summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--nix/libstore/build.cc16
1 files changed, 8 insertions, 8 deletions
diff --git a/nix/libstore/build.cc b/nix/libstore/build.cc
index b3f9c24983c..9010ca4e200 100644
--- a/nix/libstore/build.cc
+++ b/nix/libstore/build.cc
@@ -1638,15 +1638,15 @@ void chmod_(const Path & path, mode_t mode)
1638 1638
1639 1639
1640/* UID and GID of the build user inside its own user namespace. */ 1640/* UID and GID of the build user inside its own user namespace. */
1641static const uid_t guestUID = 30001; 1641static const uid_t defaultGuestUID = 30001;
1642static const gid_t guestGID = 30000; 1642static const gid_t defaultGuestGID = 30000;
1643 1643
1644/* Initialize the user namespace of CHILD. */ 1644/* Initialize the user namespace of CHILD. */
1645static void initializeUserNamespace(pid_t child, 1645static void initializeUserNamespace(pid_t child,
1646 uid_t hostUID = getuid(), 1646 uid_t hostUID = getuid(),
1647 gid_t hostGID = getgid(), 1647 gid_t hostGID = getgid(),
1648 uid_t guestUID = guestUID, 1648 uid_t guestUID = defaultGuestUID,
1649 gid_t guestGID = guestGID, 1649 gid_t guestGID = defaultGuestGID,
1650 const std::vector<std::pair<gid_t, gid_t>> extraGIDs = {}, 1650 const std::vector<std::pair<gid_t, gid_t>> extraGIDs = {},
1651 bool haveCapSetGID = false) 1651 bool haveCapSetGID = false)
1652{ 1652{
@@ -2763,14 +2763,14 @@ void DerivationGoal::startBuilder()
2763 std::format( 2763 std::format(
2764 "nixbld:x:{}:{}:Nix build user:/:/noshell\n" 2764 "nixbld:x:{}:{}:Nix build user:/:/noshell\n"
2765 "nobody:x:65534:65534:Nobody:/:/noshell\n", 2765 "nobody:x:65534:65534:Nobody:/:/noshell\n",
2766 buildUser.enabled() ? buildUser.getUID() : guestUID, 2766 buildUser.enabled() ? buildUser.getUID() : defaultGuestUID,
2767 buildUser.enabled() ? buildUser.getGID() : guestGID)); 2767 buildUser.enabled() ? buildUser.getGID() : defaultGuestGID));
2768 2768
2769 /* Declare the build user's group so that programs get a consistent 2769 /* Declare the build user's group so that programs get a consistent
2770 view of the system (e.g., "id -gn"). */ 2770 view of the system (e.g., "id -gn"). */
2771 writeFile(chrootRootDir + "/etc/group", 2771 writeFile(chrootRootDir + "/etc/group",
2772 std::format("nixbld:!:{}:\n", 2772 std::format("nixbld:!:{}:\n",
2773 buildUser.enabled() ? buildUser.getGID() : guestGID)); 2773 buildUser.enabled() ? buildUser.getGID() : defaultGuestGID));
2774 2774
2775 if (fixedOutput) { 2775 if (fixedOutput) {
2776 /* Fixed-output derivations typically need to access the network, 2776 /* Fixed-output derivations typically need to access the network,
@@ -3020,7 +3020,7 @@ void DerivationGoal::startBuilder()
3020 auto extraGIDs = kvmGIDMapping(); 3020 auto extraGIDs = kvmGIDMapping();
3021 initializeUserNamespace(pid, 3021 initializeUserNamespace(pid,
3022 getuid(), getgid(), 3022 getuid(), getgid(),
3023 guestUID, guestGID, extraGIDs); 3023 defaultGuestUID, defaultGuestGID, extraGIDs);
3024 writeFull(parentSetupSocket, (unsigned char*)"go\n", 3); 3024 writeFull(parentSetupSocket, (unsigned char*)"go\n", 3);
3025 } 3025 }
3026 3026