Config files like /etc/services may be symbolic links to files not available
in the build environment; copy them instead of creating dangling symlinks.

This also reverts 425aa1bf7c35839f5e500515ff3b5a861a7533d6, which would
potentially create dangling symlinks in the chroot, as reported by @cnx in
guix/guix#9072.

* nix/libstore/build.cc (DerivationGoal::startBuilder): copy network config
  files.

Fixes: guix/guix#4225
Change-Id: I38fc6374c5cecdcd16de06161db00b3825688f2a
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Modified-by: Ludovic Courtès <ludo@gnu.org>

Docker's default seccomp filter prevents use of the ADDR_NO_RANDOMIZE flag
with the personality system call.  It causes personality to return EPERM.  In
general, we assume that any result other than the only documented one, EINVAL,
is caused by seccomp.  If we detect that ADDR_NO_RANDOMIZE is blocked, and the
--allow-aslr option was passed, we simply don't use it.

This allows guix-daemon to continue to work even in these containers, without
any implicit weakening of reproducibility.

Since it is presumably desirable to be able to build guix itself in such an
environment, also pass --allow-aslr to guix-daemon in test-env.

* nix/libstore/globals.hh (Settings::allowASLR): new field.
* nix/nix-daemon/guix-daemon.cc (options): add --allow-aslr option.
  (parse_opt): use it to set Settings::allowASLR.
* nix/libstore/build.cc (DerivationGoal::startBuilder): detect when
  ADDR_NO_RANDOMIZE is blocked and --allow-aslr is passed and don't use it in
  that case.
* doc/guix.texi: document --allow-aslr in "Invoking guix-daemon".
* build-aux/test-env.in: always pass --allow-aslr.

Fixes: guix/guix#3917
Change-Id: I51c5899a9559e161f9e107c2e6a36df395ab3134
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Modified-by: Ludovic Courtès <ludo@gnu.org>
Merges: #4616

* doc/local.mk (lang_to_texinfo): Refer to .texi files using srcdir.
(xref_command): Reference pre-inst-env using builddir.
($(srcdir)/%D%/guix.%.texi):
($(srcdir)/%D%/guix-cookbook.%.texi):
($(srcdir)/%D%/contributing.%.texi): Refer to source files using srcdir.
* nix/local.mk (etc/guix-gc.timer): Use the name of the prerequisite,
not just its file name.

Change-Id: I247bcd873c8355d0eae07870ec849d2eb8cfa6c5
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #8267

Fixes a regression on Guix System introduced in
c4298638ca27717be4a83cb033dcbfecdea88093 (from guix/guix#4178) where files in
/etc, such as /etc/services, would be symlinks.  Consequently, the chroot of
fixed-output derivations would contain a dangling symlink for /etc/services,
leading to name resolution failures in the chroot.

This also relates to 82f84f5e7fb34cc719ed6ea538a3d1ca7516f23d.

* nix/libstore/build.cc (DerivationGoal::startBuilder): Add call to
‘canonPath’.

Change-Id: If34c8e74447ffc03d9fa81a1ea6bc0aef7c4d0b3
Signed-off-by: Ludovic Courtès <ludo@gnu.org>

* nix/libstore/build.cc (prepareSlirpChrootAction): Use
canonPath(i, true) to resolve symlinks when adding /etc/resolv.conf
and /etc/hosts to the slirp4netns chroot, so that bindMount receives
a regular file path instead of a symlink.

On systems using systemd-resolved, /etc/resolv.conf is typically a
symlink:

  /etc/resolv.conf -> /run/systemd/resolve/stub-resolv.conf

The slirp4netns chroot creates an empty /run/ directory, so when
bindMount copies the symlink verbatim (spawn.cc line 537-542), the
target does not exist and slirp4netns cannot determine the upstream
DNS server.  This causes all DNS resolution to fail for fixed-output
derivations that use the Guile-based git-fetch builder (e.g.
git-fetch/lfs), since they rely on slirp4netns for network access
in the build chroot.

Derivations using builtin:git-download are unaffected because they
run in the daemon process itself, which has full network access.

Change-Id: Ib73e69a8760e74eb8141dd0408c27aa8b3001e37
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #6959

Fixes a regression introduced in 7173c2c0ca.  Additional discussion at
https://codeberg.org/guix/guix/pulls/5977.

* nix/libutil/util.cc (_deletePathAt): chmod directory and retry open when it
  fails with EACCES.  Do this using an O_PATH file descriptor referenced via
  /proc/self/fd whenever possible to avoid it being replaced by a
  non-directory immediately before being chmod'ed.
* nix/libutil/util.hh (deletePath): document TOCTTOU race on non-linux systems
  where hardlinks aren't protected.
* tests/derivations.scm ("unreadable directories in build tree can be
  removed"): new test.

Fixes: guix/guix#5891
Reported-by: Liliana Marie Prikler <liliana.prikler@gmail.com>
Change-Id: I749127fe5254ebabc8387a2f0ef47e3c116bfcc5
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #6460

All these entities are not been used anywhere.

* nix/libstore/globals.hh (Settings): Remove 'overrides' member
and 'getOverrides' method declaration.
(nixVersion): Removed.
* nix/libstore/globals.cc (Settings::set): Do not update the 'overrides' map.
(Settings::getOverrides): Remove function definition.

Change-Id: If7dbb6df79178d2569cda21e1fe5e0ea3d8e59ba
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #6009

Change-Id: Id73c0c74600a3da3373b3a37236b505af65bfe31

* nix/libstore/globals.hh,
nix/libstore/store-api.hh,
nix/libutil/util.hh: Fix misspellings in comments.

Change-Id: Id77ea2bde1c2582d1a7bec4ed256ea900998c4b8

This is a followup to 3af52f845fe2ceb448416ac7b9f48925673c594e and
6f1448ef89c8ad29e2a479099531fd3a87701e46.

* nix/libstore/local-store.cc (LocalStore::queryValidPathId): Change %1% to {}.
* nix/libstore/optimise-store.cc (LocalStore::optimisePath_): Likewise.
* nix/nix-daemon/guix-daemon.cc (open_unix_domain_socket): Likewise.
(main): Likewise.
* nix/libutil/affinity.cc (restoreAffinity): Remove useless %1%.

Change-Id: I3a7cd79cd69ab58f14118662f1dcf2fef067a6b7