ilyakooo0/nixpkgs
1
0
Fork 0
mirror of https://github.com/ilyakooo0/nixpkgs.git synced 2024-12-28 22:32:58 +03:00
Code Issues Projects Releases Wiki Activity

Merge pull request #18156 from shlevy/setuid-wrapper-atomic

Browse Source 
setuid-wrappers: Update wrapper dir atomically.
This commit is contained in:
Eelco Dolstra 2016-08-31 14:04:08 +02:00 committed by GitHub
commit 448efbacfa
1 changed files with 20 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
nixos/modules/security/setuid-wrappers.nix
View File

@ -102,11 +102,11 @@ in
source=/nix/var/nix/profiles/default/bin/${program} source=/nix/var/nix/profiles/default/bin/${program}
fi fi
cp ${setuidWrapper}/bin/setuid-wrapper ${wrapperDir}/${program} cp ${setuidWrapper}/bin/setuid-wrapper $wrapperDir/${program}
echo -n "$source" > ${wrapperDir}/${program}.real echo -n "$source" > $wrapperDir/${program}.real
chmod 0000 ${wrapperDir}/${program} # to prevent races chmod 0000 $wrapperDir/${program} # to prevent races
chown ${owner}.${group} ${wrapperDir}/${program} chown ${owner}.${group} $wrapperDir/${program}
chmod "u${if setuid then "+" else "-"}s,g${if setgid then "+" else "-"}s,${permissions}" ${wrapperDir}/${program} chmod "u${if setuid then "+" else "-"}s,g${if setgid then "+" else "-"}s,${permissions}" $wrapperDir/${program}
''; '';
in stringAfter [ "users" ] in stringAfter [ "users" ]
@ -115,9 +115,23 @@ in
# programs to be wrapped. # programs to be wrapped.
SETUID_PATH=${config.system.path}/bin:${config.system.path}/sbin SETUID_PATH=${config.system.path}/bin:${config.system.path}/sbin
rm -f ${wrapperDir}/* # */ mkdir -p /run/setuid-wrapper-dirs
wrapperDir=$(mktemp --directory --tmpdir=/run/setuid-wrapper-dirs setuid-wrappers.XXXXXXXXXX)
${concatMapStrings makeSetuidWrapper setuidPrograms} ${concatMapStrings makeSetuidWrapper setuidPrograms}
if [ -d ${wrapperDir} ]; then
mv --no-target-directory ${wrapperDir} ${wrapperDir}-old
ln --symbolic $wrapperDir ${wrapperDir}
rm --force --recursive ${wrapperDir}-old
elif [ -L ${wrapperDir} ]; then
ln --symbolic --force --no-dereference $wrapperDir ${wrapperDir}-tmp
old=$(readlink ${wrapperDir})
mv --no-target-directory ${wrapperDir}-tmp ${wrapperDir}
rm --force --recursive $old
else
ln --symbolic $wrapperDir ${wrapperDir}
fi
''; '';
}; };