Raito Bezariusandeldritch horrors b6d5e3f05a libstore/platform/linux: allow xattrs in the sandbox
Fixes #838.

xattrs were historically disabled in 2017, since then, NFS v4.2 gained
support for xattrs and almost all filesystems support xattrs. In
addition, moving the build directory to a xattrs-supporting filesystem
is always an option. Programs may exploit xattrs (including ACLs) during
their build process and testing phase, to better serve these programs,
we will remove this limitation.

Lix will use POSIX ACLs for its UNIX domain sockets in the future and be
one of these programs which will run tests making use of xattrs, while
not writing any xattrs in the derivation outputs themselves.

xattrs are still scrubbed from derivation outputs so it is not possible
to obtain an advantage by writing a security-related xattr to a well
chosen file.

Tests were added to test these scenarios on Linux. Darwin is carefully
excluded because of #1008 and #1090, solving that is welcome. In the
meantime, they are marked xfail.

Change-Id: Ia3255eeb8442e83db4f10dcb5a51cbc368a2550d
Signed-off-by: Raito Bezarius <raito@lix.systems>
2026-01-15 16:40:47 +01:00
2025-09-29 15:22:41 +02:00
2025-12-29 17:55:16 +00:00
2025-12-17 20:59:59 +01:00
2025-07-14 18:20:47 -07:00
2025-12-29 21:24:05 +00:00
2024-11-04 13:46:10 +01:00
2024-03-29 22:57:40 -07:00
2024-04-08 13:00:00 -07:00
2025-12-17 20:59:59 +01:00
2025-12-17 20:59:59 +01:00
2025-03-18 04:20:00 +00:00
2024-12-30 07:25:23 -08:00
2026-01-10 00:07:33 +00:00
2025-11-17 13:33:35 -08:00

Lix

Lix is an implementation of Nix, a powerful package management system for Linux and other Unix systems that makes package management reliable and reproducible.

Read more about us at https://lix.systems.

Installation

On Linux and macOS the easiest way to install Lix is to run the following shell command (as a user other than root):

$ curl -sSf -L https://install.lix.systems/lix | sh -s -- install

For systems that already have a Nix implementation installed, such as NixOS systems, read our install page

Building And Developing

See our Hacking guide in our manual for instruction on how to set up a development environment and build Lix from source.

Additional Resources

License

Lix is released under LGPL-2.1-or-later.

S
Description
Working fork of Lix - carries the adaptive load-aware build-remote patch. Upstream: gerrit.lix.systems
Readme
92 MiB
Languages
C++ 74.9%
Python 11.7%
Nix 6.1%
Shell 3.6%
Meson 2%
Other 1.6%