40 lines
1.1 KiB
Python
40 lines
1.1 KiB
Python
import os
|
|
import stat
|
|
from pathlib import Path
|
|
|
|
from testlib.fixtures.file_helper import with_files
|
|
from testlib.fixtures.nix import Nix
|
|
from testlib.utils import get_global_asset
|
|
|
|
|
|
@with_files({"config.nix": get_global_asset("config.nix")})
|
|
def test_build_dir_permissions(nix: Nix):
|
|
"""
|
|
ensure that the build directory parent is not world-accessible
|
|
"""
|
|
|
|
build_dir = nix.env.dirs.home / "build-dir"
|
|
build_dir.mkdir(0o755)
|
|
fifo = build_dir / "fifo"
|
|
os.mkfifo(fifo)
|
|
expr = f"""
|
|
with import ./config.nix; mkDerivation {{
|
|
name = "test";
|
|
buildCommand = "echo >'{fifo}'; cat '{fifo}' > $out";
|
|
}}
|
|
"""
|
|
|
|
nix.settings.add_xp_feature("nix-command")
|
|
nix.settings.extra_sandbox_paths = [str(fifo)]
|
|
|
|
build = nix.nix(["build", "--build-dir", f"{build_dir}/b", "-E", expr, "--impure"]).start()
|
|
|
|
fifo.read_text()
|
|
try:
|
|
child_dir = Path(next(iter((build_dir / "b").iterdir())))
|
|
assert stat.S_IMODE(child_dir.stat().st_mode) in [0o700, 0o710]
|
|
finally:
|
|
fifo.write_text("")
|
|
|
|
build.wait().ok()
|