1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

import os
import stat
from pathlib import Path

from testlib.fixtures.file_helper import with_files
from testlib.fixtures.nix import Nix
from testlib.utils import get_global_asset


@with_files({"config.nix": get_global_asset("config.nix")})
def test_build_dir_permissions(nix: Nix):
    """
    ensure that the build directory parent is not world-accessible
    """

    build_dir = nix.env.dirs.home / "build-dir"
    build_dir.mkdir(0o755)
    fifo = build_dir / "fifo"
    os.mkfifo(fifo)
    expr = f"""
        with import ./config.nix; mkDerivation {{
            name = "test";
            buildCommand = "echo >'{fifo}'; cat '{fifo}' > $out";
        }}
    """

    nix.settings.add_xp_feature("nix-command")
    nix.settings.extra_sandbox_paths = [str(fifo)]

    build = nix.nix(["build", "--build-dir", f"{build_dir}/b", "-E", expr, "--impure"]).start()

    fifo.read_text()
    try:
        child_dir = Path(next(iter((build_dir / "b").iterdir())))
        assert stat.S_IMODE(child_dir.stat().st_mode) in [0o700, 0o710]
    finally:
        fifo.write_text("")

    build.wait().ok()