8a34434...master · nix-bundle

AppRun.c+9−1

since splitsnapshots

unifiedsplit

@@ -207,6 +207,11 @@ int main(int argc, char *argv[]) {

207 err_exit("mount(%s, %s)", usrdir, path_buf);

208 }

209

210+ snprintf(path_buf, sizeof(path_buf), "%s/bin", rootdir);

211+ if (symlink("/usr/bin", path_buf) < 0) {

212+ err_exit("symlink(/usr/bin, %s)", path_buf);

213+ }

214+

210 // fixes issue #1 where writing to /proc/self/gid_map fails

215 // fixes issue #1 where writing to /proc/self/gid_map fails

211 // see user_namespaces(7) for more documentation

216 // see user_namespaces(7) for more documentation

212 int fd_setgroups = open("/proc/self/setgroups", O_WRONLY);

217 int fd_setgroups = open("/proc/self/setgroups", O_WRONLY);

@@ -226,8 +231,10 @@ int main(int argc, char *argv[]) {

226 err_exit("chroot(%s)", rootdir);

231 err_exit("chroot(%s)", rootdir);

227 }

232 }

228

233

234+ char *pwddir = getenv("PWD");

229− chdir("/");

235+ chdir(pwddir);

230

236

237+ SAVE_ENV_VAR(PWD);

231 SAVE_ENV_VAR(DBUS_SESSION_BUS_ADDRESS);

238 SAVE_ENV_VAR(DBUS_SESSION_BUS_ADDRESS);

232 SAVE_ENV_VAR(USER);

239 SAVE_ENV_VAR(USER);

233 SAVE_ENV_VAR(HOSTNAME);

240 SAVE_ENV_VAR(HOSTNAME);

@@ -243,6 +250,7 @@ int main(int argc, char *argv[]) {

243

250

244 clearenv();

251 clearenv();

245

252

253+ LOAD_ENV_VAR(PWD);

246 LOAD_ENV_VAR(DBUS_SESSION_BUS_ADDRESS);

254 LOAD_ENV_VAR(DBUS_SESSION_BUS_ADDRESS);

247 LOAD_ENV_VAR(USER);

255 LOAD_ENV_VAR(USER);

248 LOAD_ENV_VAR(HOSTNAME);

256 LOAD_ENV_VAR(HOSTNAME);

README.md+14−1

@@ -35,14 +35,27 @@ Some others to try:

35./nix-bundle.sh nano /bin/nano

36```

37

38+```sh

39+./nix-bundle.sh emacs /bin/emacs

40+```

41+

42+Or if you want to try graphical applications:

43+

44+```sh

45+# Simple X game. Very few dependencies. Quick to build and load. ~13MB

46+./nix-bundle.sh xskat /bin/xskat

47+```

48+

38```sh

49```sh

39./nix-bundle.sh firefox /bin/firefox

50./nix-bundle.sh firefox /bin/firefox

40```

51```

41

52

42```sh

53```sh

54+# SDL-based game. ~228MB

43−./nix-bundle.sh emacs /bin/emacs

55+./nix-bundle.sh ivan /bin/ivan

44```

56```

45

57

58+

46## Self-bundling (meta)

59## Self-bundling (meta)

47

60

48Starting with v0.1.3, you can bundle nix-bundle! To do this, just use nix-bundle normally:

61Starting with v0.1.3, you can bundle nix-bundle! To do this, just use nix-bundle normally:

appdir.nix+4−4

@@ -1,4 +1,4 @@

1−{ stdenv, fetchurl, muslPkgs, perl, pathsFromGraph, fetchFromGitHub, coreutils, bash }:

1+{ stdenv, lib, fetchurl, muslPkgs, perl, pathsFromGraph, fetchFromGitHub, coreutils, bash }:

2

3let

4 AppRun = targets: muslPkgs.stdenv.mkDerivation {

@@ -8,7 +8,7 @@ let

8

9 buildPhase = ''

10 CC="$CC -O2 -Wall -Wno-deprecated-declarations -Wno-unused-result -static"

11− $CC ${./AppRun.c} -o AppRun -DENV_PATH='"${stdenv.lib.makeBinPath targets}"'

11+ $CC ${./AppRun.c} -o AppRun -DENV_PATH='"${lib.makeBinPath targets}"'

12 '';

13

14 installPhase = ''

@@ -63,12 +63,12 @@ in

63

64 # icons

65 if [ -d ${target}/share/icons ]; then

66− icon=$(find ${target}/share/icons -name "${name}.png" | head -n1)

66+ icon=$(find ${target}/share/icons -name "${name}*.png" | head -n1)

67 if ! [ -z "$icon" ]; then

68 ln -s .$icon

69 ln -s .$icon .DirIcon

70 else

71− icon=$(find ${target}/share/icons -name "${name}.svg" | head -n1)

71+ icon=$(find ${target}/share/icons -name "${name}*.svg" | head -n1)

72 if ! [ -z "$icon" ]; then

73 ln -s .$icon

74 ln -s .$icon .DirIcon

appimage-bundle.nixnew file+61

@@ -0,0 +1,61 @@

1+# use like this:

2+# nix-build appimage-bundle.nix --argstr package hello --argstr exec hello

3+# nix-build appimage-bundle.nix --arg package 'with import <nixpkgs>{}; writers.writePython3Bin "helloThere.py" {} "print(1)\n"' --argstr exec helloThere.py

4+

5+

6+{nixpkgs ? import <nixpkgs>{},

7+package,

8+exec,

9+... }:

10+let

11+ appimage_src = drv : exec : with nixpkgs;

12+ self.stdenv.mkDerivation rec {

13+ name = drv.name + "-appdir";

14+ env = buildEnv {

15+ inherit name;

16+ paths = buildInputs;

17+ };

18+ src = env;

19+ inherit exec;

20+ buildInputs = [ drv ];

21+ buildCommand = ''

22+ mkdir -p $out/share/icons/hicolor/256x256/apps

23+ mkdir -p $out/share/applications

24+

25+ shopt -s extglob

26+ ln -s ${env}/!(share) $out/

27+ ln -s ${env}/share/* $out/share/

28+

29+ touch $out/share/icons/hicolor/256x256/apps/${drv.name}.png

30+ touch $out/share/icons/${drv.name}.png

31+

32+ cat <<EOF > $out/share/applications/${drv.name}.desktop

33+ [Desktop Entry]

34+ Type=Application

35+ Version=1.0

36+ Name=${drv.name}

37+ Path=${env}

38+ Icon=${drv.name}

39+ Exec=$exec

40+ Terminal=true

41+ EOF

42+ '';

43+ system = builtins.currentSystem;

44+ };

45+

46+in

47+ let results =

48+ if (nixpkgs.lib.isDerivation package && !(nixpkgs.lib.isString package))

49+ then {

50+ name = package.name;

51+ target = appimage_src package "${exec}";

52+ extraTargets = [];

53+ }

54+ else {

55+ name = nixpkgs."${package}".name;

56+ target = appimage_src (nixpkgs."${package}") "${exec}";

57+ extraTargets = [];

58+ };

59+ in

60+ with (import (./appimage-top.nix){nixpkgs' = nixpkgs.path;});

61+ (appimage (appdir results )).overrideAttrs (old: {name = results.name;})

appimagetool.nix+2−2

@@ -1,4 +1,4 @@

1−{ stdenv, fetchurl, fuse, zlib, squashfsTools, glib }:

1+{ stdenv, lib, fetchurl, fuse, zlib, squashfsTools, glib }:

2

3# This is from some binaries.

4

@@ -37,7 +37,7 @@ in stdenv.mkDerivation rec {

37 for x in $out/bin/*; do

38 patchelf \

39 --set-interpreter ${dynamicLinker} \

40− --set-rpath ${stdenv.lib.makeLibraryPath [ zlib stdenv.glibc.out fuse glib ]} \

40+ --set-rpath ${lib.makeLibraryPath [ zlib stdenv.glibc.out fuse glib ]} \

41 $x

42 done

43 '';

default.nix+35−10

@@ -2,12 +2,29 @@

2

3with nixpkgs;

4

5+let

6+ arx' = haskellPackages.arx.overrideAttrs (o: {

7+ patchPhase = (o.patchPhase or "") + ''

8+ substituteInPlace model-scripts/tmpx.sh \

9+ --replace /tmp/ \$HOME/.cache/

10+ '';

11+ });

5−rec {

12+in rec {

13+ toStorePath = target:

14+ # If a store path has been given but is not a derivation, add the missing context

15+ # to it so it will be propagated properly as a build input.

16+ if !(lib.isDerivation target) && lib.isStorePath target then

17+ let path = toString target; in

18+ builtins.appendContext path { "${path}" = { path = true; }; }

19+ # Otherwise, add to the store. This takes care of appending the store path

20+ # in the context automatically.

21+ else "${target}";

22+

6 arx = { archive, startup}:

23 arx = { archive, startup}:

7 stdenv.mkDerivation {

24 stdenv.mkDerivation {

8 name = "arx";

25 name = "arx";

9 buildCommand = ''

26 buildCommand = ''

10− ${haskellPackages.arx}/bin/arx tmpx ${archive} -o $out // ${startup}

27+ ${arx'}/bin/arx tmpx --shared -rm! ${archive} -o $out // ${startup}

11 chmod +x $out

28 chmod +x $out

12 '';

29 '';

13 };

30 };

@@ -28,7 +45,7 @@ rec {

28 };

45 };

29

46

30 # TODO: eventually should this go in nixpkgs?

47 # TODO: eventually should this go in nixpkgs?

31− nix-user-chroot = stdenv.lib.makeOverridable stdenv.mkDerivation {

48+ nix-user-chroot = lib.makeOverridable stdenv.mkDerivation {

32 name = "nix-user-chroot-2c52b5f";

49 name = "nix-user-chroot-2c52b5f";

33 src = ./nix-user-chroot;

50 src = ./nix-user-chroot;

34

51

@@ -51,6 +68,8 @@ rec {

51

68

52 runHook postInstall

69 runHook postInstall

53 '';

70 '';

71+

72+ meta.platforms = lib.platforms.linux;

54 };

73 };

55

74

56 makebootstrap = { targets, startup }:

75 makebootstrap = { targets, startup }:

@@ -61,14 +80,20 @@ rec {

61 };

80 };

62 };

81 };

63

82

64− makeStartup = { target, nixUserChrootFlags, nix-user-chroot', run }:

83+ makeStartup = { target, nixUserChrootFlags, nix-user-chroot', run, initScript }:

84+ let

85+ # Avoid re-adding a store path into the store

86+ path = toStorePath target;

87+ in

65 writeScript "startup" ''

88 writeScript "startup" ''

89+ #!/bin/sh

90+ ${initScript}

66−.${nix-user-chroot'}/bin/nix-user-chroot -n ./nix ${nixUserChrootFlags} -- ${target}${run} $@

91+ .${nix-user-chroot'}/bin/nix-user-chroot -n ./nix ${nixUserChrootFlags} -- ${path}${run} "$@"

67 '';

92 '';

68

93

69− nix-bootstrap = { target, extraTargets ? [], run, nix-user-chroot' ? nix-user-chroot, nixUserChrootFlags ? "" }:

94+ nix-bootstrap = { target, extraTargets ? [], run, nix-user-chroot' ? nix-user-chroot, nixUserChrootFlags ? "", initScript ? "" }:

70 let

95 let

71− script = makeStartup { inherit target nixUserChrootFlags nix-user-chroot' run; };

96+ script = makeStartup { inherit target nixUserChrootFlags nix-user-chroot' run initScript; };

72 in makebootstrap {

97 in makebootstrap {

73 startup = ".${script} '\"$@\"'";

98 startup = ".${script} '\"$@\"'";

74 targets = [ "${script}" ] ++ extraTargets;

99 targets = [ "${script}" ] ++ extraTargets;

@@ -85,10 +110,10 @@ rec {

85 nix-user-chroot'' = targets: nix-user-chroot.overrideDerivation (o: {

110 nix-user-chroot'' = targets: nix-user-chroot.overrideDerivation (o: {

86 buildInputs = o.buildInputs ++ targets;

111 buildInputs = o.buildInputs ++ targets;

87 makeFlags = o.makeFlags ++ [

112 makeFlags = o.makeFlags ++ [

88− ''ENV_PATH="${stdenv.lib.makeBinPath targets}"''

113+ ''ENV_PATH="${lib.makeBinPath targets}"''

89 ];

114 ];

90− }); in { target, extraTargets ? [], run }: nix-bootstrap {

115+ }); in { target, extraTargets ? [], run, initScript ? "" }: nix-bootstrap {

91− inherit target extraTargets run;

116+ inherit target extraTargets run initScript;

92 nix-user-chroot' = nix-user-chroot'' extraTargets;

117 nix-user-chroot' = nix-user-chroot'' extraTargets;

93 };

118 };

94}

119}

flake.nixnew file+26

@@ -0,0 +1,26 @@

1+{

2+ description = "The purely functional package manager";

3+

4+ inputs.nixpkgs.url = "nixpkgs/nixos-20.03-small";

5+

6+ outputs = { self, nixpkgs }: let

7+ systems = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];

8+ forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f system);

9+ in {

10+ bundlers = {

11+ nix-bundle = { program, system }: let

12+ nixpkgs' = nixpkgs.legacyPackages.${system};

13+ nix-bundle = import self { nixpkgs = nixpkgs'; };

14+ script = nixpkgs'.writeScript "startup" ''

15+ #!/bin/sh

16+ .${nix-bundle.nix-user-chroot}/bin/nix-user-chroot -n ./nix -- ${program} "$@"

17+ '';

18+ in nix-bundle.makebootstrap {

19+ targets = [ script ];

20+ startup = ".${builtins.unsafeDiscardStringContext script} '\"$@\"'";

21+ };

22+ };

23+

24+ defaultBundler = self.bundlers.nix-bundle;

25+ };

26+}

nix-bootstrap.sh+13−13

@@ -1,35 +1,35 @@

1#!/bin/sh

2

3−cmd=sh

4−if ! [ $# -eq 0 ]; then

3+if [ $# -gt 0 ]; then

5− cmd=$@

4+ set -- sh

6fi

5fi

7

6

8# should download this in the future

7# should download this in the future

9# but the mirror is down

8# but the mirror is down

10−proot=`dirname $0`/proot-`uname -p`

9+proot=$(dirname "$0")/proot-$(uname -p)

11export PROOT_NO_SECCOMP=1

10export PROOT_NO_SECCOMP=1

12

11

13nixdir=$HOME/.nix

12nixdir=$HOME/.nix

14

13

15OLD_NIX_PATH=$NIX_PATH

14OLD_NIX_PATH=$NIX_PATH

15+# shellcheck disable=SC1090

16−if [ -e $HOME/.nix-profile/etc/profile.d/nix.sh ]; then . $HOME/.nix-profile/etc/profile.d/nix.sh; fi

16+if [ -e "$HOME/.nix-profile/etc/profile.d/nix.sh" ]; then . "$HOME/.nix-profile/etc/profile.d/nix.sh"; fi

17−if ! [ -z "$OLD_NIX_PATH" ]; then NIX_PATH="$OLD_NIX_PATH"; fi

17+if [ -n "$OLD_NIX_PATH" ]; then NIX_PATH="$OLD_NIX_PATH"; fi

18

19if [ -z "$IN_PROOT" ]; then

20 export IN_PROOT=1

21

22− if ! [ -d $nixdir ]; then

22+ if ! [ -d "$nixdir" ]; then

23− mkdir -p $nixdir

23+ mkdir -p "$nixdir"

24 s=$(mktemp)

25− curl https://nixos.org/nix/install -o $s

25+ curl https://nixos.org/nix/install -o "$s"

26− $proot -b $nixdir:/nix $0 sh $s

26+ $proot -b "$nixdir:/nix" "$0" sh "$s"

27 fi

28

29− $proot -b $nixdir:/nix $0 $cmd

29+ $proot -b "$nixdir:/nix" "$0" "$@"

30

31 export IN_PROOT=

32 exit

33−elif ! [ $# -eq 0 ]; then

33+elif [ $# -gt 0 ]; then

34− exec $cmd

34+ exec "$@"

35fi

nix-bundle.sh+11−6

@@ -8,6 +8,9 @@ Usage: $0 TARGET EXECUTABLE

8Create a single-file bundle from the nixpkgs attribute "TARGET".

9EXECUTABLE should be relative to the TARGET's output path.

10

11+The TARGET is either an attribute in nixpkgs, or an absolute path to the

12+store.

13+

11For example:

14For example:

12

15

13$ $0 hello /bin/hello

16$ $0 hello /bin/hello

@@ -19,7 +22,7 @@ EOF

19 exit 1

22 exit 1

20fi

23fi

21

24

22−nix_file=`dirname $0`/default.nix

25+nix_file=$(dirname "$0")/default.nix

23

26

24target="$1"

27target="$1"

25shift

28shift

@@ -38,21 +41,23 @@ shift

38bootstrap=nix-bootstrap

41bootstrap=nix-bootstrap

39if [ "$target" = "nix-bundle" ] || [ "$target" = "nixStable" ] || [ "$target" = "nixUnstable" ] || [ "$target" = "nix" ]; then

42if [ "$target" = "nix-bundle" ] || [ "$target" = "nixStable" ] || [ "$target" = "nixUnstable" ] || [ "$target" = "nix" ]; then

40 bootstrap=nix-bootstrap-nix

43 bootstrap=nix-bootstrap-nix

41−elif ! [ -z "$extraTargets" ]; then

44+elif [ -n "$extraTargets" ]; then

42 bootstrap=nix-bootstrap-path

45 bootstrap=nix-bootstrap-path

43fi

46fi

44

47

45expr="with import <nixpkgs> {}; with import $nix_file {}; $bootstrap { target = $target; extraTargets = [ $extraTargets ]; run = \"$exec\"; }"

48expr="with import <nixpkgs> {}; with import $nix_file {}; $bootstrap { target = $target; extraTargets = [ $extraTargets ]; run = \"$exec\"; }"

46

49

47−out=$(nix-store --no-gc-warning -r $(nix-instantiate --no-gc-warning -E "$expr"))

50+drv=$(nix-instantiate --no-gc-warning -E "$expr")

51+

52+out=$(nix-store --no-gc-warning --realize "$drv")

48

53

49if [ -z "$out" ]; then

54if [ -z "$out" ]; then

50 >&2 echo "$0 failed. Exiting."

55 >&2 echo "$0 failed. Exiting."

51 exit 1

56 exit 1

52elif [ -t 1 ]; then

57elif [ -t 1 ]; then

53− filename=$(basename $exec)

58+ filename=$(basename "$exec")

54 echo "Nix bundle created at $filename."

59 echo "Nix bundle created at $filename."

55− cp -f $out $filename

60+ cp -f "$out" "$filename"

56else

61else

57− cat $out

62+ echo "$out"

58fi

63fi

nix-run.sh+23−21

@@ -18,11 +18,11 @@ if [ -z "$1" ]; then

18 exit 1

19fi

20

21−pkg=$1

21+pkg="$1"

22shift

23

24# A second argument will provide a hint to run

25−if ! [ -z "$1" ]; then

25+if [ -n "$1" ]; then

26 name="$1"

27 shift

28else

@@ -31,7 +31,7 @@ fi

31

32expr="with import <nixpkgs> {}; let x = ($pkg); in x"

33path=$(nix-instantiate --no-gc-warning -E "$expr")

34−out=$(nix-store --no-gc-warning -r $path)

34+out=$(nix-store --no-gc-warning -r "$path")

35

36if [ -z "$out" ]; then

37 >&2 echo "Could not evaluate $pkg to a Nix drv."

@@ -43,7 +43,7 @@ run_darwin_app () {

43 dir="$1"

44 shift

45

46− open -a "$dir" --args $@

46+ open -a "$dir" --args "$@"

47}

48

49# Run FILE as a Freedesktop application

@@ -53,14 +53,16 @@ run_linux_desktop_app () {

53 file="$1"

54 shift

55

56− cmd=$(grep '^Exec' $file | tail -1 | \

56+ cmd=$(grep '^Exec' "$file" | tail -1 | \

57− sed 's/Exec=//;s/^"//;s/" *$/')

57+ sed 's/Exec=//;s/^"//;s/" *$//')

58

59− if ! [ -z "$@" ]; then

59+ if [ "$#" -gt 0 ]; then

60− cmd=$(echo "$cmd" | sed "s/%[fu]/$1/;s/%[FU]/$@/")

60+ cmd=$(echo "$cmd" | sed "s/%[fu]/$1/;s/%[FU]/$*/")

61 fi

62

63 cmd=$(echo "$cmd" | sed "s/%k/$desktop/;s/%.//")

64+

65+ "$cmd" "$@"

64}

66}

65

67

66# Run FILE as an ordinary binary

68# Run FILE as an ordinary binary

@@ -68,30 +70,30 @@ run_bin () {

68 file="$1"

70 file="$1"

69 shift

71 shift

70

72

71− $file $@

73+ "$file" "$@"

72}

74}

73

75

74if [ -x "$out/nix-support/run" ]; then

76if [ -x "$out/nix-support/run" ]; then

75− run_bin "$out/nix-support/run" $@

77+ run_bin "$out/nix-support/run" "$@"

76elif [ -x "$out/bin/run" ]; then

78elif [ -x "$out/bin/run" ]; then

77− run_bin "$out/bin/run" $@

79+ run_bin "$out/bin/run" "$@"

78elif [ "$(uname)" = Darwin ] && [ -d "$out/Applications/$name.app" ]; then

80elif [ "$(uname)" = Darwin ] && [ -d "$out/Applications/$name.app" ]; then

79− run_darwin_app "$out/Applications/$name.app" $@

81+ run_darwin_app "$out/Applications/$name.app" "$@"

80−elif [ "$(uname)" = Darwin ] && [ -d $out/Applications/*.app ]; then

82+elif [ "$(uname)" = Darwin ] && [ -d "$out"/Applications/*.app ]; then

81− for f in $out/Applications/*.app; do

83+ for f in "$out"/Applications/*.app; do

82− run_darwin_app "$f" $@

84+ run_darwin_app "$f" "$@"

83 done

85 done

84elif [ -f "$out/share/applications/$name.desktop" ]; then

86elif [ -f "$out/share/applications/$name.desktop" ]; then

85− run_linux_desktop_app "$out/share/applications/$name.desktop" $@

87+ run_linux_desktop_app "$out/share/applications/$name.desktop" "$@"

86−elif [ -d $out/share/applications ]; then

88+elif [ -d "$out"/share/applications ]; then

87− for f in $out/share/applications/*.desktop; do

89+ for f in "$out"/share/applications/*.desktop; do

88 run_linux_desktop_app "$f"

90 run_linux_desktop_app "$f"

89 done

91 done

90elif [ -x "$out/bin/$name" ]; then

92elif [ -x "$out/bin/$name" ]; then

91− run_bin "$out/bin/$name" $@

93+ run_bin "$out/bin/$name" "$@"

92elif [ -d "$out/bin" ]; then

94elif [ -d "$out/bin" ]; then

93− for bin in $out/bin/*; do

95+ for bin in "$out"/bin/*; do

94− run_bin "$bin" $@

96+ run_bin "$bin" "$@"

95 done

97 done

96else

98else

97 >&2 echo "Cannot find a way to run path $out."

99 >&2 echo "Cannot find a way to run path $out."

nix-user-chroot/main.cpp+77−4

@@ -26,6 +26,10 @@

26using namespace std;

27

28#define err_exit(format, ...) { fprintf(stderr, format ": %s\n", ##__VA_ARGS__, strerror(errno)); exit(EXIT_FAILURE); }

29+static int child_proc(const char *rootdir, const char *nixdir, uint8_t clear_env, list<struct DirMapping> dirMappings, list<struct SetEnv> envMappings, const char *executable, char * const new_argv[]);

30+

31+volatile uint8_t child_died = 0;

32+int child_pid = 0;

29

33

30static void usage(const char *pname) {

34static void usage(const char *pname) {

31 fprintf(stderr, "Usage: %s -n <nixpath> -- <command>\n", pname);

35 fprintf(stderr, "Usage: %s -n <nixpath> -- <command>\n", pname);

@@ -33,6 +37,7 @@ static void usage(const char *pname) {

33 fprintf(stderr, "\t-m <src>:<src>\tmap src on the host to dest in the sandbox\n");

37 fprintf(stderr, "\t-m <src>:<src>\tmap src on the host to dest in the sandbox\n");

34 fprintf(stderr, "\t-d\tdelete all default dir mappings, may break things\n");

38 fprintf(stderr, "\t-d\tdelete all default dir mappings, may break things\n");

35 fprintf(stderr, "\t-p <var>\tpreserve the value of a variable across the -c clear\n");

39 fprintf(stderr, "\t-p <var>\tpreserve the value of a variable across the -c clear\n");

40+ fprintf(stderr, "\t-e\tadd an /escape-hatch to the sandbox, and run (outside the sandbox) any strings written to it\n");

36

41

37 exit(EXIT_FAILURE);

42 exit(EXIT_FAILURE);

38}

43}

@@ -91,8 +96,15 @@ struct DirMapping parseMapping(string input) {

91 return (struct DirMapping){ src, dest };

96 return (struct DirMapping){ src, dest };

92}

97}

93

98

99+static void handle_child_death(int signo, siginfo_t *info, void *context) {

100+ if ( (child_pid == 0) || (info->si_pid == child_pid) ) {

101+ child_died = 1;

102+ }

103+}

104+

94int main(int argc, char *argv[]) {

105int main(int argc, char *argv[]) {

95 uint8_t clear_env = 0;

106 uint8_t clear_env = 0;

107+ uint8_t enable_escape_hatch = 0;

96 char *nixdir = NULL;

108 char *nixdir = NULL;

97 list<struct DirMapping> dirMappings;

109 list<struct DirMapping> dirMappings;

98 list<struct SetEnv> envMappings;

110 list<struct SetEnv> envMappings;

@@ -107,14 +119,19 @@ int main(int argc, char *argv[]) {

107 x("var");

119 x("var");

108 x("etc");

120 x("etc");

109 x("usr");

121 x("usr");

122+ x("home");

123+ x("root");

110#undef x

124#undef x

111

125

112 int opt;

126 int opt;

113− while ((opt = getopt(argc, argv, "cn:m:dp:")) != -1) {

127+ while ((opt = getopt(argc, argv, "cen:m:dp:")) != -1) {

114 switch (opt) {

128 switch (opt) {

115 case 'c':

129 case 'c':

116 clear_env = 1;

130 clear_env = 1;

117 break;

131 break;

132+ case 'e':

133+ enable_escape_hatch = 1;

134+ break;

118 case 'n':

135 case 'n':

119 // determine absolute directory for nix dir

136 // determine absolute directory for nix dir

120 nixdir = realpath(optarg, NULL);

137 nixdir = realpath(optarg, NULL);

@@ -162,6 +179,62 @@ int main(int argc, char *argv[]) {

162 err_exit("mkdtemp(%s)", template_);

179 err_exit("mkdtemp(%s)", template_);

163 }

180 }

164

181

182+ int unrace[2];

183+

184+ if (pipe(unrace)) {

185+ err_exit("pipe()");

186+ }

187+

188+ struct sigaction handle_child;

189+ handle_child.sa_sigaction = handle_child_death;

190+ handle_child.sa_flags = SA_SIGINFO;

191+

192+ struct sigaction old_handler;

193+ if (sigaction(SIGCHLD, &handle_child, &old_handler)) {

194+ err_exit("sigaction()");

195+ }

196+

197+ int child;

198+ child = child_pid = fork();

199+ if (child < 0) {

200+ err_exit("fork()");

201+ } else if (child == 0) {

202+ sigaction(SIGCHLD, &old_handler, NULL);

203+ close(unrace[1]);

204+ char buf[10];

205+ read(unrace[0], buf, 10);

206+ close(unrace[0]);

207+ return child_proc(rootdir, nixdir, clear_env, dirMappings, envMappings, argv[optind], argv + optind);

208+ } else {

209+ close(unrace[0]);

210+ char fifopath[PATH_MAX];

211+ if (enable_escape_hatch) {

212+ snprintf(fifopath, PATH_MAX, "%s/escape-hatch", rootdir);

213+ mkfifo(fifopath, 0600);

214+ }

215+ close(unrace[1]);

216+ if (enable_escape_hatch) {

217+ char buffer[1024];

218+ while (!child_died) {

219+ int fd = open(fifopath, O_RDONLY);

220+ if (fd < 0) {

221+ if (errno == EINTR) continue;

222+ fprintf(stderr, "error opening escape-hatch: %s\n", strerror(errno));

223+ continue;

224+ }

225+ int size = read(fd, buffer, 1024);

226+ buffer[size] = 0;

227+ system(buffer);

228+ close(fd);

229+ }

230+ }

231+ int status;

232+ int ret = waitpid(child, &status, 0);

233+ return WEXITSTATUS(status);

234+ }

235+}

236+

237+static int child_proc(const char *rootdir, const char *nixdir, uint8_t clear_env, list<struct DirMapping> dirMappings, list<struct SetEnv> envMappings, const char *executable, char * const new_argv[]) {

165 // get uid, gid before going to new namespace

238 // get uid, gid before going to new namespace

166 uid_t uid = getuid();

239 uid_t uid = getuid();

167 gid_t gid = getgid();

240 gid_t gid = getgid();

@@ -169,7 +242,7 @@ int main(int argc, char *argv[]) {

169 // "unshare" into new namespace

242 // "unshare" into new namespace

170 if (unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0) {

243 if (unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0) {

171 if (errno == EPERM) {

244 if (errno == EPERM) {

172− fputs("Run the following as root to enable unprivileged namespace use:\nsysctl -w kernel.unprivileged_userns_clone=1 ; echo kernel.unprivileged_userns_clone=1 > /etc/sysctl.d/nix-user-chroot.conf\n\n", stderr);

245+ fputs("Run the following to enable unprivileged namespace use:\nsudo bash -c \"sysctl -w kernel.unprivileged_userns_clone=1 ; echo kernel.unprivileged_userns_clone=1 > /etc/sysctl.d/nix-user-chroot.conf\"\n\n", stderr);

173 exit(EXIT_FAILURE);

246 exit(EXIT_FAILURE);

174 } else {

247 } else {

175 err_exit("unshare()");

248 err_exit("unshare()");

@@ -229,6 +302,6 @@ int main(int argc, char *argv[]) {

229 }

302 }

230

303

231 // execute the command

304 // execute the command

232− execvp(argv[optind], argv + optind);

305+ execvp(executable, new_argv);

233− err_exit("execvp(%s)", argv[optind]);

306+ err_exit("execvp(%s)", executable);

234}

307}

release.nix+1−1

@@ -4,7 +4,7 @@

4stdenv.mkDerivation rec {

5 pname = "nix-bundle";

6 name = "${pname}-${version}";

7− version = "0.3.0";

7+ version = "0.4.0";

8

9 src = ./.;

10

test.shnew file+10

@@ -0,0 +1,10 @@

1+#!/usr/bin/env bash

2+set -euo pipefail

3+export NIX_PATH=channel:nixos-20.09

4+

5+echo "Test with attribute name"

6+./nix-bundle.sh hello /bin/hello

7+

8+echo "Test with store path"

9+out=$(nix-build --no-out-link --expr '(import <nixpkgs> {})' -A hello)

10+./nix-bundle.sh "$out" /bin/hello