mirror of
https://github.com/NixOS/nix
synced 2024-09-19 23:03:53 -04:00
94 lines
2.5 KiB
C++
94 lines
2.5 KiB
C++
#include "lock.hh"
|
|
#include "globals.hh"
|
|
#include "pathlocks.hh"
|
|
|
|
#include <grp.h>
|
|
#include <pwd.h>
|
|
|
|
#include <fcntl.h>
|
|
#include <unistd.h>
|
|
|
|
namespace nix {
|
|
|
|
UserLock::UserLock()
|
|
{
|
|
assert(settings.buildUsersGroup != "");
|
|
createDirs(settings.nixStateDir + "/userpool");
|
|
}
|
|
|
|
bool UserLock::findFreeUser() {
|
|
if (enabled()) return true;
|
|
|
|
/* Get the members of the build-users-group. */
|
|
struct group * gr = getgrnam(settings.buildUsersGroup.get().c_str());
|
|
if (!gr)
|
|
throw Error("the group '%1%' specified in 'build-users-group' does not exist",
|
|
settings.buildUsersGroup);
|
|
gid = gr->gr_gid;
|
|
|
|
/* Copy the result of getgrnam. */
|
|
Strings users;
|
|
for (char * * p = gr->gr_mem; *p; ++p) {
|
|
debug("found build user '%1%'", *p);
|
|
users.push_back(*p);
|
|
}
|
|
|
|
if (users.empty())
|
|
throw Error("the build users group '%1%' has no members",
|
|
settings.buildUsersGroup);
|
|
|
|
/* Find a user account that isn't currently in use for another
|
|
build. */
|
|
for (auto & i : users) {
|
|
debug("trying user '%1%'", i);
|
|
|
|
struct passwd * pw = getpwnam(i.c_str());
|
|
if (!pw)
|
|
throw Error("the user '%1%' in the group '%2%' does not exist",
|
|
i, settings.buildUsersGroup);
|
|
|
|
|
|
fnUserLock = (format("%1%/userpool/%2%") % settings.nixStateDir % pw->pw_uid).str();
|
|
|
|
AutoCloseFD fd = open(fnUserLock.c_str(), O_RDWR | O_CREAT | O_CLOEXEC, 0600);
|
|
if (!fd)
|
|
throw SysError("opening user lock '%1%'", fnUserLock);
|
|
|
|
if (lockFile(fd.get(), ltWrite, false)) {
|
|
fdUserLock = std::move(fd);
|
|
user = i;
|
|
uid = pw->pw_uid;
|
|
|
|
/* Sanity check... */
|
|
if (uid == getuid() || uid == geteuid())
|
|
throw Error("the Nix user should not be a member of '%1%'",
|
|
settings.buildUsersGroup);
|
|
|
|
#if __linux__
|
|
/* Get the list of supplementary groups of this build user. This
|
|
is usually either empty or contains a group such as "kvm". */
|
|
supplementaryGIDs.resize(10);
|
|
int ngroups = supplementaryGIDs.size();
|
|
int err = getgrouplist(pw->pw_name, pw->pw_gid,
|
|
supplementaryGIDs.data(), &ngroups);
|
|
if (err == -1)
|
|
throw Error("failed to get list of supplementary groups for '%1%'", pw->pw_name);
|
|
|
|
supplementaryGIDs.resize(ngroups);
|
|
#endif
|
|
|
|
isEnabled = true;
|
|
return true;
|
|
}
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
void UserLock::kill()
|
|
{
|
|
killUser(uid);
|
|
}
|
|
|
|
}
|