piegamesandeldritch horrors
567348a90c
This commit enables the parametrization for "legacy-combined" protocol. All failing tests with that have been either fixed or disabled. Notably: - A couple of tests (e.g. involving builders) could be made to work with a non-local store, but this would require some refactoring to testlib in order to make certain configuration settings generic over local and remote operations. We've disabled those for now, in order to make progress - The store tests all run locally only because of their nature - The flakes tests also all run locally only because my energy for fixing them is limited (and it's a *lot* of test failures, with probably little overall benefit in terms of test coverage) Change-Id: I56fa249a64f7c17c952f688ec89e9687f2a13f12
44 lines
1.1 KiB
Python
44 lines
1.1 KiB
Python
import os
|
|
import stat
|
|
from pathlib import Path
|
|
|
|
from testlib.fixtures.file_helper import with_files
|
|
from testlib.fixtures.nix import Nix
|
|
from testlib.utils import get_global_asset
|
|
|
|
import pytest
|
|
|
|
pytestmark = pytest.mark.no_daemon
|
|
|
|
|
|
@with_files({"config.nix": get_global_asset("config.nix")})
|
|
def test_build_dir_permissions(nix: Nix):
|
|
"""
|
|
ensure that the build directory parent is not world-accessible
|
|
"""
|
|
|
|
build_dir = nix.env.dirs.home / "build-dir"
|
|
build_dir.mkdir(0o755)
|
|
fifo = build_dir / "fifo"
|
|
os.mkfifo(fifo)
|
|
expr = f"""
|
|
with import ./config.nix; mkDerivation {{
|
|
name = "test";
|
|
buildCommand = "echo >'{fifo}'; cat '{fifo}' > $out";
|
|
}}
|
|
"""
|
|
|
|
nix.settings.add_xp_feature("nix-command")
|
|
nix.settings.extra_sandbox_paths = [str(fifo)]
|
|
|
|
build = nix.nix(["build", "--build-dir", f"{build_dir}/b", "-E", expr, "--impure"]).start()
|
|
|
|
fifo.read_text()
|
|
try:
|
|
child_dir = Path(next(iter((build_dir / "b").iterdir())))
|
|
assert stat.S_IMODE(child_dir.stat().st_mode) in [0o700, 0o710]
|
|
finally:
|
|
fifo.write_text("")
|
|
|
|
build.wait().ok()
|