Commit graph

715 commits

Author SHA1 Message Date
Eelco Dolstra
6cf23c3e8f
Add allow-new-privileges option
This allows builds to call setuid binaries. This was previously
possible until we started using seccomp. Turns out that seccomp by
default disallows processes from acquiring new privileges. Generally,
any use of setuid binaries (except those created by the builder
itself) is by definition impure, but some people were relying on this
ability for certain tests.

Example:

  $ nix build '(with import <nixpkgs> {}; runCommand "foo" {} "/run/wrappers/bin/ping -c 1 8.8.8.8; exit 1")' --no-allow-new-privileges
  builder for ‘/nix/store/j0nd8kv85hd6r4kxgnwzvr0k65ykf6fv-foo.drv’ failed with exit code 1; last 2 log lines:
    cannot raise the capability into the Ambient set
    : Operation not permitted

  $ nix build '(with import <nixpkgs> {}; runCommand "foo" {} "/run/wrappers/bin/ping -c 1 8.8.8.8; exit 1")' --allow-new-privileges
  builder for ‘/nix/store/j0nd8kv85hd6r4kxgnwzvr0k65ykf6fv-foo.drv’ failed with exit code 1; last 6 log lines:
    PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
    64 bytes from 8.8.8.8: icmp_seq=1 ttl=46 time=15.2 ms

Fixes #1429.
2017-07-04 15:48:25 +02:00
Eelco Dolstra
a10951de08
OS X -> macOS
(cherry picked from commit c20641ce569dc1fdeaeaa147b0292f258667f53b)
2017-06-14 23:28:06 +02:00
Eelco Dolstra
1dcadadf74
Add 1.11.10 release notes
(cherry picked from commit 0fb60e4e0f66cc42c7c274acfcf00b51f6c829c4)
2017-06-14 23:27:52 +02:00
Eelco Dolstra
d6064dd19b Merge pull request #1393 from pyrtsa/patch-1
Fix variable name typo in derivations doc
2017-05-29 11:32:06 +02:00
Pyry Jahkola
370428f86d Remove stray > in builtins doc 2017-05-28 20:47:35 +03:00
Pyry Jahkola
86ea7d1566 Fix variable name typo in derivations doc 2017-05-28 15:48:57 +03:00
Eelco Dolstra
b303ad012c Merge pull request #1382 from FRidh/patch-1
Document fetchTarball can take a sha256
2017-05-24 11:07:36 +02:00
Eelco Dolstra
f134fc4cbe
Document that builtins.match takes a POSIX extended RE 2017-05-17 12:18:18 +02:00
Frederik Rietdijk
2b2de5ef6a Document fetchTarball can take a sha256
Note that I refer to `nix-prefetch-url`.
2017-05-11 13:38:13 +02:00
Eelco Dolstra
1fd59447d5
Typo 2017-05-10 18:38:17 +02:00
Eelco Dolstra
c5f23f10a8
Replace readline by linenoise
Using linenoise avoids a license compatibility issue (#1356), is a lot
smaller and doesn't pull in ncurses.
2017-05-10 18:37:42 +02:00
Domen Kožar
82a9c93c7f
doc: builtins.attrNames returns alphabetically sorted list 2017-05-10 11:23:12 +02:00
Eelco Dolstra
d3449b286b Merge pull request #1371 from regnat/doc_--xml_fix
fix the description of --xml and --json
2017-05-03 11:06:12 +02:00
regnat
a786d26dc2 doc: fix the description of --xml and --json
Those options seem to only apply with --eval and not with --parse.
2017-05-03 10:49:34 +02:00
Eelco Dolstra
d7653dfc6d
Remove $NIX_BUILD_HOOK and $NIX_CURRENT_LOAD
This is to simplify remote build configuration. These environment
variables predate nix.conf.

The build hook now has a sensible default (namely build-remote).

The current load is kept in the Nix state directory now.
2017-05-01 17:30:16 +02:00
Eelco Dolstra
1196470e92 Merge pull request #1347 from kennyballou/sm-grammar-fix
Fix small grammar issue about page
2017-04-24 10:49:46 +02:00
Eelco Dolstra
240399e059 Merge pull request #1351 from earldouglas/ellipses
Drop misleading ellipses
2017-04-24 10:49:09 +02:00
Eelco Dolstra
8d6af08530 Merge pull request #1348 from armijnhemel/nix-env
better document --meta option for nix-env
2017-04-24 10:18:23 +02:00
James Earl Douglas
111d347237
Drop misleading ellipses
This portion of the quick start guide may lead to confusion for
newcomers to Nix.  This change clarifies the example to one that can be
copied in its entirety.
2017-04-20 18:07:23 -06:00
Eelco Dolstra
f05d5f89ff
Read per-user settings from ~/.config/nix/nix.conf 2017-04-20 14:58:16 +02:00
Eelco Dolstra
562585e901
binary-caches-parallel-connections -> http-connections 2017-04-20 14:04:00 +02:00
Eelco Dolstra
4222402219
nix.conf man page: binary-caches -> substituters 2017-04-20 13:41:29 +02:00
Armijn Hemel
1559c596f6 document option 2017-04-19 19:10:12 +02:00
kballou
00b6c6d0c3 Fix small grammar issue about page
Fix subject-verb agreement issue in introduction/about.
2017-04-19 09:27:28 -06:00
Linus Heckemann
9622d00afa Manual: document tryEval 2017-04-17 10:33:53 +01:00
Eelco Dolstra
ba9ad29fdb
Convert Settings to the new config system
This makes all config options self-documenting.

Unknown or unparseable config settings and --option flags now cause a
warning.
2017-04-13 20:53:23 +02:00
Benjamin Staffin
d267db0d75
Move note about float support out of the wrong release notes
Looks like this snuck into the 1.11 release notes post-release, but
float support isn't actually present until 1.12.
2017-04-12 18:01:43 -04:00
Eelco Dolstra
c0745a2531
Merge branch 'remove-perl' of https://github.com/shlevy/nix 2017-03-31 14:13:32 +02:00
Eelco Dolstra
aa23bba27f
Fix tests to reflect the signed-binary-caches default change 2017-03-21 18:06:13 +01:00
Eelco Dolstra
0afeb7f51e
Store: Add a method for getting build logs
This allows various Store implementations to provide different ways to
get build logs. For example, BinaryCacheStore can get the build logs
from the binary cache.

Also, remove the log-servers option since we can use substituters for
this.
2017-03-15 16:48:29 +01:00
Eelco Dolstra
19643a781e
nix -> Nix 2017-03-09 13:36:56 +01:00
Shea Levy
5f831c1057 Add docs for allow-import-from-derivation 2017-03-08 09:12:03 -05:00
Eelco Dolstra
7251d048fa
Support auto-configuration of build-max-jobs
"build-max-jobs" and the "-j" option can now be set to "auto" to use
the number of CPUs in the system. (Unlike build-cores, it doesn't use
0 to imply auto-configuration, because a) magic values are a bad idea
in general; b) 0 is a legitimate value used to disable local
building.)

Fixes #1198.
2017-02-28 12:54:50 +01:00
Eelco Dolstra
4f3fb34844
Fix 1.8 release note about build-max-jobs
We set build-cores automatically, not build-max-jobs. (The commit
message for de4cdd0d47 also got this
wrong.)
2017-02-27 15:58:24 +01:00
Eelco Dolstra
79f4583f8a
Fix XML validity 2017-02-21 13:04:31 +01:00
Linus Heckemann
b8564987a3 Document toString better 2017-02-20 14:23:48 +00:00
Eelco Dolstra
bd5388e7b2
Tweak netrc docs 2017-02-16 14:24:16 +01:00
Janus Troelsen
2b4c24f46a Remove Perl dependency listing in doc 2017-02-07 15:56:32 -05:00
Shea Levy
418a837897 Remove perl dependency.
Fixes #341
2017-02-07 15:56:32 -05:00
Renzo Carbonara
e6e74f987f Add netrc-file support 2017-02-02 13:24:20 +01:00
Eelco Dolstra
9000150a78
Drop a few more references to all-packages.nix
And also don't refer to f-spot, which apparently no longer exists.

Issue #1170.
2017-01-03 16:42:24 +01:00
zimbatm
45ed6e7ef2 Document the common --no-build-hook option 2016-12-28 14:19:59 +00:00
Daiderd Jordan
36b3e15953
manual: add NIX_CONF_DIR to conf-file section 2016-12-16 10:59:07 +01:00
Linus Heckemann
bb5a6c0085 Document path-search behaviour 2016-12-11 17:13:37 +00:00
Domen Kožar
41d6523ef5 Document builtins.match, fixes #1145 2016-12-09 20:40:55 +01:00
Eelco Dolstra
09191caea8
Add shell.nix 2016-12-06 17:17:29 +01:00
Eelco Dolstra
d1da6967b8
Drop unused WWW::Curl dependency 2016-12-06 17:17:29 +01:00
Manav Rathi
eec5409a69 installation: allow profile modification to be skipped (#1072)
The current behaviour modifies the first writeable file from amongst
.bash_profile, .bash_login and .profile.  So .bash_profile (if it is
writable) would be modified even if a user has already sourced nix.sh
in, say, .profile.

This commit introduces a new environment variable,
NIX_INSTALLER_NO_MODIFY_PROFILE.  If this is set during installation,
then the modifications are unconditionally skipped.

This is useful for users who have a manually curated set of dotfiles
that they are porting to a new machine. In such scenarios, nix.sh is
already sourced at a place where the user prefers.  Without this
change, the nix installer would insist on modifying .bash_profile if
it exists.

This commit also add documentations for both the current behaviour and
the new override.
2016-11-03 18:02:29 +01:00
Eelco Dolstra
18b7363a69 Support optional sandbox paths
For example, you can now set

  build-sandbox-paths = /dev/nvidiactl?

to specify that /dev/nvidiactl should only be mounted in the sandbox
if it exists in the host filesystem. This is useful e.g. for EC2
images that should support both CUDA and non-CUDA instances.
2016-10-31 17:09:52 +01:00
Eelco Dolstra
818ab58cc6 Add sandbox-dev-shm-size option
Fixes #1069.
2016-09-21 16:54:53 +02:00