* Handle multiple indirect symlinks when loading a Nix expression.

doc/manual/installation.xml

@@ -205,6 +205,21 @@ on systems that have the <function>setresuid()</function> system call
 (such as Linux and FreeBSD), so on those systems the binaries are
 simply owned by the Nix user.</para></warning>
 
+
+
+<!--
+
+warning: the nix-builders group should contain *only* the Nix
+builders, and nothing else.  If the Nix account is compromised, you
+can execute programs under the accounts in the nix-builders group, so
+it obviously shouldn’t contain any “real” user accounts.  So don’t use
+an existing group like <literal>users</literal> — just create a new
+one.
+
+-->
+
+
+
 </section>
 
 </section>

src/libexpr/parser.y

@@ -369,9 +369,12 @@ Expr parseExprFromFile(EvalState & state, Path path)
     /* If `path' is a symlink, follow it.  This is so that relative
        path references work. */
     struct stat st;
-    if (lstat(path.c_str(), &st))
+    while (true) {
-        throw SysError(format("getting status of `%1%'") % path);
+        if (lstat(path.c_str(), &st))
-    if (S_ISLNK(st.st_mode)) path = absPath(readLink(path), dirOf(path));
+            throw SysError(format("getting status of `%1%'") % path);
+        if (!S_ISLNK(st.st_mode)) break;
+        path = absPath(readLink(path), dirOf(path));
+    }
 
     /* If `path' refers to a directory, append `/default.nix'. */
     if (stat(path.c_str(), &st))

src/nix-env/nix-env.cc

@@ -1113,10 +1113,7 @@ static void opDefaultExpr(Globals & globals,
     if (opArgs.size() != 1)
         throw UsageError(format("exactly one argument expected"));
 
-    Path defNixExpr = absPath(opArgs.front());
+    switchLink(getDefNixExprPath(), absPath(opArgs.front()));
-    Path defNixExprLink = getDefNixExprPath();
-    
-    switchLink(defNixExprLink, defNixExpr);
 }