Docker's default seccomp filter prevents use of the ADDR_NO_RANDOMIZE flag
with the personality system call.  It causes personality to return EPERM.  In
general, we assume that any result other than the only documented one, EINVAL,
is caused by seccomp.  If we detect that ADDR_NO_RANDOMIZE is blocked, and the
--allow-aslr option was passed, we simply don't use it.

This allows guix-daemon to continue to work even in these containers, without
any implicit weakening of reproducibility.

Since it is presumably desirable to be able to build guix itself in such an
environment, also pass --allow-aslr to guix-daemon in test-env.

* nix/libstore/globals.hh (Settings::allowASLR): new field.
* nix/nix-daemon/guix-daemon.cc (options): add --allow-aslr option.
  (parse_opt): use it to set Settings::allowASLR.
* nix/libstore/build.cc (DerivationGoal::startBuilder): detect when
  ADDR_NO_RANDOMIZE is blocked and --allow-aslr is passed and don't use it in
  that case.
* doc/guix.texi: document --allow-aslr in "Invoking guix-daemon".
* build-aux/test-env.in: always pass --allow-aslr.

Fixes: guix/guix#3917
Change-Id: I51c5899a9559e161f9e107c2e6a36df395ab3134
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Modified-by: Ludovic Courtès <ludo@gnu.org>
Merges: #4616

* tests/keys/*.(pub|sec): Move to tests/keys/openpgp/*.(pub|sec)
* build-aux/test-env.in: Adapt accordingly.
* Makefile.am: Likewise.
* guix/tests/gnupg.scm: Likewise.
* tests/guix-authenticate.sh: Likewise.
* tests/openpgp.scm: Likewise.

Change-Id: If8897cec9851cc51a4ebadcc5927dc0e0520b881
Reviewed-by: Danny Milosavljevic <dannym@friendly-machines.com>
Signed-off-by: Nguyễn Gia Phong <cnx@loang.net>

* build-aux/test-env.in: Pass ‘--disable-chroot’ only when unprivileged
user namespace support is lacking and warn in that case.
* tests/store.scm ("build-things, check mode"): Use ‘gettimeofday’
rather than a shared file as a source of entropy.
("symlink is symlink")
("isolated environment", "inputs are read-only")
("inputs cannot be remounted read-write")
("build root cannot be made world-readable")
("/tmp, store, and /dev/{null,full} are writable")
("network is unreachable"): New tests.
* tests/processes.scm ("client + lock"): Skip when
‘unprivileged-user-namespace-supported?’ returns true.

Change-Id: I3b3c3ebdf6db5fd36ee70251d07b893c17ca1b84

With the weak isolation available to the test daemon, it is essential to
disallow untrusted access to it, as otherwise another local user can gain our
user's credentials easily.

* build-aux/test-env.in: ensure the daemon-socket directory is freshly-created
  with 0700 permissions.

Change-Id: I742f70fc6fc28e5b4dc88d590eef3daf1b964670
Signed-off-by: Ludovic Courtès <ludo@gnu.org>

The third key will be used in an upcoming commit.

Rename public keys to .pub.

* guix/tests/gnupg.scm (%ed25519-3-public-key-file): New variable.
(%ed25519-3-secret-key-file): New variable.
(%ed25519-2-public-key-file): Renamed from %ed25519bis-public-key-file.
(%ed25519-2-secret-key-file): Renamed from %ed25519bis-secret-key-file.
* tests/keys/ed25519-3.key: New file.
* tests/keys/ed25519-3.sec: New file.

Signed-off-by: Mathieu Othacehe <othacehe@gnu.org>

This importer has suffered from bitrot and no longer works with current
Nix and Nixpkgs.  See <https://bugs.gnu.org/32339> and
<https://bugs.gnu.org/36255>.

* guix/import/snix.scm, guix/scripts/import/nix.scm,
tests/snix.scm: Remove.
* Makefile.am (MODULES, SCM_TESTS): Remove them.
* guix/scripts/import.scm (importers): Remove "nix".
* build-aux/test-env.in: Remove NIXPKGS variable.
* configure.ac: Remove '--with-nixpkgs' option.
* doc/guix.texi (Invoking guix import): Remove bit about "guix import
nix".
* etc/completion/fish/guix.fish: Likewise.

* build-aux/test-env.in: Remove references to 'NIX_LOCALSTATE_DIR'.

This is a followup to 2e3e5d21988fc2cafb2a9eaf4b00976ea425629d.

* build-aux/test-env.in: Remove mentions of 'NIX_ROOT_FINDER'.
* nix/libstore/gc.cc (LocalStore::collectGarbage): Adjust comment
accordingly.

Fixes <https://bugs.gnu.org/22459>.
Reported by Jeff Mickey <j@codemac.net>.

* guix/config.scm.in (%state-directory): Change NIX_STATE_DIR to
GUIX_STATE_DIRECTORY.
(%store-database-directory): Change NIX_DB_DIR to
GUIX_DATABASE_DIRECTORY.
* nix/libstore/globals.cc (Settings::processEnvironment): Likewise.
* guix/self.scm (make-config.scm): Likewise.
* build-aux/build-self.scm (make-config.scm): Likewise.
* build-aux/test-env.in: Likewise.
* tests/derivations.scm ("derivation #:leaked-env-vars"): Likewise.
* tests/guix-build.sh (GUIX_DAEMON_SOCKET): Likewise.
* tests/guix-daemon.sh (socket): Likewise.

Reported by uniq10.

* build-aux/test-env.in: Check whether FILE exists before invoking 'guix
download'.