Ludovic Courtès ae18b3d9e6 daemon: Allow running as non-root with unprivileged user namespaces. ... Many thanks to Reepca Russelstein for their review and guidance on these changes. * nix/libstore/build.cc (guestUID, guestGID): New variables. (DerivationGoal)[readiness]: New field. (initializeUserNamespace): New function. (DerivationGoal::runChild): When ‘readiness.readSide’ is positive, read from it. (DerivationGoal::startBuilder): Call ‘chown’ only when ‘buildUser.enabled()’ is true. Pass CLONE_NEWUSER to ‘clone’ when ‘buildUser.enabled()’ is false or not running as root. Retry ‘clone’ without CLONE_NEWUSER upon EPERM. (DerivationGoal::registerOutputs): Make ‘actualPath’ writable before ‘rename’. (DerivationGoal::deleteTmpDir): Catch ‘SysError’ around ‘_chown’ call. * nix/libstore/local-store.cc (LocalStore::createUser): Do nothing if ‘dirs’ already exists. Warn instead of failing when failing to chown ‘dir’. * guix/substitutes.scm (%narinfo-cache-directory): Check for ‘_NIX_OPTIONS’ rather than getuid() == 0 to determine the cache location. * doc/guix.texi (Build Environment Setup): Reorganize a bit. Add section headings “Daemon Running as Root” and “The Isolated Build Environment”. Add “Daemon Running Without Privileges” subsection. Remove paragraph about ‘--disable-chroot’. (Invoking guix-daemon): Warn against ‘--disable-chroot’ and explain why. * tests/derivations.scm ("builder is outside the store"): New test. Reviewed-by: Reepca Russelstein <reepca@russelstein.xyz>		2025-03-26 17:57:43 +01:00
..
boost
libstore	daemon: Allow running as non-root with unprivileged user namespaces.	2025-03-26 17:57:43 +01:00
libutil	daemon: Close the read end of the logging pipe.	2025-03-26 17:57:43 +01:00
nix-daemon	daemon: Implement ‘substitute-urls’ RPC.	2023-12-11 23:18:53 +01:00
.gitignore
AUTHORS
COPYING
local.mk	nix: Install guix-gc systemd timer.	2025-03-02 14:21:59 +02:00