guix/nix/libstore/globals.hh, branch python-team Transactional package manager, declarative GNU/Linux distribution, reproducible deployment tool, and more! https://guix.gnu.org daemon: Allow ADDR_NO_RANDOMIZE to be omitted if `--allow-aslr'. 2026-05-27T16:25:16+00:00 Reepca Russelstein reepca@russelstein.xyz 2025-11-06T19:50:34+00:00 f519ddf7330f6dd05c880f0135336a8e9d9ca026 Docker's default seccomp filter prevents use of the ADDR_NO_RANDOMIZE flag with the personality system call. It causes personality to return EPERM. In general, we assume that any result other than the only documented one, EINVAL, is caused by seccomp. If we detect that ADDR_NO_RANDOMIZE is blocked, and the --allow-aslr option was passed, we simply don't use it. This allows guix-daemon to continue to work even in these containers, without any implicit weakening of reproducibility. Since it is presumably desirable to be able to build guix itself in such an environment, also pass --allow-aslr to guix-daemon in test-env. * nix/libstore/globals.hh (Settings::allowASLR): new field. * nix/nix-daemon/guix-daemon.cc (options): add --allow-aslr option. (parse_opt): use it to set Settings::allowASLR. * nix/libstore/build.cc (DerivationGoal::startBuilder): detect when ADDR_NO_RANDOMIZE is blocked and --allow-aslr is passed and don't use it in that case. * doc/guix.texi: document --allow-aslr in "Invoking guix-daemon". * build-aux/test-env.in: always pass --allow-aslr. Fixes: guix/guix#3917 Change-Id: I51c5899a9559e161f9e107c2e6a36df395ab3134 Signed-off-by: Ludovic Courtès <ludo@gnu.org> Modified-by: Ludovic Courtès <ludo@gnu.org> Merges: #4616 
Docker's default seccomp filter prevents use of the ADDR_NO_RANDOMIZE flag
with the personality system call.  It causes personality to return EPERM.  In
general, we assume that any result other than the only documented one, EINVAL,
is caused by seccomp.  If we detect that ADDR_NO_RANDOMIZE is blocked, and the
--allow-aslr option was passed, we simply don't use it.

This allows guix-daemon to continue to work even in these containers, without
any implicit weakening of reproducibility.

Since it is presumably desirable to be able to build guix itself in such an
environment, also pass --allow-aslr to guix-daemon in test-env.

* nix/libstore/globals.hh (Settings::allowASLR): new field.
* nix/nix-daemon/guix-daemon.cc (options): add --allow-aslr option.
  (parse_opt): use it to set Settings::allowASLR.
* nix/libstore/build.cc (DerivationGoal::startBuilder): detect when
  ADDR_NO_RANDOMIZE is blocked and --allow-aslr is passed and don't use it in
  that case.
* doc/guix.texi: document --allow-aslr in "Invoking guix-daemon".
* build-aux/test-env.in: always pass --allow-aslr.

Fixes: guix/guix#3917
Change-Id: I51c5899a9559e161f9e107c2e6a36df395ab3134
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Modified-by: Ludovic Courtès <ludo@gnu.org>
Merges: #4616
daemon: Remove unused entities in globals.{hh, cc}. 2026-02-06T19:49:01+00:00 Congcong Kuo congcong.kuo@gmail.com 2026-01-29T14:39:30+00:00 dab3b8f64cd1b5255aa29150ace86610a13e1097 All these entities are not been used anywhere. * nix/libstore/globals.hh (Settings): Remove 'overrides' member and 'getOverrides' method declaration. (nixVersion): Removed. * nix/libstore/globals.cc (Settings::set): Do not update the 'overrides' map. (Settings::getOverrides): Remove function definition. Change-Id: If7dbb6df79178d2569cda21e1fe5e0ea3d8e59ba Signed-off-by: Ludovic Courtès <ludo@gnu.org> Merges: #6009 
All these entities are not been used anywhere.

* nix/libstore/globals.hh (Settings): Remove 'overrides' member
and 'getOverrides' method declaration.
(nixVersion): Removed.
* nix/libstore/globals.cc (Settings::set): Do not update the 'overrides' map.
(Settings::getOverrides): Remove function definition.

Change-Id: If7dbb6df79178d2569cda21e1fe5e0ea3d8e59ba
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #6009
nix: Spelling corrections. 2026-01-14T08:16:45+00:00 Efraim Flashner efraim@flashner.co.il 2026-01-08T11:55:34+00:00 9efc2a690e5b5ea891457e2ae170597a548a19e6 * nix/libstore/globals.hh, nix/libstore/store-api.hh, nix/libutil/util.hh: Fix misspellings in comments. Change-Id: Id77ea2bde1c2582d1a7bec4ed256ea900998c4b8 
* nix/libstore/globals.hh,
nix/libstore/store-api.hh,
nix/libutil/util.hh: Fix misspellings in comments.

Change-Id: Id77ea2bde1c2582d1a7bec4ed256ea900998c4b8
daemon: Use inline functions and variables instead of extern 2025-11-12T17:34:06+00:00 Congcong Kuo congcong.kuo@gmail.com 2025-10-20T03:39:00+00:00 d1a9fb85a4d46722f06d01bde6f61acae3d9ea7a Avoid separate declarations and definitions for so-called 'global' objects. * nix/libstore/derivations.{cc, hh} (drvHashes): Use inline instead of separate declaration and definition. * nix/libstore/globals.{cc, hh} (settings, nixVersion): Same. * nix/libstore/local-store.hh (drvsLogDir, deduplicationMinSize): Same. * nix/libstore/optimise-store.cc (deduplicationMinSize): Same. * nix/libstore/store-api.{cc, hh} (store): Same. * nix/libutil/archive.{cc, hh} (defaultPathFilter): Same. * nix/libutil/hash.{cc, hh} (base32Chars): Same and modify header files. * nix/libutil/util.{cc, hh} (logType, verbosity, _writeToStderr, _isInterrupted): Same. * nix/local.mk: Modified according to the rename of shared.hh. * nix/nix-daemon/guix-daemon.cc (blockInt, argvSaved, run): Same and modify header files. * nix/nix-daemon/nix-daemon.cc: Modify header files. * nix/nix-daemon/shared.hh: Renamed to nix-daemon.hh Signed-off-by: Ludovic Courtès <ludo@gnu.org> 
Avoid separate declarations and definitions for so-called 'global' objects.

* nix/libstore/derivations.{cc, hh} (drvHashes): Use inline instead of separate
declaration and definition.
* nix/libstore/globals.{cc, hh} (settings, nixVersion): Same.
* nix/libstore/local-store.hh (drvsLogDir, deduplicationMinSize): Same.
* nix/libstore/optimise-store.cc (deduplicationMinSize): Same.
* nix/libstore/store-api.{cc, hh} (store): Same.
* nix/libutil/archive.{cc, hh} (defaultPathFilter): Same.
* nix/libutil/hash.{cc, hh} (base32Chars): Same and modify header files.
* nix/libutil/util.{cc, hh} (logType, verbosity, _writeToStderr,
_isInterrupted): Same.
* nix/local.mk: Modified according to the rename of shared.hh.
* nix/nix-daemon/guix-daemon.cc (blockInt, argvSaved, run): Same and
modify header files.
* nix/nix-daemon/nix-daemon.cc: Modify header files.
* nix/nix-daemon/shared.hh: Renamed to nix-daemon.hh

Signed-off-by: Ludovic Courtès <ludo@gnu.org>
daemon: Use slirp4netns to provide networking to fixed-output derivations. 2025-06-24T14:07:57+00:00 Reepca Russelstein reepca@russelstein.xyz 2025-04-18T06:35:31+00:00 fb42611b8f27960304db5a1c0d33b8371dcde2a8 Previously, the builder of a fixed-output derivation could communicate with an external process via an abstract Unix-domain socket. In particular, it could send an open file descriptor to the store, granting write access to some of its output files in the store provided the derivation build fails—the fix for CVE-2024-27297 did not address this specific case. It could also send an open file descriptor to a setuid program, which could then be executed using execveat to gain the privileges of the build user. With this change, fixed-output derivations other than “builtin:download” and “builtin:git-download” always run in a separate network namespace and have network access provided by a TAP device backed by slirp4netns, thereby closing the abstract Unix-domain socket channel. * nix/libstore/globals.hh (Settings)[useHostLoopback, slirp4netns]: new fields. * config-daemon.ac (SLIRP4NETNS): new C preprocessor definition. * nix/libstore/globals.cc (Settings::Settings): initialize them to defaults. * nix/nix-daemon/guix-daemon.cc (options): add --isolate-host-loopback option. * doc/guix.texi: document it. * nix/libstore/build.cc (DerivationGoal)[slirp]: New field. (setupTap, setupTapAction, waitForSlirpReadyAction, enableRouteLocalnetAction, prepareSlirpChrootAction, spawnSlirp4netns, haveGlobalIPv6Address, remapIdsTo0Action): New functions. (initializeUserNamespace): allow the guest UID and GID to be specified. (DerivationGoal::killChild): When ‘slirp’ is not -1, call ‘kill’. (DerivationGoal::startBuilder): Unconditionally add CLONE_NEWNET to FLAGS. When ‘fixedOutput’ is true, spawn ‘slirp4netns’. When ‘fixedOutput’ and ‘useChroot’ are true, add setupTapAction, waitForSlirpReadyAction, and enableRouteLocalnetAction to builder setup phases. Create a /etc/resolv.conf for fixed-output derivations that directs them to slirp4netns's dns address. When settings.useHostLoopback is true, supply fixed-output derivations with a /etc/hosts that resolves "localhost" to slirp4netns's address for accessing the host loopback. * nix/libutil/util.cc (keepOnExec, decodeOctalEscaped, sendFD, receiveFD, findProgram): New functions. * nix/libutil/util.hh (keepOnExec, decodeOctalEscaped, sendFD, receiveFD, findProgram): New declarations. * gnu/packages/package-management.scm (guix): add slirp4netns input for linux targets. * tests/derivations.scm (builder-network-isolated?): new variable. ("fixed-output derivation, network access, localhost", "fixed-output derivation, network access, external host"): skip test case if fixed output derivations are isolated from the network. Change-Id: Ia3fea2ab7add56df66800071cf15cdafe7bfab96 Signed-off-by: John Kehayias <john.kehayias@protonmail.com> 
Previously, the builder of a fixed-output derivation could communicate with an
external process via an abstract Unix-domain socket.  In particular, it could
send an open file descriptor to the store, granting write access to some of
its output files in the store provided the derivation build fails—the fix for
CVE-2024-27297 did not address this specific case.  It could also send an open
file descriptor to a setuid program, which could then be executed using
execveat to gain the privileges of the build user.

With this change, fixed-output derivations other than “builtin:download”
and “builtin:git-download” always run in a separate network namespace
and have network access provided by a TAP device backed by slirp4netns,
thereby closing the abstract Unix-domain socket channel.

* nix/libstore/globals.hh (Settings)[useHostLoopback, slirp4netns]: new
fields.
* config-daemon.ac (SLIRP4NETNS): new C preprocessor definition.
* nix/libstore/globals.cc (Settings::Settings): initialize them to defaults.
* nix/nix-daemon/guix-daemon.cc (options): add --isolate-host-loopback option.
* doc/guix.texi: document it.
* nix/libstore/build.cc (DerivationGoal)[slirp]: New field.
(setupTap, setupTapAction, waitForSlirpReadyAction, enableRouteLocalnetAction,
 prepareSlirpChrootAction, spawnSlirp4netns, haveGlobalIPv6Address,
 remapIdsTo0Action): New functions.
(initializeUserNamespace): allow the guest UID and GID to be specified.
(DerivationGoal::killChild): When ‘slirp’ is not -1, call ‘kill’.
(DerivationGoal::startBuilder): Unconditionally add CLONE_NEWNET to FLAGS.
When ‘fixedOutput’ is true, spawn ‘slirp4netns’.
When ‘fixedOutput’ and ‘useChroot’ are true, add setupTapAction,
waitForSlirpReadyAction, and enableRouteLocalnetAction to builder setup
phases.
Create a /etc/resolv.conf for fixed-output derivations that directs them to
slirp4netns's dns address.
When settings.useHostLoopback is true, supply fixed-output derivations with a
/etc/hosts that resolves "localhost" to slirp4netns's address for accessing
the host loopback.
* nix/libutil/util.cc (keepOnExec, decodeOctalEscaped, sendFD, receiveFD,
  findProgram): New functions.
* nix/libutil/util.hh (keepOnExec, decodeOctalEscaped, sendFD, receiveFD,
  findProgram): New declarations.
* gnu/packages/package-management.scm (guix): add slirp4netns input for linux
  targets.
* tests/derivations.scm (builder-network-isolated?): new variable.
  ("fixed-output derivation, network access, localhost", "fixed-output
  derivation, network access, external host"):
  skip test case if fixed output derivations are isolated from the network.

Change-Id: Ia3fea2ab7add56df66800071cf15cdafe7bfab96
Signed-off-by: John Kehayias <john.kehayias@protonmail.com>
daemon: Remove 'NIX_LIBEXEC_DIR'. 2019-09-08T09:49:24+00:00 Ludovic Courtès ludo@gnu.org 2019-09-04T10:00:31+00:00 82f903e70f580c34503052245625354d2f097d7e * nix/libstore/globals.hh (Settings)[nixLibexecDir]: Remove. * nix/libstore/globals.cc (Settings::processEnvironment): Remove reference to 'nixLibexecDir'. * nix/local.mk (libstore_a_CPPFLAGS): Remove -DNIX_LIBEXEC_DIR flag. * build-aux/pre-inst-env.in: Remove references to 'NIX_LIBEXEC_DIR'. 
* nix/libstore/globals.hh (Settings)[nixLibexecDir]: Remove.
* nix/libstore/globals.cc (Settings::processEnvironment): Remove
reference to 'nixLibexecDir'.
* nix/local.mk (libstore_a_CPPFLAGS): Remove -DNIX_LIBEXEC_DIR flag.
* build-aux/pre-inst-env.in: Remove references to 'NIX_LIBEXEC_DIR'.
daemon: Run 'guix substitute' directly and assume a single substituter. 2019-09-08T09:49:24+00:00 Ludovic Courtès ludo@gnu.org 2019-09-04T09:04:44+00:00 f6919ebdc6b0ce0286814cc6ab0564b1a4c67f5f The daemon had a mechanism that allows it to handle a list of substituters and try them sequentially; this removes it. * nix/scripts/substitute.in: Remove. * nix/local.mk (nodist_pkglibexec_SCRIPTS): Remove. * config-daemon.ac: Don't output 'nix/scripts/substitute'. * nix/libstore/build.cc (SubstitutionGoal)[subs, sub, hasSubstitute]: Remove. [tryNext]: Make private. (SubstitutionGoal::SubstitutionGoal, SubstitutionGoal::init): Remove now unneeded initializers. (SubstitutionGoal::tryNext): Adjust to assume a single substituter: call 'amDone' upfront when we couldn't find substitutes. (SubstitutionGoal::tryToRun): Adjust to run 'guix substitute' via 'settings.guixProgram'. (SubstitutionGoal::finished): Call 'amDone(ecFailed)' upon failure instead of setting 'state' to 'tryNext'. * nix/libstore/globals.hh (Settings)[substituters]: Remove. * nix/libstore/local-store.cc (LocalStore::~LocalStore): Adjust to handle a single substituter. (LocalStore::startSubstituter): Remove 'path' parameter. Adjust to invoke 'settings.guixProgram'. Don't refer to 'run.program', which no longer exists. (LocalStore::querySubstitutablePaths): Adjust for 'runningSubstituters' being a singleton instead of a list. (LocalStore::querySubstitutablePathInfos): Likewise, and remove 'substituter' parameter. * nix/libstore/local-store.hh (RunningSubstituter)[program]: Remove. (LocalStore)[runningSubstituters]: Remove. [runningSubstituter]: New field. [querySubstitutablePathInfos]: Remove 'substituter' parameter. [startSubstituter]: Remove 'substituter' parameter. * nix/nix-daemon/guix-daemon.cc (main): Remove references to 'settings.substituters'. * nix/nix-daemon/nix-daemon.cc (performOp): Ignore the user's "build-use-substitutes" value when 'settings.useSubstitutes' is false. 
The daemon had a mechanism that allows it to handle a list of
substituters and try them sequentially; this removes it.

* nix/scripts/substitute.in: Remove.
* nix/local.mk (nodist_pkglibexec_SCRIPTS): Remove.
* config-daemon.ac: Don't output 'nix/scripts/substitute'.
* nix/libstore/build.cc (SubstitutionGoal)[subs, sub, hasSubstitute]:
Remove.
[tryNext]: Make private.
(SubstitutionGoal::SubstitutionGoal, SubstitutionGoal::init): Remove now
unneeded initializers.
(SubstitutionGoal::tryNext): Adjust to assume a single substituter: call
'amDone' upfront when we couldn't find substitutes.
(SubstitutionGoal::tryToRun): Adjust to run 'guix substitute' via
'settings.guixProgram'.
(SubstitutionGoal::finished): Call 'amDone(ecFailed)' upon failure
instead of setting 'state' to 'tryNext'.
* nix/libstore/globals.hh (Settings)[substituters]: Remove.
* nix/libstore/local-store.cc (LocalStore::~LocalStore): Adjust to
handle a single substituter.
(LocalStore::startSubstituter): Remove 'path' parameter.  Adjust to
invoke 'settings.guixProgram'.  Don't refer to 'run.program', which no
longer exists.
(LocalStore::querySubstitutablePaths): Adjust for 'runningSubstituters'
being a singleton instead of a list.
(LocalStore::querySubstitutablePathInfos): Likewise, and remove
'substituter' parameter.
* nix/libstore/local-store.hh (RunningSubstituter)[program]: Remove.
(LocalStore)[runningSubstituters]: Remove.
[runningSubstituter]: New field.
[querySubstitutablePathInfos]: Remove 'substituter' parameter.
[startSubstituter]: Remove 'substituter' parameter.
* nix/nix-daemon/guix-daemon.cc (main): Remove references to
'settings.substituters'.
* nix/nix-daemon/nix-daemon.cc (performOp): Ignore the user's
"build-use-substitutes" value when 'settings.useSubstitutes' is false.
daemon: Invoke 'guix gc --list-busy' instead of 'list-runtime-roots'. 2019-09-08T09:49:24+00:00 Ludovic Courtès ludo@gnu.org 2019-09-03T19:36:29+00:00 2e3e5d21988fc2cafb2a9eaf4b00976ea425629d * nix/scripts/list-runtime-roots.in: Remove. * guix/store/roots.scm (%proc-directory): New variable. (proc-file-roots, proc-exe-roots, proc-cwd-roots) (proc-fd-roots, proc-maps-roots, proc-environ-roots) (referenced-files, canonicalize-store-item, busy-store-items): New procedures, taken from 'list-runtime-roots.in'. * nix/libstore/globals.hh (Settings)[guixProgram]: New field. * nix/libstore/globals.cc (Settings::processEnvironment): Initialize 'guixProgram'. * nix/libstore/gc.cc (addAdditionalRoots): Drop code related to 'NIX_ROOT_FINDER'. Run "guix gc --list-busy". * nix/local.mk (nodist_pkglibexec_SCRIPTS): Remove 'scripts/list-runtime-roots'. * config-daemon.ac: Don't output nix/scripts/list-runtime-roots. * build-aux/pre-inst-env.in: Don't set 'NIX_ROOT_FINDER'. Set 'GUIX'. * doc/guix.texi (Invoking guix gc): Document '--list-busy'. * guix/scripts/gc.scm (show-help, %options): Add "--list-busy". (guix-gc)[list-busy]: New procedure. Handle the 'list-busy' action. 
* nix/scripts/list-runtime-roots.in: Remove.
* guix/store/roots.scm (%proc-directory): New variable.
(proc-file-roots, proc-exe-roots, proc-cwd-roots)
(proc-fd-roots, proc-maps-roots, proc-environ-roots)
(referenced-files, canonicalize-store-item, busy-store-items): New
procedures, taken from 'list-runtime-roots.in'.
* nix/libstore/globals.hh (Settings)[guixProgram]: New field.
* nix/libstore/globals.cc (Settings::processEnvironment): Initialize
'guixProgram'.
* nix/libstore/gc.cc (addAdditionalRoots): Drop code related to
'NIX_ROOT_FINDER'.  Run "guix gc --list-busy".
* nix/local.mk (nodist_pkglibexec_SCRIPTS): Remove
'scripts/list-runtime-roots'.
* config-daemon.ac: Don't output nix/scripts/list-runtime-roots.
* build-aux/pre-inst-env.in: Don't set 'NIX_ROOT_FINDER'.
Set 'GUIX'.
* doc/guix.texi (Invoking guix gc): Document '--list-busy'.
* guix/scripts/gc.scm (show-help, %options): Add "--list-busy".
(guix-gc)[list-busy]: New procedure.
Handle the 'list-busy' action.
daemon: Remove unused 'NIX_DATA_DIR' environment variable. 2019-02-03T23:03:30+00:00 Ludovic Courtès ludo@gnu.org 2019-02-03T21:30:18+00:00 65d13e3043d90382f79b1780e06dc671ae451edf * nix/libstore/globals.hh (Settings)[nixDataDir]: Remove. * nix/libstore/globals.cc (Settings:processEnvironment): Remove setting of 'nixDataDir'. * nix/local.mk (libstore_a_CPPFLAGS): Remove '-DNIX_DATA_DIR'. 
* nix/libstore/globals.hh (Settings)[nixDataDir]: Remove.
* nix/libstore/globals.cc (Settings:processEnvironment): Remove setting
of 'nixDataDir'.
* nix/local.mk (libstore_a_CPPFLAGS): Remove '-DNIX_DATA_DIR'.
daemon: Support multiplexed build output. 2018-10-15T20:40:35+00:00 Ludovic Courtès ludo@gnu.org 2018-10-15T20:40:35+00:00 6ef61cc4c30e94acbd7437f19c893f63a7112267 This allows clients to tell whether output comes from the daemon or, if it comes from a builder, from which builder it comes. The latter is particularly useful when MAX-BUILD-JOBS > 1. * nix/libstore/build.cc (DerivationGoal::tryBuildHook) (DerivationGoal::startBuilder): Print the child's PID in "@ build-started" traces. (DerivationGoal::handleChildOutput): Define 'prefix', pass it to 'writeToStderr'. * nix/libstore/globals.cc (Settings:Settings): Initialize 'multiplexedBuildOutput'. (Settings::update): Likewise. * nix/libstore/globals.hh (Settings)[multiplexedBuildOutput]: New field. Update 'printBuildTrace' documentation. * nix/libstore/worker-protocol.hh (PROTOCOL_VERSION): Bump to 0.163. * nix/nix-daemon/nix-daemon.cc (performOp) <wopSetOptions>: Special-case "multiplexed-build-output" and remove "use-ssh-substituter". * guix/store.scm (set-build-options): Add #:multiplexed-build-output? and honor it. (%protocol-version): Bump to #x163. * tests/store.scm ("multiplexed-build-output"): New test. fixlet 
This allows clients to tell whether output comes from the daemon or, if
it comes from a builder, from which builder it comes.  The latter is
particularly useful when MAX-BUILD-JOBS > 1.

* nix/libstore/build.cc (DerivationGoal::tryBuildHook)
(DerivationGoal::startBuilder): Print the child's PID in "@ build-started"
traces.
(DerivationGoal::handleChildOutput): Define 'prefix', pass it to
'writeToStderr'.
* nix/libstore/globals.cc (Settings:Settings): Initialize
'multiplexedBuildOutput'.
(Settings::update): Likewise.
* nix/libstore/globals.hh (Settings)[multiplexedBuildOutput]: New field.
Update 'printBuildTrace' documentation.
* nix/libstore/worker-protocol.hh (PROTOCOL_VERSION): Bump to 0.163.
* nix/nix-daemon/nix-daemon.cc (performOp) <wopSetOptions>: Special-case
"multiplexed-build-output" and remove "use-ssh-substituter".
* guix/store.scm (set-build-options): Add #:multiplexed-build-output?
and honor it.
(%protocol-version): Bump to #x163.
* tests/store.scm ("multiplexed-build-output"): New test.

fixlet