck) for this.
+
+
+## Fixes
+
+- Always clean up scratch paths after derivations failed to build [cl/3444](https://gerrit.lix.systems/c/lix/+/3444)
+
+  Previously, scratch paths created during builds were not always cleaned up if
+  the derivation failed, potentially leaving behind unnecessary temporary files
+  or directories in the Nix store.
+
+  This fix ensures that such paths are consistently removed after a failed build,
+  improving Nix store hygiene, hardening Lix against mis-reuse of failed builds
+  scratch paths.
+
+  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) and [eldritch horrors](https://git.lix.systems/pennae) for this.
+
+- `build-dir` no longer defaults to `temp-dir` [cl/3443](https://gerrit.lix.systems/c/lix/+/3443)
+
+  The directory in which temporary build directories are created no longer defaults
+  to the value of the `temp-dir` setting to avoid builders making their directories
+  world-accessible. This behavior has been used to escape the build sandbox and can
+  cause build impurities even when not used maliciously. We now default to `builds`
+  in `NIX_STATE_DIR` (which is `/nix/var/nix/builds` in the default configuration).
+
+  Many thanks to [eldritch horrors](https://git.lix.systems/pennae) for this.
+
+- Remove reliance on Bash for remote stores via SSH [fj#830](https://git.lix.systems/lix-project/lix/issues/830) [fj#805](https://git.lix.systems/lix-project/lix/issues/805) [fj#304](https://git.lix.systems/lix-project/lix/issues/304) [cl/3159](https://gerrit.lix.systems/c/lix/+/3159)
+
+  The pre-flight `echo started` handshake -- added years ago to catch race conditions -- has been removed.
+
+  After removal of connection sharing in Lix 2.93, it required a Bash-compatible shell and a standard `echo`, so it failed on:
+
+    * builders protected by `ForceCommand` wrappers (e.g. `nix-remote-build`),
+    * BusyBox / initrd images with no Bash,
+    * hosts using non-POSIX shells such as Nushell.
+
+  The race the probe once addressed was tied to SSH connection-sharing -- since connection-sharing code has already been removed, the probe is now pointless.
+
+  Real connection or protocol errors are now left to SSH/Nix to report directly.
+
+  This is technically a breaking change if you had scripts that relied on the literal "started" which needs to be updated to rely on other signals, e.g., exit codes.
+
+  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) for this.
+
+
+## Miscellany
+
+- Deprecation of CA derivations, dynamic derivations, and impure derivations [fj#815](https://git.lix.systems/lix-project/lix/issues/815)
+
+  Content-addressed derivations are now deprecated and slated for removal in Lix 2.94.
+  We're doing this because the CA derivation system has been a known cause of problems
+  and inconsistencies, is unmaintained, habitually makes improving the store code very
+  difficult (or blocks such improvements outright), and is beset by a number of design
+  flaws that in our opinion cannot be fixed without a full reimplementation from zero.
+  Dynamic derivations and impure derivations are built on the CA derivation framework,
+  and owing to this they too are deprecated and slated for removal in another release.
+
+
+
+
 
 
 # Lix 2.93.0 (2025-05-09)

lix/libcmd/repl.cc

@@ -254,7 +254,7 @@ void runNix(Path program, const Strings & args)
         .program = settings.nixBinDir+ "/" + program,
         .args = args,
         .environment = subprocessEnv,
-    }).wait();
+    }).waitAndCheck();
 
     return;
 }
@@ -672,7 +672,7 @@ ProcessLineResult NixRepl::processLine(std::string line)
 
         // runProgram redirects stdout to a StringSink,
         // using runProgram2 to allow editors to display their UI
-        runProgram2(RunOptions { .program = editor, .searchPath = true, .args = args }).wait();
+        runProgram2(RunOptions { .program = editor, .searchPath = true, .args = args }).waitAndCheck();
 
         // Reload right after exiting the editor if path is not in store
         // Store is immutable, so there could be no changes, so there's no need to reload

lix/libfetchers/git.cc

@@ -22,6 +22,7 @@
 #include <string.h>
 #include <sys/time.h>
 #include <sys/wait.h>
+#include <unistd.h>
 
 using namespace std::string_literals;
 
@@ -168,7 +169,7 @@ WorkdirInfo getWorkdirInfo(const Input & input, const Path & workdir)
         .program = "git",
         .args = { "-C", workdir, "--git-dir", gitDir, "rev-parse", "--verify", "--no-revs", "HEAD^{commit}" },
         .environment = env,
-        .mergeStderrToStdout = true
+        .redirections = {{.from = STDERR_FILENO, .to = STDOUT_FILENO}},
     });
     auto exitCode = WEXITSTATUS(result.first);
     auto errorMessage = result.second;
@@ -701,7 +702,7 @@ struct GitInputScheme : InputScheme
         auto result = runProgram(RunOptions {
             .program = "git",
             .args = { "-C", repoDir, "--git-dir", gitDir, "cat-file", "commit", input.getRev()->gitRev() },
-            .mergeStderrToStdout = true
+            .redirections = {{.from = STDERR_FILENO, .to = STDOUT_FILENO}},
         });
         if (WEXITSTATUS(result.first) == 128
             && result.second.find("bad file") != std::string::npos)
@@ -766,7 +767,7 @@ struct GitInputScheme : InputScheme
                 .args = { "-C", repoDir, "--git-dir", gitDir, "archive", input.getRev()->gitRev() },
                 .captureStdout = true,
             });
-            Finally const _wait([&] { proc.wait(); });
+            Finally const _wait([&] { proc.waitAndCheck(); });
 
             unpackTarfile(*proc.getStdout(), tmpDir);
         }

lix/libstore/build/derivation-goal.cc

@@ -1011,11 +1011,11 @@ void runPostBuildHook(
         .program = settings.postBuildHook,
         .environment = hookEnvironment,
         .captureStdout = true,
-        .mergeStderrToStdout = true,
+        .redirections = {{.from = STDERR_FILENO, .to = STDOUT_FILENO}},
     });
     Finally const _wait([&] {
         try {
-            proc.wait();
+            proc.waitAndCheck();
         } catch (nix::Error & e) {
             e.addTrace(nullptr,
                 "while running the post-build-hook %s for derivation %s",

lix/libstore/build/local-derivation-goal.cc

@@ -13,6 +13,8 @@
 #include "lix/libutil/archive.hh"
 #include "lix/libstore/daemon.hh"
 #include "lix/libutil/regex.hh"
+#include "lix/libutil/file-descriptor.hh"
+#include "lix/libutil/file-system.hh"
 #include "lix/libutil/result.hh"
 #include "lix/libutil/topo-sort.hh"
 #include "lix/libutil/json.hh"
@@ -25,13 +27,16 @@
 #include "lix/libutil/mount.hh"
 #include "lix/libutil/strings.hh"
 #include "lix/libutil/thread-name.hh"
+#include "platform/linux.hh"
 
 #include <cstddef>
+#include <dirent.h>
 #include <exception>
 #include <regex>
 #include <queue>
 
 #include <stdexcept>
+#include <sys/stat.h>
 #include <sys/un.h>
 #include <fcntl.h>
 #include <termios.h>
@@ -110,7 +115,11 @@ LocalDerivationGoal::~LocalDerivationGoal() noexcept(false)
     /* Careful: we should never ever throw an exception from a
        destructor. */
     try { killChild(); } catch (...) { ignoreExceptionInDestructor(); }
-    try { deleteTmpDir(false, true); } catch (...) { ignoreExceptionInDestructor(); }
+    try {
+        finalizeTmpDir(false, true);
+    } catch (...) {
+        ignoreExceptionInDestructor();
+    }
 }
 
 
@@ -360,13 +369,14 @@ bool LocalDerivationGoal::cleanupDecideWhetherDiskFull()
         if (statvfs(localStore.config().realStoreDir.get().c_str(), &st) == 0 &&
             (uint64_t) st.f_bavail * st.f_bsize < required)
             diskFull = true;
-        if (statvfs(tmpDir.c_str(), &st) == 0 &&
-            (uint64_t) st.f_bavail * st.f_bsize < required)
+        if (statvfs(tmpDirRoot.c_str(), &st) == 0 && (uint64_t) st.f_bavail * st.f_bsize < required)
+        {
             diskFull = true;
+        }
     }
 #endif
 
-    deleteTmpDir(false);
+    finalizeTmpDir(false);
 
     /* Move paths out of the chroot for easier debugging of
        build failures. */
@@ -385,7 +395,7 @@ bool LocalDerivationGoal::cleanupDecideWhetherDiskFull()
 
 void LocalDerivationGoal::cleanupPostOutputsRegisteredModeCheck()
 {
-    deleteTmpDir(true);
+    finalizeTmpDir(true);
 }
 
 
@@ -480,22 +490,87 @@ try {
         });
     }
 
-    /* Create a temporary directory where the build will take
-       place. */
-    tmpDir = createTempDir(
-        settings.buildDir.get().value_or(""),
-        "nix-build-" + std::string(drvPath.name()),
-        false,
-        false,
-        0700
-    );
+    try {
+        auto buildDir = worker.buildDirOverride.value_or(settings.buildDir.get());
+
+        createDirs(buildDir);
+
+        /* Create a temporary directory where the build will take
+           place. */
+        tmpDirRoot =
+            createTempDir(buildDir, "nix-build-" + std::string(drvPath.name()), false, false, 0700);
+    } catch (SysError & e) {
+        /*
+         * Fallback to the global tmpdir and create a safe space there
+         * only if it's a permission error.
+         */
+        if (e.errNo != EACCES) {
+            throw;
+        }
+
+        auto globalTmp = defaultTempDir();
+        createDirs(globalTmp);
+#if __APPLE__
+        /* macOS filesystem namespacing does not exist, to avoid breaking builds, we need to weaken
+         * the mode bits on the top-level directory. This avoids issues like
+         * https://github.com/NixOS/nix/pull/11031. */
+        constexpr int toplevelDirMode = 0755;
+#else
+        constexpr int toplevelDirMode = 0700;
+#endif
+        auto nixBuildsTmp =
+            createTempDir(globalTmp, fmt("nix-builds-%s", geteuid()), false, false, toplevelDirMode);
+        warn(
+            "Failed to use the system-wide build directory '%s', falling back to a temporary "
+            "directory inside '%s'",
+            settings.buildDir.get(),
+            nixBuildsTmp
+        );
+        worker.buildDirOverride = nixBuildsTmp;
+        tmpDirRoot = createTempDir(
+            nixBuildsTmp, "nix-build-" + std::string(drvPath.name()), false, false, 0700
+        );
+    }
     /* The TOCTOU between the previous mkdir call and this open call is unavoidable due to
      * POSIX semantics.*/
-    tmpDirFd = AutoCloseFD{open(tmpDir.c_str(), O_RDONLY | O_NOFOLLOW | O_DIRECTORY)};
+    tmpDirRootFd = AutoCloseFD{open(tmpDirRoot.c_str(), O_RDONLY | O_NOFOLLOW | O_DIRECTORY)};
+    if (!tmpDirRootFd) {
+        throw SysError("failed to open the build temporary directory descriptor '%1%'", tmpDirRoot);
+    }
+
+    // place the actual build directory in a subdirectory of tmpDirRoot. if
+    // we do not do this a build can `chown 777` its build directory and so
+    // make it accessible to everyone in the system, breaking isolation. we
+    // also need the intermediate level to be inaccessible to others. build
+    // processes must be able to at least traverse to the directory though,
+    // without being able to chmod. this means either mode 0750 or 0710. we
+    // cannot use 0710 because the libarchive we link with is compiled with
+    // an old apple sdk that does not have O_SEARCH, which makes libarchive
+    // try to open tmpDirRoot for *read* and fail because g+r is not set. a
+    // future update to nixpkgs may fix this. until then we do not lose any
+    // security by setting mode 0750 because we use only a single subdir in
+    // tmpDirRoot, so being able to list its parent doesn't break anything.
+    //
+    // use a short name to not increase the path length too much on darwin.
+    // darwin has a severe sockaddr_un path length limitation, so this does
+    // make a difference over more evocative names. we use `b` for `build`.
+    tmpDir = tmpDirRoot + "/b";
+    if (mkdirat(tmpDirRootFd.get(), "b", 0700)) {
+        throw SysError("failed to create the build temporary directory '%1%'", tmpDir);
+    }
+    tmpDirFd = AutoCloseFD{openat(tmpDirRootFd.get(), "b", O_RDONLY | O_NOFOLLOW | O_DIRECTORY)};
     if (!tmpDirFd)
         throw SysError("failed to open the build temporary directory descriptor '%1%'", tmpDir);
 
     chownToBuilder(tmpDirFd);
+    if (buildUser) {
+        if (fchown(tmpDirRootFd.get(), -1, buildUser->getGID()) == -1) {
+            throw SysError("cannot change ownership of '%1%'", tmpDirRoot);
+        }
+        if (fchmod(tmpDirRootFd.get(), 0750) == -1) {
+            throw SysError("cannot change mode of '%1%'", tmpDirRoot);
+        }
+    }
 
     for (auto & [outputName, status] : initialOutputs) {
         /* Set scratch path we'll actually use during the build.
@@ -863,8 +938,13 @@ void LocalDerivationGoal::initTmpDir() {
                 auto hash = hashString(HashType::SHA256, i.first);
                 std::string fn = ".attr-" + hash.to_string(Base::Base32, false);
                 Path p = tmpDir + "/" + fn;
-                writeFile(p, rewriteStrings(i.second, inputRewrites));
-                chownToBuilder(p);
+                /* TODO(jade): we should have BorrowedFD instead of OwnedFD. */
+                AutoCloseFD passAsFileFd{openat(tmpDirFd.get(), fn.c_str(), O_WRONLY | O_TRUNC | O_CREAT | O_CLOEXEC | O_EXCL | O_NOFOLLOW, 0666)};
+                if (!passAsFileFd) {
+                    throw SysError("opening `passAsFile` file in the sandbox '%1%'", p);
+                }
+                writeFile(passAsFileFd, rewriteStrings(i.second, inputRewrites));
+                chownToBuilder(passAsFileFd);
                 env[i.first + "Path"] = tmpDirInSandbox + "/" + fn;
             }
         }
@@ -1117,7 +1197,7 @@ void LocalDerivationGoal::runChild()
                 /* N.B. it is realistic that these paths might not exist. It
                    happens when testing Nix building fixed-output derivations
                    within a pure derivation. */
-                for (auto & path : { "/etc/resolv.conf", "/etc/services", "/etc/hosts" })
+                for (auto & path : { "/etc/services", "/etc/hosts" })
                     if (pathExists(path)) {
                         // Copy the actual file, not the symlink, because we don't know where
                         // the symlink is pointing, and we don't want to chase down the entire
@@ -1138,6 +1218,11 @@ void LocalDerivationGoal::runChild()
                         copyFile(path, chrootRootDir + path, { .followSymlinks = true });
                     }
 
+                if (pathExists("/etc/resolv.conf")) {
+                    const auto resolvConf = rewriteResolvConf(readFile("/etc/resolv.conf"));
+                    writeFile(chrootRootDir + "/etc/resolv.conf", resolvConf);
+                }
+
                 if (settings.caFile != "" && pathExists(settings.caFile)) {
                     // For the same reasons as above, copy the CA certificates file too.
                     // It should be even less likely to change during the build than resolv.conf.
@@ -1265,6 +1350,36 @@ void LocalDerivationGoal::runChild()
             if (setuid(sandboxUid()) == -1)
                 throw SysError("setuid failed");
 
+            if (runPasta) {
+                // wait for the pasta interface to appear. pasta can't signal us when
+                // it's done setting up the namespace, so we have to wait for a while
+                AutoCloseFD fd(socket(PF_INET, SOCK_DGRAM, IPPROTO_IP));
+                if (!fd) throw SysError("cannot open IP socket");
+
+                struct ifreq ifr;
+                strcpy(ifr.ifr_name, LinuxLocalDerivationGoal::PASTA_NS_IFNAME);
+                // wait two minutes for the interface to appear. if it does not do so
+                // we are either grossly overloaded, or pasta startup failed somehow.
+                static constexpr int SINGLE_WAIT_US = 1000;
+                static constexpr int TOTAL_WAIT_US = 120'000'000;
+                for (unsigned tries = 0; ; tries++) {
+                    if (tries > TOTAL_WAIT_US / SINGLE_WAIT_US) {
+                        throw Error(
+                            "sandbox network setup timed out, please check daemon logs for "
+                            "possible error output."
+                        );
+                    } else if (ioctl(fd.get(), SIOCGIFFLAGS, &ifr) == 0) {
+                        if ((ifr.ifr_ifru.ifru_flags & IFF_UP) != 0) {
+                            break;
+                        }
+                    } else if (errno == ENODEV) {
+                        usleep(SINGLE_WAIT_US);
+                    } else {
+                        throw SysError("cannot get loopback interface flags");
+                    }
+                }
+            }
+
             setUser = false;
         }
 #endif
@@ -1436,6 +1551,8 @@ void LocalDerivationGoal::runChild()
 
         if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {
             Strings sandboxArgs;
+            sandboxArgs.push_back("_NIX_BUILD_TOP");
+            sandboxArgs.push_back(tmpDir);
             sandboxArgs.push_back("_GLOBAL_TMP_DIR");
             sandboxArgs.push_back(globalTmpDir);
             if (allowLocalNetworking) {
@@ -2309,21 +2426,78 @@ try {
     co_return result::current_exception();
 }
 
-
-void LocalDerivationGoal::deleteTmpDir(bool force, bool duringDestruction)
+// make `entry` in `parentFd` visible to the given user and group, preserving
+// inode modes as much as possible. if the builder sets the mode of any inode
+// to not be readable by the owner we keep this; not doing so could interfere
+// with error analysis. if the builder used multiple uids or gids we will not
+// keep them around and instead collapse them all onto the uid/gid given here
+// to not leave around inodes owned by unassigned uids/gids in the system. we
+// also clear setuid/setgid/sticky bits just to be safe even though a builder
+// should not be able to set them to begin, otherwise we may leave setuid/gid
+// executables in the tree even with user/group set to -1/-1. there have been
+// enough bugs of this kind in the past to warrant some extra attention here.
+static void makeVisible(int parentFd, const char * entry, uid_t user, gid_t group)
 {
-    if (tmpDir != "") {
+    struct stat st;
+    if (fstatat(parentFd, entry, &st, AT_SYMLINK_NOFOLLOW)) {
+        throw SysError("fstat(%s)", guessOrInventPathFromFD(parentFd));
+    }
+    if (S_ISDIR(st.st_mode)) {
+        int dirfd = openat(parentFd, entry, O_RDONLY | O_DIRECTORY | O_NOFOLLOW);
+        if (dirfd < 0) {
+            throw SysError("openat(%s/%s)", guessOrInventPathFromFD(parentFd), entry);
+        }
+        AutoCloseDir dir(fdopendir(dirfd));
+        if (!dir) {
+            close(dirfd);
+            throw SysError("fdopendir(%s/%s)", guessOrInventPathFromFD(parentFd), entry);
+        }
+
+        struct dirent * dirent;
+        while (errno = 0, dirent = readdir(dir.get())) {
+            if (strcmp(dirent->d_name, ".") == 0 || strcmp(dirent->d_name, "..") == 0) {
+                continue;
+            }
+            makeVisible(dirfd, dirent->d_name, user, group);
+        }
+    }
+
+    // ignore permissions errors for symlinks. linux can't chmod them.
+    // clear special permission bits while we're here, just to be safe
+    if (fchmodat(parentFd, entry, st.st_mode & 0777, AT_SYMLINK_NOFOLLOW) && !S_ISLNK(st.st_mode)) {
+        throw SysError("fchmod(%s)", guessOrInventPathFromFD(parentFd));
+    }
+    if (user != uid_t(-1) && group != gid_t(-1)
+        && fchownat(parentFd, entry, user, group, AT_SYMLINK_NOFOLLOW))
+    {
+        throw SysError("fchown(%s)", guessOrInventPathFromFD(parentFd));
+    }
+}
+
+void LocalDerivationGoal::finalizeTmpDir(bool force, bool duringDestruction)
+{
+    if (tmpDirRoot != "") {
         /* Don't keep temporary directories for builtins because they
            might have privileged stuff (like a copy of netrc). */
         if (settings.keepFailed && !force && !drv->isBuiltin()) {
-            printError("note: keeping build directory '%s'", tmpDir);
-            chmod(tmpDir.c_str(), 0755);
+            printError("note: keeping build directory '%s'", tmpDirRoot);
+            try {
+                // always make visible, but don't always chown. if we run as
+                // root we may not want to chown things to root:root so much
+                auto creds = worker.store.associatedCredentials();
+                makeVisible(
+                    tmpDirFd.get(), ".", creds ? creds->user : -1, creds ? creds->group : -1
+                );
+            } catch (SysError & e) {
+                printError("error making '%s' accessible: %s", tmpDir, e.what());
+            }
+            chmod(tmpDirRoot.c_str(), 0755);
         }
         else if (duringDestruction)
-            deletePathUninterruptible(tmpDir);
+            deletePathUninterruptible(tmpDirRoot);
         else
-            deletePath(tmpDir);
-        tmpDir = "";
+            deletePath(tmpDirRoot);
+        tmpDirRoot = "";
     }
 }
 

lix/libstore/build/local-derivation-goal.hh

@@ -29,12 +29,12 @@ struct LocalDerivationGoal : public DerivationGoal
     /**
      * The temporary directory.
      */
-    Path tmpDir;
+    Path tmpDirRoot, tmpDir;
 
     /**
      * The temporary directory file descriptor
      */
-    AutoCloseFD tmpDirFd;
+    AutoCloseFD tmpDirRootFd, tmpDirFd;
 
     /**
      * The path of the temporary directory in the sandbox.
@@ -246,9 +246,12 @@ struct LocalDerivationGoal : public DerivationGoal
     void cleanupPostOutputsRegisteredModeNonCheck() override;
 
     /**
-     * Delete the temporary directory, if we have one.
+     * Delete the temporary directory or make it visible to the user requesting
+     * this build, if a temporary directory was created at all. Temporary files
+     * of derivations using builtin builders are deleted even for `keep-failed`
+     * builds as otherwise we may expose secrets (e.g. from the system .netrc).
      */
-    void deleteTmpDir(bool force, bool duringDestruction = false);
+    void finalizeTmpDir(bool force, bool duringDestruction = false);
 
     /**
      * Forcibly kill the child process, if any.
@@ -282,6 +285,12 @@ struct LocalDerivationGoal : public DerivationGoal
 protected:
     using DerivationGoal::DerivationGoal;
 
+    /**
+     * Whether to run pasta for network-endowed derivations. Running pasta
+     * currently requires actively waiting for its net-ns setup to finish.
+     */
+    bool runPasta = false;
+
     /**
      * Setup dependencies outside the sandbox.
      * Called in the parent nix process.
@@ -291,6 +300,15 @@ protected:
         throw Error("sandboxing builds is not supported on this platform");
     };
 
+    /**
+     * Rewrite resolv.conf for use in the sandbox. Used in the linux platform
+     * to replace nameservers * when using pasta for fixed output derivations.
+     */
+    virtual std::string rewriteResolvConf(std::string fromHost)
+    {
+        return fromHost;
+    }
+
     /**
      * Create a new process that runs `openSlave` and `runChild`
      * On some platforms this process is created with sandboxing flags.

lix/libstore/build/sandbox-defaults.sb

@@ -26,12 +26,14 @@ R""(
 ; Allow getpwuid.
 (allow mach-lookup (global-name "com.apple.system.opendirectoryd.libinfo"))
 
-; Access to /tmp.
+; Access to /tmp and the build directory.
 ; The network-outbound/network-inbound ones are for unix domain sockets, which
 ; we allow access to in TMPDIR (but if we allow them more broadly, you could in
 ; theory escape the sandbox)
 (allow file* process-exec network-outbound network-inbound
-       (literal "/tmp") (subpath TMPDIR))
+       (literal "/tmp")
+       (subpath TMPDIR)
+       (subpath (param "_NIX_BUILD_TOP")))
 
 ; Some packages like to read the system version.
 (allow file-read*

lix/libstore/build/worker.hh

@@ -195,6 +195,7 @@ public:
     Store & store;
     Store & evalStore;
     AsyncSemaphore substitutions, localBuilds;
+    std::optional<Path> buildDirOverride;
 
 private:
     kj::TaskSet children;

lix/libstore/globals.cc

@@ -87,6 +87,9 @@ Settings::Settings()
 #if defined(__linux__) && defined(SANDBOX_SHELL)
     sandboxPaths.setDefault(tokenizeString<StringSet>("/bin/sh=" SANDBOX_SHELL));
 #endif
+#if defined(__linux__) && defined(PASTA_PATH)
+    pastaPath.setDefault(PASTA_PATH);
+#endif
 
     /* chroot-like behavior from Apple's sandbox */
 #if __APPLE__
@@ -243,7 +246,11 @@ StringSet Settings::getDefaultExtraPlatforms()
     // x86_64 in aarch64 environments or vice versa since they can
     // always exec with their own binary preferences.
     if (std::string{SYSTEM} == "aarch64-darwin" &&
-        runProgram(RunOptions {.program = "arch", .args = {"-arch", "x86_64", "/usr/bin/true"}, .mergeStderrToStdout = true}).first == 0)
+        runProgram(RunOptions {
+            .program = "arch",
+            .args = {"-arch", "x86_64", "/usr/bin/true"},
+            .redirections = {{.from = STDERR_FILENO, .to = STDOUT_FILENO}}
+        }).first == 0)
         extraPlatforms.insert("x86_64-darwin");
 #endif
 

lix/libstore/local-store.hh

@@ -135,6 +135,8 @@ private:
 
     Sync<GCState> _gcState;
 
+    std::optional<AssociatedCredentials> association;
+
 public:
 
     const Path dbDir;
@@ -148,6 +150,16 @@ public:
     LocalStoreConfig & config() override { return config_; }
     const LocalStoreConfig & config() const override { return config_; }
 
+    std::optional<AssociatedCredentials> associatedCredentials() const override
+    {
+        return association;
+    }
+
+    void associateWithCredentials(uid_t user, gid_t group)
+    {
+        association = {user, group};
+    }
+
 private:
 
     const PublicKeys & getPublicKeys();

lix/libstore/meson.build

@@ -82,6 +82,7 @@ libstore_setting_definitions = files(
   'settings/narinfo-cache-negative-ttl.md',
   'settings/narinfo-cache-positive-ttl.md',
   'settings/netrc-file.md',
+  'settings/pasta-path.md',
   'settings/plugin-files.md',
   'settings/post-build-hook.md',
   'settings/pre-build-hook.md',
@@ -332,6 +333,12 @@ elif busybox.found()
   }
 endif
 
+if pasta.found()
+  cpp_str_defines += {
+    'PASTA_PATH': pasta.full_path(),
+  }
+endif
+
 cpp_args = []
 
 foreach name, value : cpp_str_defines

lix/libstore/platform/linux.cc

@@ -1,16 +1,25 @@
 #include "lix/libstore/build/worker.hh"
 #include "lix/libutil/cgroup.hh"
+#include "lix/libutil/file-descriptor.hh"
+#include "lix/libutil/file-system.hh"
 #include "lix/libutil/finally.hh"
 #include "lix/libstore/gc-store.hh"
+#include "lix/libutil/processes.hh"
 #include "lix/libutil/signals.hh"
 #include "lix/libstore/platform/linux.hh"
 #include "lix/libutil/regex.hh"
 #include "lix/libutil/strings.hh"
 
+#include <csignal>
+#include <cstdlib>
 #include <grp.h>
 #include <regex>
 #include <sys/prctl.h>
 
+#if __linux__
+#include <linux/capability.h>
+#endif
+
 #if HAVE_SECCOMP
 #include <linux/filter.h>
 #include <sys/syscall.h>
@@ -61,6 +70,14 @@ static void readFileRoots(const char * path, UncheckedRoots & roots)
     }
 }
 
+LinuxLocalDerivationGoal::~LinuxLocalDerivationGoal()
+{
+    // pasta being left around mostly happens when builds are aborted
+    if (pastaPid) {
+        pastaPid.kill();
+    }
+}
+
 void LinuxLocalStore::findPlatformRoots(UncheckedRoots & unchecked)
 {
     auto procDir = AutoCloseDir{opendir("/proc")};
@@ -836,6 +853,26 @@ void LinuxLocalDerivationGoal::prepareSandbox()
     }
 }
 
+std::string LinuxLocalDerivationGoal::rewriteResolvConf(std::string fromHost)
+{
+    if (!runPasta) {
+        return fromHost;
+    }
+
+    static constexpr auto flags = std::regex::ECMAScript | std::regex::multiline;
+    static auto lineRegex = regex::parse("^nameserver\\s.*$", flags);
+    static auto v4Regex = regex::parse("^nameserver\\s+\\d{1,3}\\.", flags);
+    static auto v6Regex = regex::parse("^nameserver.*:", flags);
+    std::string nsInSandbox = "\n";
+    if (std::regex_search(fromHost, v4Regex)) {
+        nsInSandbox += fmt("nameserver %s\n", PASTA_HOST_IPV4);
+    }
+    if (std::regex_search(fromHost, v6Regex)) {
+        nsInSandbox += fmt("nameserver %s\n", PASTA_HOST_IPV6);
+    }
+    return std::regex_replace(fromHost, lineRegex, "") + nsInSandbox;
+}
+
 Pid LinuxLocalDerivationGoal::startChild(std::function<void()> openSlave)
 {
 #if HAVE_SECCOMP
@@ -863,9 +900,11 @@ Pid LinuxLocalDerivationGoal::startChild(std::function<void()> openSlave)
 
        - The private network namespace ensures that the builder
          cannot talk to the outside world (or vice versa).  It
-         only has a private loopback interface. (Fixed-output
-         derivations are not run in a private network namespace
-         to allow functions like fetchurl to work.)
+         only has a private loopback interface. If a copy of
+         `pasta` is available, Fixed-output derivations are run
+         inside a private network namespace with internet
+         access, otherwise they are run in the host's network
+         namespace, to allow functions like fetchurl to work.
 
        - The IPC namespace prevents the builder from communicating
          with outside processes using SysV IPC mechanisms (shared
@@ -886,6 +925,10 @@ Pid LinuxLocalDerivationGoal::startChild(std::function<void()> openSlave)
     if (derivationType->isSandboxed())
         privateNetwork = true;
 
+    // don't launch pasta unless we have a tun device. in a build sandbox we
+    // commonly do not, and trying to run pasta anyway naturally won't work.
+    runPasta = !privateNetwork && settings.pastaPath != "" && pathExists("/dev/net/tun");
+
     userNamespaceSync.create();
 
     Pipe sendPid;
@@ -910,7 +953,9 @@ Pid LinuxLocalDerivationGoal::startChild(std::function<void()> openSlave)
 
         ProcessOptions options;
         options.cloneFlags = CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWIPC | CLONE_NEWUTS | CLONE_PARENT | SIGCHLD;
-        if (privateNetwork)
+        // we always want to create a new network namespace for pasta, even when
+        // we can't actually run it. not doing so hides bugs and impairs purity.
+        if (settings.pastaPath != "" || privateNetwork)
             options.cloneFlags |= CLONE_NEWNET;
         if (usingUserNamespace)
             options.cloneFlags |= CLONE_NEWUSER;
@@ -980,6 +1025,67 @@ Pid LinuxLocalDerivationGoal::startChild(std::function<void()> openSlave)
     /* Signal the builder that we've updated its user namespace. */
     writeFull(userNamespaceSync.writeSide.get(), "1");
 
+    if (runPasta) {
+        // Bring up pasta, for handling FOD networking. We don't let it daemonize
+        // itself for process managements reasons and kill it manually when done.
+
+        // TODO add a new sandbox mode flag to disable all or parts of this?
+        Strings args = {
+            // clang-format off
+            "--quiet",
+            "--foreground",
+            "--config-net",
+            "--gateway", PASTA_HOST_IPV4,
+            "--address", PASTA_CHILD_IPV4, "--netmask", PASTA_IPV4_NETMASK,
+            "--dns-forward", PASTA_HOST_IPV4,
+            "--gateway", PASTA_HOST_IPV6,
+            "--address", PASTA_CHILD_IPV6,
+            "--dns-forward", PASTA_HOST_IPV6,
+            "--ns-ifname", PASTA_NS_IFNAME,
+            "--no-netns-quit",
+            "--netns", "/proc/self/fd/0",
+            // clang-format on
+        };
+
+        AutoCloseFD netns(open(fmt("/proc/%i/ns/net", pid.get()).c_str(), O_RDONLY | O_CLOEXEC));
+        if (!netns) {
+            throw SysError("failed to open netns");
+        }
+
+        AutoCloseFD userns;
+        if (usingUserNamespace) {
+            userns =
+                AutoCloseFD(open(fmt("/proc/%i/ns/user", pid.get()).c_str(), O_RDONLY | O_CLOEXEC));
+            if (!userns) {
+                throw SysError("failed to open userns");
+            }
+            args.push_back("--userns");
+            args.push_back("/proc/self/fd/1");
+        }
+
+        // FIXME ideally we want a notification when pasta exits, but we cannot do
+        // this at present. without such support we need to busy-wait for pasta to
+        // set up the namespace completely and time out after a while for the case
+        // of pasta launch failures. pasta logs go to syslog only for now as well.
+        pastaPid = runProgram2({
+            .program = settings.pastaPath,
+            .args = args,
+            .uid = useBuildUsers() ? std::optional(buildUser->getUID()) : std::nullopt,
+            .gid = useBuildUsers() ? std::optional(buildUser->getGID()) : std::nullopt,
+            // TODO these redirections are crimes. pasta closes all non-stdio file
+            // descriptors very early and lacks fd arguments for the namespaces we
+            // want it to join. we cannot have pasta join the namespaces via pids;
+            // doing so requires capabilities which pasta *also* drops very early.
+            .redirections = {
+                {.from = 0, .to = netns.get()},
+                {.from = 1, .to = userns ? userns.get() : 1},
+            },
+            .caps = getuid() == 0
+                ? std::set<long>{CAP_SYS_ADMIN, CAP_NET_BIND_SERVICE}
+                : std::set<long>{},
+        });
+    }
+
     return pid;
 }
 
@@ -997,5 +1103,24 @@ void LinuxLocalDerivationGoal::killSandbox(bool getStats)
            This avoids processes unrelated to the build being killed, thus avoiding: https://git.lix.systems/lix-project/lix/issues/667 */
         LocalDerivationGoal::killSandbox(getStats);
     }
+
+    if (pastaPid) {
+        // FIXME we really want to send SIGTERM instead and wait for pasta to exit,
+        // but we do not have the infra for that right now. we send SIGKILL instead
+        // and treat exiting with that as a successful exit code until such a time.
+        // this is not likely to cause problems since pasta runs as the build user,
+        // but not inside the build sandbox. if it's killed it's either due to some
+        // external influence (in which case the sandboxed child will probably fail
+        // due to network errors, if it used the network at all) or some bug in lix
+        if (auto status = pastaPid.kill(); !WIFSIGNALED(status) || WTERMSIG(status) != SIGKILL) {
+            if (WIFSIGNALED(status)) {
+                throw Error("pasta killed by signal %i", WTERMSIG(status));
+            } else if (WIFEXITED(status)) {
+                throw Error("pasta exited with code %i", WEXITSTATUS(status));
+            } else {
+                throw Error("pasta exited with status %i", status);
+            }
+        }
+    }
 }
 }

lix/libstore/platform/linux.hh

@@ -4,6 +4,7 @@
 #include "lix/libstore/build/local-derivation-goal.hh"
 #include "lix/libstore/gc-store.hh"
 #include "lix/libstore/local-store.hh"
+#include "lix/libutil/processes.hh"
 
 namespace nix {
 
@@ -33,7 +34,23 @@ class LinuxLocalDerivationGoal : public LocalDerivationGoal
 public:
     using LocalDerivationGoal::LocalDerivationGoal;
 
+    ~LinuxLocalDerivationGoal();
+
+    // NOTE these are all C strings because macos doesn't have constexpr std::string
+    // constructors, and std::string_view is a pain to turn into std::strings again.
+    static constexpr const char * PASTA_NS_IFNAME = "eth0";
+    static constexpr const char * PASTA_HOST_IPV4 = "169.254.1.1";
+    static constexpr const char * PASTA_CHILD_IPV4 = "169.254.1.2";
+    static constexpr const char * PASTA_IPV4_NETMASK = "16";
+    // randomly chosen 6to4 prefix, mapping the same ipv4ll as above.
+    // even if this id is used on the daemon host there should not be
+    // any collisions since ipv4ll should never be addressed by ipv6.
+    static constexpr const char * PASTA_HOST_IPV6 = "64:ff9b:1:4b8e:472e:a5c8:a9fe:0101";
+    static constexpr const char * PASTA_CHILD_IPV6 = "64:ff9b:1:4b8e:472e:a5c8:a9fe:0102";
+
 private:
+    RunningProgram pastaPid;
+
     /**
      * Create and populate chroot
      */
@@ -62,6 +79,7 @@ private:
         return true;
     }
 
+    std::string rewriteResolvConf(std::string fromHost) override;
 };
 
 }

lix/libstore/settings/build-dir.md

@@ -1,14 +1,24 @@
 ---
 name: build-dir
 internalName: buildDir
-settingType: PathsSetting<std::optional<Path>>
-default: null
+settingType: PathsSetting<Path>
+defaultText: "`«nixStateDir»/builds`"
+defaultExpr: nixStateDir + "/builds"
 ---
 The directory on the host, in which derivations' temporary build directories are created.
 
-If not set, Nix will use the [`temp-dir`](#conf-temp-dir) setting if set, otherwise the system temporary directory indicated by the `TMPDIR` environment variable.
-Note that builds are often performed by the Nix daemon, so its `TMPDIR` is used, and not that of the Nix command line interface.
+If not set, Lix will use the `builds` subdirectory of its configured state directory.
+Lix will create this directory automatically with suitable permissions if it does not
+exist, otherwise its permissions must allow all users to traverse the directory (i.e.
+it must have `o+x` set, in unix parlance) for non-sandboxed builds to work correctly.
 
 This is also the location where [`--keep-failed`](@docroot@/command-ref/opt-common.md#opt-keep-failed) leaves its files.
 
 If Nix runs without sandbox, or if the platform does not support sandboxing with bind mounts (e.g. macOS), then the [`builder`](@docroot@/language/derivations.md#attr-builder)'s environment will contain this directory, instead of the virtual location [`sandbox-build-dir`](#conf-sandbox-build-dir).
+
+> Important:
+>
+> `build-dir` must not be set to a world-writable directory. Placing temporary build
+> directories in a world-writable place allows other users to access or modify build
+> data that is currently in use. This alone is merely an impurity, but combined with
+> another factor this has allowed malicious derivations to escape the build sandbox.

lix/libstore/settings/pasta-path.md

@@ -0,0 +1,10 @@
+---
+name: pasta-path
+internalName: pastaPath
+type: Path
+default: ""
+---
+If set to an absolute path, enables fully sandboxing fixed-output
+derivations, by using `pasta` to pass network traffic between the
+private network namespace. This allows for greater levels of isolation
+of builds to the host.

lix/libstore/ssh.cc

@@ -5,6 +5,7 @@
 #include "lix/libutil/logging.hh"
 #include "lix/libutil/strings.hh"
 #include "lix/libstore/temporary-dir.hh"
+#include <unistd.h>
 
 namespace nix {
 

lix/libstore/store-api.hh

@@ -234,6 +234,22 @@ protected:
     Store(const StoreConfig & config);
 
 public:
+    struct AssociatedCredentials
+    {
+        uid_t user;
+        gid_t group;
+    };
+
+    /**
+     * Credentials of the context using this store if this store is proxied
+     * to somewhere else and the peer context is known. Only the daemon can
+     * set this to values that make any sense, using unix peer credentials.
+     */
+    virtual std::optional<AssociatedCredentials> associatedCredentials() const
+    {
+        return {};
+    }
+
     /**
      * Perform any necessary effectful operation to make the store up and
      * running

lix/libutil/file-system.cc

@@ -469,18 +469,29 @@ void syncParent(const Path & path)
     fd.fsync();
 }
 
-static void _deletePath(int parentfd, const Path & path, uint64_t & bytesFreed, bool interruptible)
+/* TODO(horrors): a better structure that links all parent fds for the traversal root
+ * should be considered for this code
+ */
+static void _deletePath(int parentfd, const std::string & name, uint64_t & bytesFreed, bool interruptible)
 {
+    /* This ensures that `name` is an immediate child of `parentfd`. */
+    assert(!name.empty() && name.find('/') == std::string::npos && "`name` is an immediate child to `parentfd`");
+
     if (interruptible) {
         checkInterrupt();
     }
 
-    std::string name(baseNameOf(path));
+    /* FIXME(horrors): there's a minor TOCTOU here.
+     * we fstatat the inode nofollow, check if this is a directory
+     * and then open it.
+     * a better alternative is open it as O_PATH as a namefd.
+     * if it's a directory, it can be openat with the namefd.
+     */
 
     struct stat st;
     if (fstatat(parentfd, name.c_str(), &st, AT_SYMLINK_NOFOLLOW) == -1) {
         if (errno == ENOENT) return;
-        throw SysError("getting status of '%1%'", path);
+        throw SysError("getting status of '%1%' in directory '%2%'", name, guessOrInventPathFromFD(parentfd));
     }
 
     if (!S_ISDIR(st.st_mode)) {
@@ -511,24 +522,25 @@ static void _deletePath(int parentfd, const Path & path, uint64_t & bytesFreed,
         /* Make the directory accessible. */
         const auto PERM_MASK = S_IRUSR | S_IWUSR | S_IXUSR;
         if ((st.st_mode & PERM_MASK) != PERM_MASK) {
-            if (fchmodat(parentfd, name.c_str(), st.st_mode | PERM_MASK, 0) == -1)
-                throw SysError("chmod '%1%'", path);
+            if (fchmodat(parentfd, name.c_str(), st.st_mode | PERM_MASK, 0) == -1) {
+                throw SysError("chmod '%1%' in directory '%2%'", name, guessOrInventPathFromFD(parentfd));
+            }
         }
 
-        int fd = openat(parentfd, path.c_str(), O_RDONLY);
+        int fd = openat(parentfd, name.c_str(), O_RDONLY | O_DIRECTORY | O_NOFOLLOW);
         if (fd == -1)
-            throw SysError("opening directory '%1%'", path);
+            throw SysError("opening directory '%1%' in directory '%2%'", name, guessOrInventPathFromFD(parentfd));
         AutoCloseDir dir(fdopendir(fd));
         if (!dir)
-            throw SysError("opening directory '%1%'", path);
-        for (auto & i : readDirectory(dir.get(), path, interruptible))
-            _deletePath(dirfd(dir.get()), path + "/" + i.name, bytesFreed, interruptible);
+            throw SysError("opening directory '%1%' in directory '%2%'", name, guessOrInventPathFromFD(parentfd));
+        for (auto & i : readDirectory(dir.get(), name, interruptible))
+            _deletePath(dirfd(dir.get()), i.name, bytesFreed, interruptible);
     }
 
     int flags = S_ISDIR(st.st_mode) ? AT_REMOVEDIR : 0;
     if (unlinkat(parentfd, name.c_str(), flags) == -1) {
         if (errno == ENOENT) return;
-        throw SysError("cannot unlink '%1%'", path);
+        throw SysError("cannot unlink '%1%' in directory '%2%'", name, guessOrInventPathFromFD(parentfd));
     }
 }
 
@@ -544,7 +556,7 @@ static void _deletePath(const Path & path, uint64_t & bytesFreed, bool interrupt
         throw SysError("opening directory '%1%'", path);
     }
 
-    _deletePath(dirfd.get(), path, bytesFreed, interruptible);
+    _deletePath(dirfd.get(), std::string(baseNameOf(path)), bytesFreed, interruptible);
 }
 
 

lix/libutil/processes.cc

@@ -22,6 +22,7 @@
 #endif
 
 #ifdef __linux__
+# include <linux/capability.h>
 # include <sys/prctl.h>
 # include <sys/mman.h>
 #endif
@@ -249,7 +250,7 @@ std::pair<int, std::string> runProgram(RunOptions && options)
 
     try {
         auto proc = runProgram2(options);
-        Finally const _wait([&] { proc.wait(); });
+        Finally const _wait([&] { proc.waitAndCheck(); });
         stdout = proc.getStdout()->drain();
     } catch (ExecError & e) {
         status = e.status;
@@ -277,7 +278,22 @@ RunningProgram::~RunningProgram()
     }
 }
 
-void RunningProgram::wait()
+std::tuple<pid_t, std::unique_ptr<Source>, int> RunningProgram::release()
+{
+    return {pid.release(), std::move(stdoutSource), stdout_.release()};
+}
+
+int RunningProgram::kill()
+{
+    return pid.kill();
+}
+
+int RunningProgram::wait()
+{
+    return pid.wait();
+}
+
+void RunningProgram::waitAndCheck()
 {
     if (std::uncaught_exceptions() == 0) {
         int status = pid.wait();
@@ -315,12 +331,21 @@ RunningProgram runProgram2(const RunOptions & options)
             replaceEnv(*options.environment);
         if (options.captureStdout && dup2(out.writeSide.get(), STDOUT_FILENO) == -1)
             throw SysError("dupping stdout");
-        if (options.mergeStderrToStdout)
-            if (dup2(STDOUT_FILENO, STDERR_FILENO) == -1)
-                throw SysError("cannot dup stdout into stderr");
+        for (auto redirection : options.redirections) {
+            if (dup2(redirection.to, redirection.from) == -1) {
+                throw SysError("dupping fd %i to %i", redirection.from, redirection.to);
+            }
+        }
 
         if (options.chdir && chdir((*options.chdir).c_str()) == -1)
             throw SysError("chdir failed");
+
+#if __linux__
+        if (!options.caps.empty() && prctl(PR_SET_KEEPCAPS, 1) < 0) {
+            throw SysError("setting keep-caps failed");
+        }
+#endif
+
         if (options.gid && setgid(*options.gid) == -1)
             throw SysError("setgid failed");
         /* Drop all other groups if we're setgid. */
@@ -329,6 +354,45 @@ RunningProgram runProgram2(const RunOptions & options)
         if (options.uid && setuid(*options.uid) == -1)
             throw SysError("setuid failed");
 
+#if __linux__
+        if (!options.caps.empty()) {
+            if (prctl(PR_SET_KEEPCAPS, 0)) {
+                throw SysError("clearing keep-caps failed");
+            }
+
+            // we do the capability dance like this to avoid a dependency
+            // on libcap, which has a rather large build closure and many
+            // more features that we need for now. maybe some other time.
+            static constexpr uint32_t LINUX_CAPABILITY_VERSION_3 = 0x20080522;
+            static constexpr uint32_t LINUX_CAPABILITY_U32S_3 = 2;
+            struct user_cap_header_struct
+            {
+                uint32_t version;
+                int pid;
+            } hdr = {LINUX_CAPABILITY_VERSION_3, 0};
+            struct user_cap_data_struct
+            {
+                uint32_t effective;
+                uint32_t permitted;
+                uint32_t inheritable;
+            } data[LINUX_CAPABILITY_U32S_3] = {};
+            for (auto cap : options.caps) {
+                assert(cap / 32 < LINUX_CAPABILITY_U32S_3);
+                data[cap / 32].permitted |= 1 << (cap % 32);
+                data[cap / 32].inheritable |= 1 << (cap % 32);
+            }
+            if (syscall(SYS_capset, &hdr, data)) {
+                throw SysError("couldn't set capabilities");
+            }
+
+            for (auto cap : options.caps) {
+                if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0) < 0) {
+                    throw SysError("couldn't set ambient caps");
+                }
+            }
+        }
+#endif
+
         Strings args_(options.args);
         args_.push_front(options.program);
 

lix/libutil/processes.hh

@@ -76,6 +76,11 @@ std::string runProgram(Path program, bool searchPath = false,
 
 struct RunOptions
 {
+    struct Redirection
+    {
+        int from, to;
+    };
+
     Path program;
     bool searchPath = true;
     Strings args = {};
@@ -84,8 +89,11 @@ struct RunOptions
     std::optional<Path> chdir = {};
     std::optional<std::map<std::string, std::string>> environment = {};
     bool captureStdout = false;
-    bool mergeStderrToStdout = false;
     bool isInteractive = false;
+    std::vector<Redirection> redirections;
+#if __linux__
+    std::set<long> caps;
+#endif
 };
 
 struct [[nodiscard("you must call RunningProgram::wait()")]] RunningProgram
@@ -102,9 +110,23 @@ private:
 
 public:
     RunningProgram() = default;
+    RunningProgram(RunningProgram &&) = default;
+    RunningProgram & operator=(RunningProgram &&) = default;
     ~RunningProgram();
 
-    void wait();
+    explicit operator bool() const { return bool(pid); }
+
+    std::tuple<pid_t, std::unique_ptr<Source>, int> release();
+
+    int kill();
+    [[nodiscard]]
+    int wait();
+    void waitAndCheck();
+
+    std::optional<int> getStdoutFD() const
+    {
+        return stdout_ ? std::optional(stdout_.get()) : std::nullopt;
+    }
 
     Source * getStdout() const { return stdoutSource.get(); };
 };

lix/nix/daemon.cc

@@ -364,11 +364,17 @@ static void daemonLoopImpl(std::optional<TrustedFlag> forceTrustClientOpt)
                     strncpy(savedArgv[1], processName.c_str(), strlen(savedArgv[1]));
                 }
 
+                auto store = aio.blockOn(openUncachedStore());
+                if (auto local = dynamic_cast<LocalStore *>(&*store); local && peer.uidKnown && peer.gidKnown) {
+                    local->associateWithCredentials(peer.uid, peer.gid);
+                }
+
                 //  Handle the connection.
                 FdSource from(remote.get());
                 FdSink to(remote.get());
+
                 processConnection(
-                    aio, aio.blockOn(openUncachedStore()), from, to, trusted
+                    aio, store, from, to, trusted
                 );
 
                 exit(0);

meson.build

@@ -451,6 +451,13 @@ configdata += {
   'HAVE_DTRACE': dtrace_feature.enabled().to_int(),
 }
 
+pasta_path = get_option('pasta-path')
+# we can't check the pasta version because passt misuses stdio (it calls _exit()
+# after printing the version, which will never print the version unless run from
+# a terminal). pasta isn't mandatory yet due to high fetcher breakage potential.
+# we *will* enable it in our own packaging, but distributions are not forced to.
+pasta = find_program(pasta_path, required : false, native : false)
+
 lsof = find_program('lsof', native : true)
 
 # This is how Nix does generated headers...

meson.options

@@ -24,6 +24,10 @@ option('sandbox-shell', type : 'string', value : 'busybox',
   description : 'path to a statically-linked shell to use as /bin/sh in sandboxes (usually busybox)',
 )
 
+option('pasta-path', type : 'string', value : 'pasta',
+  description : 'path to the location of pasta (provided by passt)',
+)
+
 option('enable-tests', type : 'boolean', value : true,
   description : 'whether to enable tests or not (requires rapidcheck and gtest)',
 )

misc/passt.nix

@@ -0,0 +1,64 @@
+{
+  lib,
+  stdenv,
+  buildPackages,
+  fetchurl,
+  getconf,
+  gitUpdater,
+  testers,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "passt";
+  version = "2025_02_17.a1e48a0";
+
+  src = fetchurl {
+    url = "https://passt.top/passt/snapshot/passt-${finalAttrs.version}.tar.gz";
+    hash = "sha256-/FUXxeYv3Lb0DiXmbS2PUzfLL5ZwHJ42tiuH7YnlljE=";
+  };
+
+  postPatch = ''
+    substituteInPlace Makefile --replace-fail \
+      'PAGE_SIZE=$(shell getconf PAGE_SIZE)' \
+      "PAGE_SIZE=$(${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe getconf} PAGE_SIZE)"
+  '';
+
+  makeFlags = [
+    "prefix=${placeholder "out"}"
+    "VERSION=${finalAttrs.version}"
+  ];
+
+  passthru = {
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+    };
+
+    updateScript = gitUpdater {
+      url = "https://passt.top/passt";
+    };
+  };
+
+  meta = with lib; {
+    homepage = "https://passt.top/passt/about/";
+    description = "Plug A Simple Socket Transport";
+    longDescription = ''
+      passt implements a translation layer between a Layer-2 network interface
+      and native Layer-4 sockets (TCP, UDP, ICMP/ICMPv6 echo) on a host.
+      It doesn't require any capabilities or privileges, and it can be used as
+      a simple replacement for Slirp.
+
+      pasta (same binary as passt, different command) offers equivalent
+      functionality, for network namespaces: traffic is forwarded using a tap
+      interface inside the namespace, without the need to create further
+      interfaces on the host, hence not requiring any capabilities or
+      privileges.
+    '';
+    license = [
+      licenses.bsd3 # and
+      licenses.gpl2Plus
+    ];
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ _8aed ];
+    mainProgram = "passt";
+  };
+})

misc/systemd/nix-daemon.conf.in

@@ -1 +1,2 @@
-d @localstatedir@/nix/daemon-socket 0755 root root - -
+d @localstatedir@/nix/daemon-socket 0755 root root -  -
+d @localstatedir@/nix/builds        0755 root root 7d -

package.nix

@@ -45,6 +45,8 @@
   ninja,
   ncurses,
   openssl,
+  # FIXME: we need passt 2024_12_11.09478d5 or newer, i.e. nixos 25.05 or later
+  passt-lix ? __forDefaults.passt-lix,
   pegtl,
   pkg-config,
   python3,
@@ -116,6 +118,8 @@
     # needs derivation patching to add debuginfo and coroutine library support
     # !! must build this with clang as it is affected by the gcc coroutine bugs
     capnproto-lix = callPackage ./misc/capnproto.nix { inherit stdenv; };
+
+    passt-lix = callPackage ./misc/passt.nix { };
   },
 }:
 
@@ -131,10 +135,10 @@ let
 
   # This could be the dtrace for macOS, etc, but I have no idea if it is
   # packaged or if it works.
-  dtrace-generator = lib.optional withDtrace systemtap-lix;
+  dtrace-generator = if withDtrace then systemtap-lix else null;
 
   # This is for sys/sdt.h
-  dtrace-headers = lib.optional withDtrace libsystemtap;
+  dtrace-headers = if withDtrace then libsystemtap else null;
 
   aws-sdk-cpp-nix =
     if aws-sdk-cpp == null then
@@ -205,6 +209,8 @@ assert (lintInsteadOfBuild -> lix-clang-tidy != null);
 stdenv.mkDerivation (finalAttrs: {
   inherit pname version;
 
+  __structuredAttrs = true;
+
   src = fileset.toSource {
     root = ./.;
     fileset = fileset.intersection baseFiles (
@@ -225,8 +231,6 @@ stdenv.mkDerivation (finalAttrs: {
     );
   };
 
-  VERSION_SUFFIX = versionSuffix;
-
   outputs =
     [ "out" ]
     ++ lib.optionals (!finalAttrs.dontBuild) [
@@ -247,6 +251,7 @@ stdenv.mkDerivation (finalAttrs: {
       # which don't actually get added to PATH. And buildInputs is correct over
       # nativeBuildInputs since this should be a busybox executable on the host.
       "-Dsandbox-shell=${lib.getExe' busybox-sandbox-shell "busybox"}"
+      "-Dpasta-path=${lib.getExe' passt-lix "pasta"}"
     ]
     ++ lib.optional hostPlatform.isStatic "-Denable-embedded-sandbox-shell=true"
     ++ lib.optional (finalAttrs.dontBuild && !lintInsteadOfBuild) "-Denable-build=false"
@@ -332,6 +337,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals hostPlatform.isLinux [
       libseccomp
       busybox-sandbox-shell
+      passt-lix
     ]
     ++ lib.optionals (
       stdenv.hostPlatform.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinSdkVersion "11.0"
@@ -358,9 +364,9 @@ stdenv.mkDerivation (finalAttrs: {
     lixPythonForBuild
   ];
 
-  # Needed for Meson to find Boost.
-  # https://github.com/NixOS/nixpkgs/issues/86131.
   env = {
+    # Needed for Meson to find Boost.
+    # https://github.com/NixOS/nixpkgs/issues/86131.
     BOOST_INCLUDEDIR = "${lib.getDev boost}/include";
     BOOST_LIBRARYDIR = "${lib.getLib boost}/lib";
 
@@ -368,6 +374,8 @@ stdenv.mkDerivation (finalAttrs: {
     # Turns out the Nix-generated Cargo dependencies are named the same as they
     # would be in a Cargo registry cache.
     MESON_PACKAGE_CACHE_DIR = finalAttrs.cargoDeps;
+
+    VERSION_SUFFIX = versionSuffix;
   };
 
   cargoDeps = rustPlatform.importCargoLock { lockFile = ./Cargo.lock; };

tests/functional/build-remote-trustless-should-fail-0.sh

@@ -8,7 +8,6 @@ requireSandboxSupport
 [[ $busybox =~ busybox ]] || skipTest "no busybox"
 
 unset NIX_STORE_DIR
-unset NIX_STATE_DIR
 
 # We first build a dependency of the derivation we eventually want to
 # build.

tests/functional/build-remote-trustless.sh

@@ -2,7 +2,6 @@ requireSandboxSupport
 [[ $busybox =~ busybox ]] || skipTest "no busybox"
 
 unset NIX_STORE_DIR
-unset NIX_STATE_DIR
 
 remoteDir=$TEST_ROOT/remote
 

tests/functional/build-remote.sh

@@ -3,7 +3,6 @@ requireSandboxSupport
 
 # Avoid store dir being inside sandbox build-dir
 unset NIX_STORE_DIR
-unset NIX_STATE_DIR
 
 function join_by { local d=$1; shift; echo -n "$1"; shift; printf "%s" "${@/#/$d}"; }
 
@@ -81,4 +80,4 @@ out="$(nix-build 2>&1 failing.nix \
 [[ "$out" =~ .*"note: keeping build directory".* ]]
 
 build_dir="$(grep "note: keeping build" <<< "$out" | sed -E "s/^(.*)note: keeping build directory '(.*)'(.*)$/\2/")"
-[[ "foo" = $(<"$build_dir"/bar) ]]
+[[ "foo" = $(<"$build_dir"/b/bar) ]]

tests/functional/build.sh

@@ -174,3 +174,28 @@ test "$(<<<"$out" grep -E '^error:' | wc -l)" = 3
 <<<"$out" grepQuiet -E "error: 2 dependencies of derivation '.*-x4\\.drv' failed to build"
 <<<"$out" grepQuiet -vE "hash mismatch in fixed-output derivation '.*-x3\\.drv'"
 <<<"$out" grepQuiet -vE "hash mismatch in fixed-output derivation '.*-x2\\.drv'"
+
+# Ensure when if the system build dir is inaccessible, we can still build things
+BUILD_DIR=$(mktemp -d)
+chmod 0000 "$BUILD_DIR"
+nix --build-dir "$BUILD_DIR" build -E 'with import ./config.nix; mkDerivation { name = "test"; buildCommand = "echo rawr > $out"; }' --impure --no-link
+
+# ensure that the build directory parent is not world-accessible
+chmod 0755 "$BUILD_DIR"
+FIFO="$BUILD_DIR/fifo"
+mkfifo "$FIFO"
+(
+  echo > "$FIFO"
+  trap 'echo > "$FIFO"' EXIT
+  mode=$(stat -c %a $BUILD_DIR/b/*)
+  [ "$mode" = "700" -o "$mode" = "710" ]
+) &
+nix build --build-dir "$BUILD_DIR/b" -E '
+  with import ./config.nix; mkDerivation {
+    name = "test";
+    buildCommand = "cat '"$FIFO"'; cat '"$FIFO"' > $out";
+  }' \
+  --extra-sandbox-paths "$FIFO" \
+  --impure \
+  --no-link
+wait

tests/functional/check.sh

@@ -45,31 +45,10 @@ test_custom_build_dir() {
   [ "$status" = "100" ]
   [[ 1 == "$(count "$customBuildDir/nix-build-"*)" ]]
   local buildDir="$customBuildDir/nix-build-"*
-  grep $checkBuildId $buildDir/checkBuildId
+  grep $checkBuildId $buildDir/b/checkBuildId
 }
 test_custom_build_dir
 
-test_custom_temp_dir() {
-  # like test_custom_build_dir(), but uses the temp-dir setting instead
-  # build-dir inherits from temp-dir when build-dir is unset
-  local customTempDir="$TEST_ROOT/custom-temp-dir"
-
-  mkdir "$customTempDir"
-  nix-build check.nix -A failed --argstr checkBuildId $checkBuildId \
-      --no-out-link --keep-failed --option temp-dir "$customTempDir" 2> $TEST_ROOT/log || status=$?
-  [ "$status" = "100" ]
-  [[ 1 == "$(count "$customTempDir/nix-build-"*)" ]]
-  local buildDir="$customTempDir/nix-build-"*
-  grep $checkBuildId $buildDir/checkBuildId
-
-  # also check a separate code path that doesn't involve build-dir
-  # nix-shell uses temp-dir for its rcfile path
-  rcpath=$(NIX_BUILD_SHELL=$SHELL nix-shell check.nix -A deterministic --option temp-dir "$customTempDir" --run 'echo $0' 2> $TEST_ROOT/log)
-  # rcpath is <temp-dir>/nix-shell-*/rc
-  [[ $rcpath = "$customTempDir"/* ]]
-}
-test_custom_temp_dir
-
 test_shell_preserves_tmpdir() {
   # ensure commands that spawn interactive shells don't overwrite TMPDIR with temp-dir
   local envTempDir=$TEST_ROOT/shell-temp-dir-env

tests/functional/supplementary-groups.sh

@@ -10,7 +10,6 @@ unshare --mount --map-root-user bash <<EOF
 
   # Avoid store dir being inside sandbox build-dir
   unset NIX_STORE_DIR
-  unset NIX_STATE_DIR
 
   setLocalStore () {
     export NIX_REMOTE=\$TEST_ROOT/\$1

tests/nixos/ca-fd-leak/default.nix

@@ -1,90 +0,0 @@
-# Nix is a sandboxed build system. But Not everything can be handled inside its
-# sandbox: Network access is normally blocked off, but to download sources, a
-# trapdoor has to exist. Nix handles this by having "Fixed-output derivations".
-# The detail here is not important, but in our case it means that the hash of
-# the output has to be known beforehand. And if you know that, you get a few
-# rights: you no longer run inside a special network namespace!
-#
-# Now, Linux has a special feature, that not many other unices do: Abstract
-# unix domain sockets! Not only that, but those are namespaced using the
-# network namespace! That means that we have a way to create sockets that are
-# available in every single fixed-output derivation, and also all processes
-# running on the host machine! Now, this wouldn't be that much of an issue, as,
-# well, the whole idea is that the output is pure, and all processes in the
-# sandbox are killed before finalizing the output. What if we didn't need those
-# processes at all? Unix domain sockets have a semi-known trick: you can pass
-# file descriptors around!
-# This makes it possible to exfiltrate a file-descriptor with write access to
-# $out outside of the sandbox. And that file-descriptor can be used to modify
-# the contents of the store path after it has been registered.
-
-{ config, ... }:
-
-let
-  pkgs = config.nodes.machine.nixpkgs.pkgs;
-
-  # Simple C program that sends a a file descriptor to `$out` to a Unix
-  # domain socket.
-  # Compiled statically so that we can easily send it to the VM and use it
-  # inside the build sandbox.
-  sender = pkgs.runCommandWith {
-    name = "sender";
-    stdenv = pkgs.pkgsStatic.stdenv;
-  } ''
-    $CC -static -o $out ${./sender.c}
-  '';
-
-  # Okay, so we have a file descriptor shipped out of the FOD now. But the
-  # Nix store is read-only, right? .. Well, yeah. But this file descriptor
-  # lives in a mount namespace where it is not! So even when this file exists
-  # in the actual Nix store, we're capable of just modifying its contents...
-  smuggler = pkgs.writeCBin "smuggler" (builtins.readFile ./smuggler.c);
-
-  # The abstract socket path used to exfiltrate the file descriptor
-  socketName = "FODSandboxExfiltrationSocket";
-in
-{
-  name = "ca-fd-leak";
-
-  nodes.machine =
-    { config, lib, pkgs, ... }:
-    { virtualisation.writableStore = true;
-      nix.settings.substituters = lib.mkForce [ ];
-      virtualisation.additionalPaths = [ pkgs.busybox-sandbox-shell sender smuggler pkgs.socat ];
-    };
-
-  testScript = { nodes }: ''
-    start_all()
-
-    machine.succeed("echo hello")
-    # Start the smuggler server
-    machine.succeed("${smuggler}/bin/smuggler ${socketName} >&2 &")
-
-    # Build the smuggled derivation.
-    # This will connect to the smuggler server and send it the file descriptor
-    machine.succeed(r"""
-      nix-build -E '
-        builtins.derivation {
-          name = "smuggled";
-          system = builtins.currentSystem;
-          # look ma, no tricks!
-          outputHashMode = "flat";
-          outputHashAlgo = "sha256";
-          outputHash = builtins.hashString "sha256" "hello, world\n";
-          builder = "${pkgs.busybox-sandbox-shell}/bin/sh";
-          args = [ "-c" "echo \"hello, world\" > $out; ''${${sender}} ${socketName}" ];
-      }'
-    """.strip())
-
-
-    # Tell the smuggler server that we're done
-    machine.execute("echo done | ${pkgs.socat}/bin/socat - ABSTRACT-CONNECT:${socketName}")
-
-    # Check that the file was not modified
-    machine.succeed(r"""
-      cat ./result
-      test "$(cat ./result)" = "hello, world"
-    """.strip())
-  '';
-
-}

tests/nixos/ca-fd-leak/sender.c

@@ -1,65 +0,0 @@
-#include <sys/socket.h>
-#include <sys/un.h>
-#include <stdlib.h>
-#include <stddef.h>
-#include <stdio.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <string.h>
-#include <assert.h>
-
-int main(int argc, char **argv) {
-
-    assert(argc == 2);
-
-    int sock = socket(AF_UNIX, SOCK_STREAM, 0);
-
-    // Set up a abstract domain socket path to connect to.
-    struct sockaddr_un data;
-    data.sun_family = AF_UNIX;
-    data.sun_path[0] = 0;
-    strcpy(data.sun_path + 1, argv[1]);
-
-    // Now try to connect, To ensure we work no matter what order we are
-    // executed in, just busyloop here.
-    int res = -1;
-    while (res < 0) {
-        res = connect(sock, (const struct sockaddr *)&data,
-            offsetof(struct sockaddr_un, sun_path)
-              + strlen(argv[1])
-              + 1);
-        if (res < 0 && errno != ECONNREFUSED) perror("connect");
-        if (errno != ECONNREFUSED) break;
-    }
-
-    // Write our message header.
-    struct msghdr msg = {0};
-    msg.msg_control = malloc(128);
-    msg.msg_controllen = 128;
-
-    // Write an SCM_RIGHTS message containing the output path.
-    struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg);
-    hdr->cmsg_len = CMSG_LEN(sizeof(int));
-    hdr->cmsg_level = SOL_SOCKET;
-    hdr->cmsg_type = SCM_RIGHTS;
-    int fd = open(getenv("out"), O_RDWR | O_CREAT, 0640);
-    memcpy(CMSG_DATA(hdr), (void *)&fd, sizeof(int));
-
-    msg.msg_controllen = CMSG_SPACE(sizeof(int));
-
-    // Write a single null byte too.
-    msg.msg_iov = malloc(sizeof(struct iovec));
-    msg.msg_iov[0].iov_base = "";
-    msg.msg_iov[0].iov_len = 1;
-    msg.msg_iovlen = 1;
-
-    // Send it to the othher side of this connection.
-    res = sendmsg(sock, &msg, 0);
-    if (res < 0) perror("sendmsg");
-    int buf;
-
-    // Wait for the server to close the socket, implying that it has
-    // received the commmand.
-    recv(sock, (void *)&buf, sizeof(int), 0);
-}

tests/nixos/ca-fd-leak/smuggler.c

@@ -1,66 +0,0 @@
-#include <sys/socket.h>
-#include <sys/un.h>
-#include <stdlib.h>
-#include <stddef.h>
-#include <stdio.h>
-#include <unistd.h>
-#include <assert.h>
-
-int main(int argc, char **argv) {
-
-    assert(argc == 2);
-
-    int sock = socket(AF_UNIX, SOCK_STREAM, 0);
-
-    // Bind to the socket.
-    struct sockaddr_un data;
-    data.sun_family = AF_UNIX;
-    data.sun_path[0] = 0;
-    strcpy(data.sun_path + 1, argv[1]);
-    int res = bind(sock, (const struct sockaddr *)&data,
-        offsetof(struct sockaddr_un, sun_path)
-        + strlen(argv[1])
-        + 1);
-    if (res < 0) perror("bind");
-
-    res = listen(sock, 1);
-    if (res < 0) perror("listen");
-
-    int smuggling_fd = -1;
-
-    // Accept the connection a first time to receive the file descriptor.
-    fprintf(stderr, "%s\n", "Waiting for the first connection");
-    int a = accept(sock, 0, 0);
-    if (a < 0) perror("accept");
-
-    struct msghdr msg = {0};
-    msg.msg_control = malloc(128);
-    msg.msg_controllen = 128;
-
-    // Receive the file descriptor as sent by the smuggler.
-    recvmsg(a, &msg, 0);
-
-    struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg);
-    while (hdr) {
-        if (hdr->cmsg_level == SOL_SOCKET
-          && hdr->cmsg_type == SCM_RIGHTS) {
-
-            // Grab the copy of the file descriptor.
-            memcpy((void *)&smuggling_fd, CMSG_DATA(hdr), sizeof(int));
-        }
-
-        hdr = CMSG_NXTHDR(&msg, hdr);
-    }
-    fprintf(stderr, "%s\n", "Got the file descriptor. Now waiting for the second connection");
-    close(a);
-
-    // Wait for a second connection, which will tell us that the build is
-    // done
-    a = accept(sock, 0, 0);
-    fprintf(stderr, "%s\n", "Got a second connection, rewriting the file");
-    // Write a new content to the file
-    if (ftruncate(smuggling_fd, 0)) perror("ftruncate");
-    char * new_content = "Pwned\n";
-    int written_bytes = write(smuggling_fd, new_content, strlen(new_content));
-    if (written_bytes != strlen(new_content)) perror("write");
-}

tests/nixos/chown-to-user.nix

@@ -0,0 +1,74 @@
+{ lib, config, pkgs, ... }:
+
+let
+  failedNormal = config: pkgs.writeText "failed.nix" ''
+    let utils = builtins.storePath ${config.system.build.extraUtils}; in
+    derivation {
+      name = "failed";
+      system = builtins.currentSystem;
+      PATH = "''${utils}/bin";
+      builder = "''${utils}/bin/sh";
+      args = [ "-c" "mkdir dir; echo test > dir/file" ];
+    }
+  '';
+
+  failedBuiltin = pkgs.writeText "failed.nix" ''
+    derivation {
+      name = "failed";
+      system = builtins.currentSystem;
+      builder = "builtin:fetchurl";
+      url = "http://localhost/foo";
+      outputHashMode = "flat";
+    }
+  '';
+in
+{
+  name = "chown-to-user";
+
+  nodes = {
+    machine = { lib, pkgs, ... }: {
+      virtualisation.writableStore = true;
+
+      users.users.test = {
+        isNormalUser = true;
+        group = "test";
+      };
+      users.groups.test = {};
+      nix.nrBuildUsers = 1;
+    };
+  };
+
+  testScript = { nodes, ... }: ''
+    import re
+
+    machine.wait_for_unit("multi-user.target")
+
+    # builds using the daemon chown tempdirs
+    out = machine.fail("runuser -u test -- nix-build ${failedNormal nodes.machine} --keep-failed 2>&1")
+    dir = re.search("keeping build directory '(.+?)'", out)
+    assert dir
+    assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}").strip() == "root:nixbld:755"
+    assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}/b").strip() == "test:test:700"
+    assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}/b/dir").strip() == "test:test:755"
+    assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}/b/dir/file").strip() == "test:test:644"
+
+    # builds not using the daemon do not chown tempdirs
+    out = machine.fail("NIX_REMOTE=local nix-build ${failedNormal nodes.machine} --keep-failed 2>&1")
+    dir = re.search("keeping build directory '(.+?)'", out)
+    assert dir
+    assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}").strip() == "root:nixbld:755"
+    assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}/b").strip() == "nixbld1:nixbld:700"
+    assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}/b/dir").strip() == "nixbld1:nixbld:755"
+    assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}/b/dir/file").strip() == "nixbld1:nixbld:644"
+
+    # builds using builtin builders using the daemon do not keep tempdirs
+    out = machine.fail("runuser -u test -- nix-build ${failedBuiltin} --keep-failed 2>&1")
+    dir = re.search("keeping build directory '(.+?)'", out)
+    assert not dir
+
+    # builds using builtin builders not using the daemon do not keep tempdirs
+    out = machine.fail("NIX_REMOTE=local nix-build ${failedBuiltin} --keep-failed 2>&1")
+    dir = re.search("keeping build directory '(.+?)'", out)
+    assert not dir
+  '';
+}

tests/nixos/default.nix

@@ -165,8 +165,6 @@ in
     ["i686-linux" "x86_64-linux"]
     (system: runNixOSTestFor system ./setuid/setuid.nix);
 
-  ca-fd-leak = runNixOSTestFor "x86_64-linux" ./ca-fd-leak;
-
   fetch-git = runNixOSTestFor "x86_64-linux" ./fetch-git;
 
   symlinkResolvconf = runNixOSTestFor "x86_64-linux" ./symlink-resolvconf.nix;
@@ -182,4 +180,6 @@ in
   io_uring = runNixOSTestFor "x86_64-linux" ./io_uring;
 
   fetchurl = runNixOSTestFor "x86_64-linux" ./fetchurl.nix;
+
+  chown-to-user = runNixOSTestFor "x86_64-linux" ./chown-to-user.nix;
 }

tests/nixos/fetchurl.nix

@@ -52,7 +52,7 @@ in
 
       security.pki.certificateFiles = [ "${goodCert}/cert.pem" ];
 
-      networking.hosts."127.0.0.1" = [ "good" "bad" ];
+      networking.hosts."192.168.1.1" = [ "good" "bad" ];
 
       virtualisation.writableStore = true;
 

version.json

@@ -1,5 +1,5 @@
 {
-    "version": "2.93.0",
-    "official_release": false,
+    "version": "2.93.3",
+    "official_release": true,
     "release_name": "Bici Bici"
 }