Add granular access control for nix store

flake.nix

@@ -232,11 +232,11 @@
             boost
             libsodium
           ]
+          ++ lib.optionals stdenv.isLinux [libseccomp acl]
           ++ lib.optionals (!stdenv.hostPlatform.isWindows) [
             editline
             lowdown-nix
           ]
-          ++ lib.optional stdenv.isLinux libseccomp
           ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid;
 
         checkDeps = [

perl/default.nix

@@ -2,7 +2,7 @@
 , stdenv
 , perl, perlPackages
 , autoconf-archive, autoreconfHook, pkg-config
-, nix, curl, bzip2, xz, boost, libsodium, darwin
+, nix, curl, bzip2, xz, boost, libsodium, darwin, acl
 }:
 
 perl.pkgs.toPerlModule (stdenv.mkDerivation {
@@ -38,6 +38,7 @@ perl.pkgs.toPerlModule (stdenv.mkDerivation {
       boost
     ]
     ++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium
+    ++ lib.optional stdenv.isLinux acl
     ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
 
   configureFlags = [

src/libcmd/installables.cc

@@ -1,4 +1,5 @@
 #include "globals.hh"
+#include "granular-access-store.hh"
 #include "installables.hh"
 #include "installable-derived-path.hh"
 #include "installable-attr-path.hh"
@@ -21,6 +22,8 @@
 #include "url.hh"
 #include "registry.hh"
 #include "build-result.hh"
+#include "store-cast.hh"
+#include "local-store.hh"
 
 #include <regex>
 #include <queue>
@@ -585,10 +588,11 @@ std::vector<BuiltPathWithResult> Installable::build(
     ref<Store> store,
     Realise mode,
     const Installables & installables,
-    BuildMode bMode)
+    BuildMode bMode,
+    bool protect)
 {
     std::vector<BuiltPathWithResult> res;
-    for (auto & [_, builtPathWithResult] : build2(evalStore, store, mode, installables, bMode))
+    for (auto & [_, builtPathWithResult] : build2(evalStore, store, mode, installables, bMode, protect))
         res.push_back(builtPathWithResult);
     return res;
 }
@@ -598,7 +602,8 @@ std::vector<std::pair<ref<Installable>, BuiltPathWithResult>> Installable::build
     ref<Store> store,
     Realise mode,
     const Installables & installables,
-    BuildMode bMode)
+    BuildMode bMode,
+    bool protect)
 {
     if (mode == Realise::Nothing)
         settings.readOnlyMode = true;
@@ -616,6 +621,17 @@ std::vector<std::pair<ref<Installable>, BuiltPathWithResult>> Installable::build
         for (auto b : i->toDerivedPaths()) {
             pathsToBuild.push_back(b.path);
             backmap[b.path].push_back({.info = b.info, .installable = i});
+            if (protect) {
+                LocalStore::AccessStatus status {true, {ACL::User(getuid())}};
+                std::visit(overloaded {
+                    [&](DerivedPath::Opaque p){
+                        require<LocalGranularAccessStore>(*store).setAccessStatus(p.path, status, false);
+                    },
+                    [&](DerivedPath::Built b){
+                        require<LocalGranularAccessStore>(*store).setAccessStatus(b, status, false);
+                    }
+                }, b.path);
+            }
         }
     }
 

src/libcmd/installables.hh

@@ -156,14 +156,16 @@ struct Installable
         ref<Store> store,
         Realise mode,
         const Installables & installables,
-        BuildMode bMode = bmNormal);
+        BuildMode bMode = bmNormal,
+        bool protect = false);
 
     static std::vector<std::pair<ref<Installable>, BuiltPathWithResult>> build2(
         ref<Store> evalStore,
         ref<Store> store,
         Realise mode,
         const Installables & installables,
-        BuildMode bMode = bmNormal);
+        BuildMode bMode = bmNormal,
+        bool protect = false);
 
     static std::set<StorePath> toStorePaths(
         ref<Store> evalStore,

src/libexpr/eval.cc

@@ -495,6 +495,12 @@ EvalState::EvalState(
     , sArgs(symbols.create("args"))
     , sContentAddressed(symbols.create("__contentAddressed"))
     , sImpure(symbols.create("__impure"))
+    , sDrv(symbols.create("drv"))
+    , sLog(symbols.create("log"))
+    , sProtected(symbols.create("protected"))
+    , sPermissions(symbols.create("__permissions"))
+    , sUsers(symbols.create("users"))
+    , sGroups(symbols.create("groups"))
     , sOutputHash(symbols.create("outputHash"))
     , sOutputHashAlgo(symbols.create("outputHashAlgo"))
     , sOutputHashMode(symbols.create("outputHashMode"))

src/libexpr/eval.hh

@@ -204,6 +204,7 @@ public:
         sFile, sLine, sColumn, sFunctor, sToString,
         sRight, sWrong, sStructuredAttrs, sBuilder, sArgs,
         sContentAddressed, sImpure,
+        sDrv, sLog, sProtected, sPermissions, sUsers, sGroups,
         sOutputHash, sOutputHashAlgo, sOutputHashMode,
         sRecurseForDerivations,
         sDescription, sSelf, sEpsilon, sStartSet, sOperator, sKey, sPath,