Raito Bezarius
fd35e86fc5
If `settings.buildDir` cannot be written to, because we are in a chroot store, unprivileged or anything. We can and should always gracefully fallback to a *secure* location inside of /tmp, i.e. `/tmp/<a directory under 0700>/<our temporary directory for build under 0700>/...`. This does not reintroduce CVE-2025-52991 because we are creating a directory in-between compared to creating only ONE level of directory. Fixes #876. Change-Id: Ie521202923f763225e1901ab1b9b6c6132aaf548 Signed-off-by: Raito Bezarius <raito@lix.systems>
1.1 KiB
1.1 KiB
synopsis, issues, cls, category, credits
| synopsis | issues | cls | category | credits | ||||
|---|---|---|---|---|---|---|---|---|
| Fallback to safe temp dir when build-dir is unwritable |
|
|
Fixes |
|
Non-daemon builds started failing with a permission error after introducing the build-dir option:
$ nix build --store ~/scratch nixpkgs#hello --rebuild
error: creating directory '/nix/var/nix/builds/nix-build-hello-2.12.2.drv-0': Permission denied
This happens because:
- These builds are not run via the daemon, which owns
/nix/var/nix/builds. - The user lacks permissions for that path.
We considered making build-dir a store-level option and defaulting it to <chroot-root>/nix/var/nix/builds for chroot stores, but opted instead for a fallback: if the default fails, Nix now creates a safe build directory under /tmp.
To avoid CVE-2025-52991, the fallback uses an extra path component between /tmp and the build dir.
Note: this fallback clutters /tmp with build directories that are not cleaned up. To prevent this, explicitly set build-dir to a path managed by Lix, even for local workloads.