diff options
author | Ludovic Courtès <ludo@gnu.org> | 2025-02-14 17:29:56 +0100 |
---|---|---|
committer | Ludovic Courtès <ludo@gnu.org> | 2025-03-26 17:57:44 +0100 |
commit | bdd7b9a45d650ed45a1569cbc4ed971b52728104 (patch) | |
tree | 583a4b3da807a6aebf676462e0d2717271a6f9d7 | |
parent | 0163c732a17f6358a6b0d8004b27d27650a7d5be (diff) | |
download | guix-bdd7b9a45d650ed45a1569cbc4ed971b52728104.tar.gz guix-bdd7b9a45d650ed45a1569cbc4ed971b52728104.zip |
daemon: Move comments where they belong.
* nix/libstore/build.cc (DerivationGoal::startBuilder): Shuffle
comments for clarity.
Change-Id: I6557c103ade4a3ab046354548ea193c68f8c9c05
-rw-r--r-- | nix/libstore/build.cc | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/nix/libstore/build.cc b/nix/libstore/build.cc index e6a139eb0d..d0fcc99854 100644 --- a/nix/libstore/build.cc +++ b/nix/libstore/build.cc @@ -1870,18 +1870,19 @@ void DerivationGoal::startBuilder() } dirsInChroot[tmpDirInSandbox] = tmpDir; - /* Make the closure of the inputs available in the chroot, - rather than the whole store. This prevents any access - to undeclared dependencies. !!! As an extra security - precaution, make the fake store only writable by the - build user. */ + /* Create the fake store. */ Path chrootStoreDir = chrootRootDir + settings.nixStore; createDirs(chrootStoreDir); chmod_(chrootStoreDir, 01775); if (buildUser.enabled() && chown(chrootStoreDir.c_str(), 0, buildUser.getGID()) == -1) - throw SysError(format("cannot change ownership of ‘%1%’") % chrootStoreDir); + /* As an extra security precaution, make the fake store only + writable by the build user. */ + throw SysError(format("cannot change ownership of ‘%1%’") % chrootStoreDir); + /* Make the closure of the inputs available in the chroot, rather than + the whole store. This prevents any access to undeclared + dependencies. */ foreach (PathSet::iterator, i, inputPaths) { struct stat st; if (lstat(i->c_str(), &st)) |