From cb5f4c8d2a01ce32f9b15bf3b41728b36a6738a9 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra
Date: Tue, 9 Aug 2016 20:14:54 +0300
Subject: [PATCH] Build sandbox support etc. unconditionally on Linux.
---
nix/libstore/build.cc | 40 ++++++++++------------------------------
nix/libstore/local-store.cc | 9 ++-------
nix/libutil/affinity.cc | 10 +++++-----
3 files changed, 17 insertions(+), 42 deletions(-)
diff --git a/nix/libstore/build.cc b/nix/libstore/build.cc
index ae78e65..3c48e97 100644
--- a/nix/libstore/build.cc
+++ b/nix/libstore/build.cc
@@ -32,36 +32,18 @@
#include
/* Includes required for chroot support. */
-#if HAVE_SYS_PARAM_H
-#include
-#endif
-#if HAVE_SYS_MOUNT_H
-#include
-#endif
-#if HAVE_SYS_SYSCALL_H
-#include
-#endif
-#if HAVE_SCHED_H
-#include
-#endif
-
-/* In GNU libc 2.11, does not define `MS_PRIVATE', but
- does. */
-#if !defined MS_PRIVATE && defined HAVE_LINUX_FS_H
-#include
-#endif
-
-#define CHROOT_ENABLED HAVE_CHROOT && HAVE_SYS_MOUNT_H && defined(MS_BIND) && defined(MS_PRIVATE) && defined(CLONE_NEWNS) && defined(SYS_pivot_root)
-
-#if CHROOT_ENABLED
+#if __linux__
#include
#include
#include
#include
-#endif
-
-#if __linux__
#include
+#include
+#include
+#include
+#include
+#include
+#define pivot_root(new_root, put_old) (syscall(SYS_pivot_root, new_root, put_old))
#endif
#if HAVE_STATVFS
@@ -1817,7 +1799,7 @@ void DerivationGoal::startBuilder()
}
if (useChroot) {
-#if CHROOT_ENABLED
+#if __linux__
/* Create a temporary directory in which we set up the chroot
environment using bind-mounts. We put it in the Nix store
to ensure that we can create hard-links to non-directory
@@ -1998,7 +1980,7 @@ void DerivationGoal::startBuilder()
- The UTS namespace ensures that builders see a hostname of
localhost rather than the actual hostname.
*/
-#if CHROOT_ENABLED
+#if __linux__
if (useChroot) {
char stack[32 * 1024];
int flags = CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWIPC | CLONE_NEWUTS | SIGCHLD;
@@ -2046,7 +2028,7 @@ void DerivationGoal::runChild()
commonChildInit(builderOut);
-#if CHROOT_ENABLED
+#if __linux__
if (useChroot) {
/* Initialise the loopback interface. */
AutoCloseFD fd(socket(PF_INET, SOCK_DGRAM, IPPROTO_IP));
@@ -2179,10 +2161,8 @@ void DerivationGoal::runChild()
if (mkdir("real-root", 0) == -1)
throw SysError("cannot create real-root directory");
-#define pivot_root(new_root, put_old) (syscall(SYS_pivot_root, new_root, put_old))
if (pivot_root(".", "real-root") == -1)
throw SysError(format("cannot pivot old root directory onto '%1%'") % (chrootRootDir + "/real-root"));
-#undef pivot_root
if (chroot(".") == -1)
throw SysError(format("cannot change root directory to '%1%'") % chrootRootDir);
diff --git a/nix/libstore/local-store.cc b/nix/libstore/local-store.cc
index 347e8a7..782e4e8 100644
--- a/nix/libstore/local-store.cc
+++ b/nix/libstore/local-store.cc
@@ -22,16 +22,11 @@
#include
#include
-#if HAVE_UNSHARE && HAVE_STATVFS && HAVE_SYS_MOUNT_H
+#if __linux__
#include
#include
#include
-#endif
-
-#if HAVE_LINUX_FS_H
-#include
#include
-#include
#endif
#include
@@ -501,7 +496,7 @@ void LocalStore::openDB(bool create)
bind mount. So make the Nix store writable for this process. */
void LocalStore::makeStoreWritable()
{
-#if HAVE_UNSHARE && HAVE_STATVFS && HAVE_SYS_MOUNT_H && defined(MS_BIND) && defined(MS_REMOUNT)
+#if __linux__
if (getuid() != 0) return;
/* Check if /nix/store is on a read-only mount. */
struct statvfs stat;
diff --git a/nix/libutil/affinity.cc b/nix/libutil/affinity.cc
index 3e21f43..3cbdf87 100644
--- a/nix/libutil/affinity.cc
+++ b/nix/libutil/affinity.cc
@@ -2,14 +2,14 @@
#include "util.hh"
#include "affinity.hh"
-#if HAVE_SCHED_H
+#if __linux__
#include
#endif
namespace nix {
-#if HAVE_SCHED_SETAFFINITY
+#if __linux__
static bool didSaveAffinity = false;
static cpu_set_t savedAffinity;
#endif
@@ -17,7 +17,7 @@ static cpu_set_t savedAffinity;
void setAffinityTo(int cpu)
{
-#if HAVE_SCHED_SETAFFINITY
+#if __linux__
if (sched_getaffinity(0, sizeof(cpu_set_t), &savedAffinity) == -1) return;
didSaveAffinity = true;
printMsg(lvlDebug, format("locking this thread to CPU %1%") % cpu);
@@ -32,7 +32,7 @@ void setAffinityTo(int cpu)
int lockToCurrentCPU()
{
-#if HAVE_SCHED_SETAFFINITY
+#if __linux__
int cpu = sched_getcpu();
if (cpu != -1) setAffinityTo(cpu);
return cpu;
@@ -44,7 +44,7 @@ int lockToCurrentCPU()
void restoreAffinity()
{
-#if HAVE_SCHED_SETAFFINITY
+#if __linux__
if (!didSaveAffinity) return;
if (sched_setaffinity(0, sizeof(cpu_set_t), &savedAffinity) == -1)
printMsg(lvlError, "failed to restore affinity %1%");
--
2.6.4