nix-community / vulnix

Vulnerability (CVE) scanner for Nix/NixOS.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Feature request: In-memory roots from currently-running processes

chkno opened this issue · comments

commented

--gc-roots is good because it includes all the roots in use by currently-running processes (found by rummaging through /proc/). But --gc-roots is bad because it includes all the old profiles.

nixos-rebuild switch, nix-env updates, etc., (intentionally) don't restart everything. vulnix ought to be able to raise issues with currently-running jobs (especially because nix dynamic gc-root tracking already does all the hard work here).

Please provide an option to just include the roots from currently-running processes.