982cb12..master · nix-bundle

git.iko.soy/nix-bundle

on master help sign in

AppRun.c+9−1

since splitsnapshots

unifiedsplit

@@ -207,6 +207,11 @@ int main(int argc, char *argv[]) {

207 err_exit("mount(%s, %s)", usrdir, path_buf);

208 }

209

210+ snprintf(path_buf, sizeof(path_buf), "%s/bin", rootdir);

211+ if (symlink("/usr/bin", path_buf) < 0) {

212+ err_exit("symlink(/usr/bin, %s)", path_buf);

213+ }

214+

210 // fixes issue #1 where writing to /proc/self/gid_map fails

215 // fixes issue #1 where writing to /proc/self/gid_map fails

211 // see user_namespaces(7) for more documentation

216 // see user_namespaces(7) for more documentation

212 int fd_setgroups = open("/proc/self/setgroups", O_WRONLY);

217 int fd_setgroups = open("/proc/self/setgroups", O_WRONLY);

@@ -226,8 +231,10 @@ int main(int argc, char *argv[]) {

226 err_exit("chroot(%s)", rootdir);

231 err_exit("chroot(%s)", rootdir);

227 }

232 }

228

233

234+ char *pwddir = getenv("PWD");

229− chdir("/");

235+ chdir(pwddir);

230

236

237+ SAVE_ENV_VAR(PWD);

231 SAVE_ENV_VAR(DBUS_SESSION_BUS_ADDRESS);

238 SAVE_ENV_VAR(DBUS_SESSION_BUS_ADDRESS);

232 SAVE_ENV_VAR(USER);

239 SAVE_ENV_VAR(USER);

233 SAVE_ENV_VAR(HOSTNAME);

240 SAVE_ENV_VAR(HOSTNAME);

@@ -243,6 +250,7 @@ int main(int argc, char *argv[]) {

243

250

244 clearenv();

251 clearenv();

245

252

253+ LOAD_ENV_VAR(PWD);

246 LOAD_ENV_VAR(DBUS_SESSION_BUS_ADDRESS);

254 LOAD_ENV_VAR(DBUS_SESSION_BUS_ADDRESS);

247 LOAD_ENV_VAR(USER);

255 LOAD_ENV_VAR(USER);

248 LOAD_ENV_VAR(HOSTNAME);

256 LOAD_ENV_VAR(HOSTNAME);

README.md+14−1

@@ -35,14 +35,27 @@ Some others to try:

35./nix-bundle.sh nano /bin/nano

36```

38+```sh

39+./nix-bundle.sh emacs /bin/emacs

40+```

41+

42+Or if you want to try graphical applications:

43+

44+```sh

45+# Simple X game. Very few dependencies. Quick to build and load. ~13MB

46+./nix-bundle.sh xskat /bin/xskat

47+```

48+

38```sh

49```sh

39./nix-bundle.sh firefox /bin/firefox

50./nix-bundle.sh firefox /bin/firefox

40```

51```

42```sh

53```sh

54+# SDL-based game. ~228MB

43−./nix-bundle.sh emacs /bin/emacs

55+./nix-bundle.sh ivan /bin/ivan

44```

56```

58+

46## Self-bundling (meta)

59## Self-bundling (meta)

48Starting with v0.1.3, you can bundle nix-bundle! To do this, just use nix-bundle normally:

61Starting with v0.1.3, you can bundle nix-bundle! To do this, just use nix-bundle normally:

appdir.nix+4−4

@@ -1,4 +1,4 @@

1−{ stdenv, fetchurl, muslPkgs, perl, pathsFromGraph, fetchFromGitHub, coreutils, bash }:

1+{ stdenv, lib, fetchurl, muslPkgs, perl, pathsFromGraph, fetchFromGitHub, coreutils, bash }:

3let

4 AppRun = targets: muslPkgs.stdenv.mkDerivation {

@@ -8,7 +8,7 @@ let

9 buildPhase = ''

10 CC="$CC -O2 -Wall -Wno-deprecated-declarations -Wno-unused-result -static"

11− $CC ${./AppRun.c} -o AppRun -DENV_PATH='"${stdenv.lib.makeBinPath targets}"'

11+ $CC ${./AppRun.c} -o AppRun -DENV_PATH='"${lib.makeBinPath targets}"'

12 '';

14 installPhase = ''

@@ -63,12 +63,12 @@ in

64 # icons

65 if [ -d ${target}/share/icons ]; then

66− icon=$(find ${target}/share/icons -name "${name}.png" | head -n1)

66+ icon=$(find ${target}/share/icons -name "${name}*.png" | head -n1)

67 if ! [ -z "$icon" ]; then

68 ln -s .$icon

69 ln -s .$icon .DirIcon

70 else

71− icon=$(find ${target}/share/icons -name "${name}.svg" | head -n1)

71+ icon=$(find ${target}/share/icons -name "${name}*.svg" | head -n1)

72 if ! [ -z "$icon" ]; then

73 ln -s .$icon

74 ln -s .$icon .DirIcon

appimage-bundle.nixnew file+61

@@ -0,0 +1,61 @@

1+# use like this:

2+# nix-build appimage-bundle.nix --argstr package hello --argstr exec hello

3+# nix-build appimage-bundle.nix --arg package 'with import <nixpkgs>{}; writers.writePython3Bin "helloThere.py" {} "print(1)\n"' --argstr exec helloThere.py

6+{nixpkgs ? import <nixpkgs>{},

7+package,

8+exec,

9+... }:

10+let

11+ appimage_src = drv : exec : with nixpkgs;

12+ self.stdenv.mkDerivation rec {

13+ name = drv.name + "-appdir";

14+ env = buildEnv {

15+ inherit name;

16+ paths = buildInputs;

17+ };

18+ src = env;

19+ inherit exec;

20+ buildInputs = [ drv ];

21+ buildCommand = ''

22+ mkdir -p $out/share/icons/hicolor/256x256/apps

23+ mkdir -p $out/share/applications

24+

25+ shopt -s extglob

26+ ln -s ${env}/!(share) $out/

27+ ln -s ${env}/share/* $out/share/

28+

29+ touch $out/share/icons/hicolor/256x256/apps/${drv.name}.png

30+ touch $out/share/icons/${drv.name}.png

31+

32+ cat <<EOF > $out/share/applications/${drv.name}.desktop

33+ [Desktop Entry]

34+ Type=Application

35+ Version=1.0

36+ Name=${drv.name}

37+ Path=${env}

38+ Icon=${drv.name}

39+ Exec=$exec

40+ Terminal=true

41+ EOF

42+ '';

43+ system = builtins.currentSystem;

44+ };

45+

46+in

47+ let results =

48+ if (nixpkgs.lib.isDerivation package && !(nixpkgs.lib.isString package))

49+ then {

50+ name = package.name;

51+ target = appimage_src package "${exec}";

52+ extraTargets = [];

53+ }

54+ else {

55+ name = nixpkgs."${package}".name;

56+ target = appimage_src (nixpkgs."${package}") "${exec}";

57+ extraTargets = [];

58+ };

59+ in

60+ with (import (./appimage-top.nix){nixpkgs' = nixpkgs.path;});

61+ (appimage (appdir results )).overrideAttrs (old: {name = results.name;})

appimagetool.nix+2−2

@@ -1,4 +1,4 @@

1−{ stdenv, fetchurl, fuse, zlib, squashfsTools, glib }:

1+{ stdenv, lib, fetchurl, fuse, zlib, squashfsTools, glib }:

3# This is from some binaries.

@@ -37,7 +37,7 @@ in stdenv.mkDerivation rec {

37 for x in $out/bin/*; do

38 patchelf \

39 --set-interpreter ${dynamicLinker} \

40− --set-rpath ${stdenv.lib.makeLibraryPath [ zlib stdenv.glibc.out fuse glib ]} \

40+ --set-rpath ${lib.makeLibraryPath [ zlib stdenv.glibc.out fuse glib ]} \

41 $x

42 done

43 '';

default.nix+46−26

@@ -2,12 +2,29 @@

3with nixpkgs;

5+let

6+ arx' = haskellPackages.arx.overrideAttrs (o: {

7+ patchPhase = (o.patchPhase or "") + ''

8+ substituteInPlace model-scripts/tmpx.sh \

9+ --replace /tmp/ \$HOME/.cache/

10+ '';

11+ });

5−rec {

12+in rec {

13+ toStorePath = target:

14+ # If a store path has been given but is not a derivation, add the missing context

15+ # to it so it will be propagated properly as a build input.

16+ if !(lib.isDerivation target) && lib.isStorePath target then

17+ let path = toString target; in

18+ builtins.appendContext path { "${path}" = { path = true; }; }

19+ # Otherwise, add to the store. This takes care of appending the store path

20+ # in the context automatically.

21+ else "${target}";

22+

6 arx = { archive, startup}:

23 arx = { archive, startup}:

7 stdenv.mkDerivation {

24 stdenv.mkDerivation {

8 name = "arx";

25 name = "arx";

9 buildCommand = ''

26 buildCommand = ''

10− ${haskellPackages.arx}/bin/arx tmpx ${archive} -o $out // ${startup}

27+ ${arx'}/bin/arx tmpx --shared -rm! ${archive} -o $out // ${startup}

11 chmod +x $out

28 chmod +x $out

12 '';

29 '';

13 };

30 };

@@ -28,10 +45,12 @@ rec {

28 };

45 };

30 # TODO: eventually should this go in nixpkgs?

47 # TODO: eventually should this go in nixpkgs?

31− nix-user-chroot = stdenv.lib.makeOverridable stdenv.mkDerivation {

48+ nix-user-chroot = lib.makeOverridable stdenv.mkDerivation {

32 name = "nix-user-chroot-2c52b5f";

49 name = "nix-user-chroot-2c52b5f";

33 src = ./nix-user-chroot;

50 src = ./nix-user-chroot;

52+ makeFlags = [];

53+

35 # hack to use when /nix/store is not available

54 # hack to use when /nix/store is not available

36 postFixup = ''

55 postFixup = ''

37 exe=$out/bin/nix-user-chroot

56 exe=$out/bin/nix-user-chroot

@@ -49,6 +68,8 @@ rec {

50 runHook postInstall

69 runHook postInstall

51 '';

70 '';

71+

72+ meta.platforms = lib.platforms.linux;

52 };

73 };

54 makebootstrap = { targets, startup }:

75 makebootstrap = { targets, startup }:

@@ -59,41 +80,40 @@ rec {

59 };

80 };

60 };

81 };

62− makeStartup = { target, nixUserChrootFlags, nix-user-chroot', run }:

83+ makeStartup = { target, nixUserChrootFlags, nix-user-chroot', run, initScript }:

84+ let

85+ # Avoid re-adding a store path into the store

86+ path = toStorePath target;

87+ in

63 writeScript "startup" ''

88 writeScript "startup" ''

64− #!/bin/sh

89+ #!/bin/sh

90+ ${initScript}

65− .${nix-user-chroot'}/bin/nix-user-chroot -n ./nix ${nixUserChrootFlags} -- ${target}${run} $@

91+ .${nix-user-chroot'}/bin/nix-user-chroot -n ./nix ${nixUserChrootFlags} -- ${path}${run} "$@"

66 '';

92 '';

68− nix-bootstrap = { target, extraTargets ? [], run, nix-user-chroot' ? nix-user-chroot, nixUserChrootFlags ? "" }:

94+ nix-bootstrap = { target, extraTargets ? [], run, nix-user-chroot' ? nix-user-chroot, nixUserChrootFlags ? "", initScript ? "" }:

69 let

95 let

70− script = makeStartup { inherit target nixUserChrootFlags nix-user-chroot' run; };

96+ script = makeStartup { inherit target nixUserChrootFlags nix-user-chroot' run initScript; };

71 in makebootstrap {

97 in makebootstrap {

72− startup = ".${script}";

98+ startup = ".${script} '\"$@\"'";

73 targets = [ "${script}" ] ++ extraTargets;

99 targets = [ "${script}" ] ++ extraTargets;

74 };

100 };

101

76− # special case handling because of impurities in nix bootstrap

77− # anything that needs Nix will have to have these setup before they can be run

78− nix-bootstrap-nix = let

102+ nix-bootstrap-nix = {target, run, extraTargets ? []}:

79− nix-user-chroot' = nix-user-chroot.override {

103+ nix-bootstrap-path {

80− buildInputs = [ cacert gnutar bzip2 gzip coreutils ];

104+ inherit target run;

81− makeFlags = [

105+ extraTargets = [ gnutar bzip2 xz gzip coreutils bash ];

82− ''NIX_SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt"''

106+ };

83− ''NIX_PATH="nixpkgs=https://github.com/matthewbauer/nixpkgs/archive/nix-bundle.tar.gz"''

84− ''ENV_PATH="${stdenv.lib.makeBinPath [ coreutils gnutar bzip2 gzip bash ]}"''

85− ];

86− }; in { target, extraTargets ? [], run }: nix-bootstrap { inherit target extraTargets run nix-user-chroot'; };

107

88 # special case adding path to the environment before launch

108 # special case adding path to the environment before launch

89 nix-bootstrap-path = let

109 nix-bootstrap-path = let

90− nix-user-chroot'' = targets: nix-user-chroot.override {

110+ nix-user-chroot'' = targets: nix-user-chroot.overrideDerivation (o: {

91− buildInputs = targets;

111+ buildInputs = o.buildInputs ++ targets;

92− makeFlags = [

112+ makeFlags = o.makeFlags ++ [

93− ''ENV_PATH="${stdenv.lib.makeBinPath targets}"''

113+ ''ENV_PATH="${lib.makeBinPath targets}"''

94 ];

114 ];

95− }; in { target, extraTargets ? [], run }: nix-bootstrap {

115+ }); in { target, extraTargets ? [], run, initScript ? "" }: nix-bootstrap {

96− inherit target extraTargets run;

116+ inherit target extraTargets run initScript;

97 nix-user-chroot' = nix-user-chroot'' extraTargets;

117 nix-user-chroot' = nix-user-chroot'' extraTargets;

98 };

118 };

99}

119}

flake.nixnew file+26

@@ -0,0 +1,26 @@

1+{

2+ description = "The purely functional package manager";

4+ inputs.nixpkgs.url = "nixpkgs/nixos-20.03-small";

6+ outputs = { self, nixpkgs }: let

7+ systems = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];

8+ forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f system);

9+ in {

10+ bundlers = {

11+ nix-bundle = { program, system }: let

12+ nixpkgs' = nixpkgs.legacyPackages.${system};

13+ nix-bundle = import self { nixpkgs = nixpkgs'; };

14+ script = nixpkgs'.writeScript "startup" ''

15+ #!/bin/sh

16+ .${nix-bundle.nix-user-chroot}/bin/nix-user-chroot -n ./nix -- ${program} "$@"

17+ '';

18+ in nix-bundle.makebootstrap {

19+ targets = [ script ];

20+ startup = ".${builtins.unsafeDiscardStringContext script} '\"$@\"'";

21+ };

22+ };

23+

24+ defaultBundler = self.bundlers.nix-bundle;

25+ };

26+}

nix-bootstrap.sh+13−13

@@ -1,35 +1,35 @@

1#!/bin/sh

3−cmd=sh

4−if ! [ $# -eq 0 ]; then

3+if [ $# -gt 0 ]; then

5− cmd=$@

4+ set -- sh

6fi

5fi

8# should download this in the future

7# should download this in the future

9# but the mirror is down

8# but the mirror is down

10−proot=`dirname $0`/proot-`uname -p`

9+proot=$(dirname "$0")/proot-$(uname -p)

11export PROOT_NO_SECCOMP=1

10export PROOT_NO_SECCOMP=1

13nixdir=$HOME/.nix

12nixdir=$HOME/.nix

15OLD_NIX_PATH=$NIX_PATH

14OLD_NIX_PATH=$NIX_PATH

15+# shellcheck disable=SC1090

16−if [ -e $HOME/.nix-profile/etc/profile.d/nix.sh ]; then . $HOME/.nix-profile/etc/profile.d/nix.sh; fi

16+if [ -e "$HOME/.nix-profile/etc/profile.d/nix.sh" ]; then . "$HOME/.nix-profile/etc/profile.d/nix.sh"; fi

17−if ! [ -z "$OLD_NIX_PATH" ]; then NIX_PATH="$OLD_NIX_PATH"; fi

17+if [ -n "$OLD_NIX_PATH" ]; then NIX_PATH="$OLD_NIX_PATH"; fi

19if [ -z "$IN_PROOT" ]; then

20 export IN_PROOT=1

22− if ! [ -d $nixdir ]; then

22+ if ! [ -d "$nixdir" ]; then

23− mkdir -p $nixdir

23+ mkdir -p "$nixdir"

24 s=$(mktemp)

25− curl https://nixos.org/nix/install -o $s

25+ curl https://nixos.org/nix/install -o "$s"

26− $proot -b $nixdir:/nix $0 sh $s

26+ $proot -b "$nixdir:/nix" "$0" sh "$s"

27 fi

29− $proot -b $nixdir:/nix $0 $cmd

29+ $proot -b "$nixdir:/nix" "$0" "$@"

31 export IN_PROOT=

32 exit

33−elif ! [ $# -eq 0 ]; then

33+elif [ $# -gt 0 ]; then

34− exec $cmd

34+ exec "$@"

35fi

nix-bundle.sh+12−7

@@ -8,6 +8,9 @@ Usage: $0 TARGET EXECUTABLE

8Create a single-file bundle from the nixpkgs attribute "TARGET".

9EXECUTABLE should be relative to the TARGET's output path.

11+The TARGET is either an attribute in nixpkgs, or an absolute path to the

12+store.

13+

11For example:

14For example:

13$ $0 hello /bin/hello

16$ $0 hello /bin/hello

@@ -19,7 +22,7 @@ EOF

19 exit 1

22 exit 1

20fi

23fi

22−nix_file=`dirname $0`/default.nix

25+nix_file=$(dirname "$0")/default.nix

24target="$1"

27target="$1"

25shift

28shift

@@ -36,23 +39,25 @@ exec="$1"

36shift

39shift

38bootstrap=nix-bootstrap

41bootstrap=nix-bootstrap

39−if [ "$target" = "nix-bundle" ] || [ "$target" = "nixStable" ] || [ "$target" = "nixUnstable" ]; then

42+if [ "$target" = "nix-bundle" ] || [ "$target" = "nixStable" ] || [ "$target" = "nixUnstable" ] || [ "$target" = "nix" ]; then

40 bootstrap=nix-bootstrap-nix

43 bootstrap=nix-bootstrap-nix

41−elif ! [ -z "$extraTargets" ]; then

44+elif [ -n "$extraTargets" ]; then

42 bootstrap=nix-bootstrap-path

45 bootstrap=nix-bootstrap-path

43fi

46fi

45expr="with import <nixpkgs> {}; with import $nix_file {}; $bootstrap { target = $target; extraTargets = [ $extraTargets ]; run = \"$exec\"; }"

48expr="with import <nixpkgs> {}; with import $nix_file {}; $bootstrap { target = $target; extraTargets = [ $extraTargets ]; run = \"$exec\"; }"

47−out=$(nix-store --no-gc-warning -r $(nix-instantiate --no-gc-warning -E "$expr"))

50+drv=$(nix-instantiate --no-gc-warning -E "$expr")

51+

52+out=$(nix-store --no-gc-warning --realize "$drv")

49if [ -z "$out" ]; then

54if [ -z "$out" ]; then

50 >&2 echo "$0 failed. Exiting."

55 >&2 echo "$0 failed. Exiting."

51 exit 1

56 exit 1

52elif [ -t 1 ]; then

57elif [ -t 1 ]; then

53− filename=$(basename $exec)

58+ filename=$(basename "$exec")

54 echo "Nix bundle created at $filename."

59 echo "Nix bundle created at $filename."

55− cp -f $out $filename

60+ cp -f "$out" "$filename"

56else

61else

57− cat $out

62+ echo "$out"

58fi

63fi

nix-run.sh+23−21

@@ -18,11 +18,11 @@ if [ -z "$1" ]; then

18 exit 1

19fi

21−pkg=$1

21+pkg="$1"

22shift

24# A second argument will provide a hint to run

25−if ! [ -z "$1" ]; then

25+if [ -n "$1" ]; then

26 name="$1"

27 shift

28else

@@ -31,7 +31,7 @@ fi

32expr="with import <nixpkgs> {}; let x = ($pkg); in x"

33path=$(nix-instantiate --no-gc-warning -E "$expr")

34−out=$(nix-store --no-gc-warning -r $path)

34+out=$(nix-store --no-gc-warning -r "$path")

36if [ -z "$out" ]; then

37 >&2 echo "Could not evaluate $pkg to a Nix drv."

@@ -43,7 +43,7 @@ run_darwin_app () {

43 dir="$1"

44 shift

46− open -a "$dir" --args $@

46+ open -a "$dir" --args "$@"

47}

49# Run FILE as a Freedesktop application

@@ -53,14 +53,16 @@ run_linux_desktop_app () {

53 file="$1"

54 shift

56− cmd=$(grep '^Exec' $file | tail -1 | \

56+ cmd=$(grep '^Exec' "$file" | tail -1 | \

57− sed 's/Exec=//;s/^"//;s/" *$/')

57+ sed 's/Exec=//;s/^"//;s/" *$//')

59− if ! [ -z "$@" ]; then

59+ if [ "$#" -gt 0 ]; then

60− cmd=$(echo "$cmd" | sed "s/%[fu]/$1/;s/%[FU]/$@/")

60+ cmd=$(echo "$cmd" | sed "s/%[fu]/$1/;s/%[FU]/$*/")

61 fi

63 cmd=$(echo "$cmd" | sed "s/%k/$desktop/;s/%.//")

64+

65+ "$cmd" "$@"

64}

66}

66# Run FILE as an ordinary binary

68# Run FILE as an ordinary binary

@@ -68,30 +70,30 @@ run_bin () {

68 file="$1"

70 file="$1"

69 shift

71 shift

71− $file $@

73+ "$file" "$@"

72}

74}

74if [ -x "$out/nix-support/run" ]; then

76if [ -x "$out/nix-support/run" ]; then

75− run_bin "$out/nix-support/run" $@

77+ run_bin "$out/nix-support/run" "$@"

76elif [ -x "$out/bin/run" ]; then

78elif [ -x "$out/bin/run" ]; then

77− run_bin "$out/bin/run" $@

79+ run_bin "$out/bin/run" "$@"

78elif [ "$(uname)" = Darwin ] && [ -d "$out/Applications/$name.app" ]; then

80elif [ "$(uname)" = Darwin ] && [ -d "$out/Applications/$name.app" ]; then

79− run_darwin_app "$out/Applications/$name.app" $@

81+ run_darwin_app "$out/Applications/$name.app" "$@"

80−elif [ "$(uname)" = Darwin ] && [ -d $out/Applications/*.app ]; then

82+elif [ "$(uname)" = Darwin ] && [ -d "$out"/Applications/*.app ]; then

81− for f in $out/Applications/*.app; do

83+ for f in "$out"/Applications/*.app; do

82− run_darwin_app "$f" $@

84+ run_darwin_app "$f" "$@"

83 done

85 done

84elif [ -f "$out/share/applications/$name.desktop" ]; then

86elif [ -f "$out/share/applications/$name.desktop" ]; then

85− run_linux_desktop_app "$out/share/applications/$name.desktop" $@

87+ run_linux_desktop_app "$out/share/applications/$name.desktop" "$@"

86−elif [ -d $out/share/applications ]; then

88+elif [ -d "$out"/share/applications ]; then

87− for f in $out/share/applications/*.desktop; do

89+ for f in "$out"/share/applications/*.desktop; do

88 run_linux_desktop_app "$f"

90 run_linux_desktop_app "$f"

89 done

91 done

90elif [ -x "$out/bin/$name" ]; then

92elif [ -x "$out/bin/$name" ]; then

91− run_bin "$out/bin/$name" $@

93+ run_bin "$out/bin/$name" "$@"

92elif [ -d "$out/bin" ]; then

94elif [ -d "$out/bin" ]; then

93− for bin in $out/bin/*; do

95+ for bin in "$out"/bin/*; do

94− run_bin "$bin" $@

96+ run_bin "$bin" "$@"

95 done

97 done

96else

98else

97 >&2 echo "Cannot find a way to run path $out."

99 >&2 echo "Cannot find a way to run path $out."

nix-user-chroot/Makefile+1−3

@@ -1,6 +1,4 @@

1−NIX_PATH ?= "nixpkgs=https://github.com/NixOS/nixpkgs/archive/master.tar.gz"

2−NIX_SSL_CERT_FILE ?= "/homeless-shelter"

3ENV_PATH ?= ""

1ENV_PATH ?= ""

5nix-user-chroot: main.cpp

3nix-user-chroot: main.cpp

6− g++ -o nix-user-chroot -DNIX_PATH='$(NIX_PATH)' -DNIX_SSL_CERT_FILE='$(NIX_SSL_CERT_FILE)' -DENV_HOME='$(ENV_HOME)' -DENV_PATH='$(ENV_PATH)' main.cpp

4+ g++ -o nix-user-chroot -DENV_PATH='$(ENV_PATH)' main.cpp

nix-user-chroot/main.cpp+115−41

@@ -26,6 +26,10 @@

26using namespace std;

28#define err_exit(format, ...) { fprintf(stderr, format ": %s\n", ##__VA_ARGS__, strerror(errno)); exit(EXIT_FAILURE); }

29+static int child_proc(const char *rootdir, const char *nixdir, uint8_t clear_env, list<struct DirMapping> dirMappings, list<struct SetEnv> envMappings, const char *executable, char * const new_argv[]);

30+

31+volatile uint8_t child_died = 0;

32+int child_pid = 0;

30static void usage(const char *pname) {

34static void usage(const char *pname) {

31 fprintf(stderr, "Usage: %s -n <nixpath> -- <command>\n", pname);

35 fprintf(stderr, "Usage: %s -n <nixpath> -- <command>\n", pname);

@@ -33,6 +37,7 @@ static void usage(const char *pname) {

33 fprintf(stderr, "\t-m <src>:<src>\tmap src on the host to dest in the sandbox\n");

37 fprintf(stderr, "\t-m <src>:<src>\tmap src on the host to dest in the sandbox\n");

34 fprintf(stderr, "\t-d\tdelete all default dir mappings, may break things\n");

38 fprintf(stderr, "\t-d\tdelete all default dir mappings, may break things\n");

35 fprintf(stderr, "\t-p <var>\tpreserve the value of a variable across the -c clear\n");

39 fprintf(stderr, "\t-p <var>\tpreserve the value of a variable across the -c clear\n");

40+ fprintf(stderr, "\t-e\tadd an /escape-hatch to the sandbox, and run (outside the sandbox) any strings written to it\n");

37 exit(EXIT_FAILURE);

42 exit(EXIT_FAILURE);

38}

43}

@@ -91,8 +96,15 @@ struct DirMapping parseMapping(string input) {

91 return (struct DirMapping){ src, dest };

96 return (struct DirMapping){ src, dest };

92}

97}

99+static void handle_child_death(int signo, siginfo_t *info, void *context) {

100+ if ( (child_pid == 0) || (info->si_pid == child_pid) ) {

101+ child_died = 1;

102+ }

103+}

104+

94int main(int argc, char *argv[]) {

105int main(int argc, char *argv[]) {

95 uint8_t clear_env = 0;

106 uint8_t clear_env = 0;

107+ uint8_t enable_escape_hatch = 0;

96 char *nixdir = NULL;

108 char *nixdir = NULL;

97 list<struct DirMapping> dirMappings;

109 list<struct DirMapping> dirMappings;

98 list<struct SetEnv> envMappings;

110 list<struct SetEnv> envMappings;

@@ -105,14 +117,20 @@ int main(int argc, char *argv[]) {

105 x("run");

117 x("run");

106 x("tmp");

118 x("tmp");

107 x("var");

119 x("var");

120+ x("etc");

121+ x("usr");

122+ x("home");

123+ x("root");

108#undef x

124#undef x

109

125

110 int opt;

126 int opt;

111− while ((opt = getopt(argc, argv, "cn:m:dp:")) != -1) {

127+ while ((opt = getopt(argc, argv, "cen:m:dp:")) != -1) {

112 switch (opt) {

128 switch (opt) {

113 case 'c':

129 case 'c':

114 clear_env = 1;

130 clear_env = 1;

115− puts("clearing env");

131+ break;

132+ case 'e':

133+ enable_escape_hatch = 1;

116 break;

134 break;

117 case 'n':

135 case 'n':

118 // determine absolute directory for nix dir

136 // determine absolute directory for nix dir

@@ -161,13 +179,74 @@ int main(int argc, char *argv[]) {

161 err_exit("mkdtemp(%s)", template_);

179 err_exit("mkdtemp(%s)", template_);

162 }

180 }

163

181

182+ int unrace[2];

183+

184+ if (pipe(unrace)) {

185+ err_exit("pipe()");

186+ }

187+

188+ struct sigaction handle_child;

189+ handle_child.sa_sigaction = handle_child_death;

190+ handle_child.sa_flags = SA_SIGINFO;

191+

192+ struct sigaction old_handler;

193+ if (sigaction(SIGCHLD, &handle_child, &old_handler)) {

194+ err_exit("sigaction()");

195+ }

196+

197+ int child;

198+ child = child_pid = fork();

199+ if (child < 0) {

200+ err_exit("fork()");

201+ } else if (child == 0) {

202+ sigaction(SIGCHLD, &old_handler, NULL);

203+ close(unrace[1]);

204+ char buf[10];

205+ read(unrace[0], buf, 10);

206+ close(unrace[0]);

207+ return child_proc(rootdir, nixdir, clear_env, dirMappings, envMappings, argv[optind], argv + optind);

208+ } else {

209+ close(unrace[0]);

210+ char fifopath[PATH_MAX];

211+ if (enable_escape_hatch) {

212+ snprintf(fifopath, PATH_MAX, "%s/escape-hatch", rootdir);

213+ mkfifo(fifopath, 0600);

214+ }

215+ close(unrace[1]);

216+ if (enable_escape_hatch) {

217+ char buffer[1024];

218+ while (!child_died) {

219+ int fd = open(fifopath, O_RDONLY);

220+ if (fd < 0) {

221+ if (errno == EINTR) continue;

222+ fprintf(stderr, "error opening escape-hatch: %s\n", strerror(errno));

223+ continue;

224+ }

225+ int size = read(fd, buffer, 1024);

226+ buffer[size] = 0;

227+ system(buffer);

228+ close(fd);

229+ }

230+ }

231+ int status;

232+ int ret = waitpid(child, &status, 0);

233+ return WEXITSTATUS(status);

234+ }

235+}

236+

237+static int child_proc(const char *rootdir, const char *nixdir, uint8_t clear_env, list<struct DirMapping> dirMappings, list<struct SetEnv> envMappings, const char *executable, char * const new_argv[]) {

164 // get uid, gid before going to new namespace

238 // get uid, gid before going to new namespace

165 uid_t uid = getuid();

239 uid_t uid = getuid();

166 gid_t gid = getgid();

240 gid_t gid = getgid();

167

241

168 // "unshare" into new namespace

242 // "unshare" into new namespace

169 if (unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0) {

243 if (unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0) {

244+ if (errno == EPERM) {

245+ fputs("Run the following to enable unprivileged namespace use:\nsudo bash -c \"sysctl -w kernel.unprivileged_userns_clone=1 ; echo kernel.unprivileged_userns_clone=1 > /etc/sysctl.d/nix-user-chroot.conf\"\n\n", stderr);

246+ exit(EXIT_FAILURE);

247+ } else {

170− err_exit("unshare()");

248+ err_exit("unshare()");

249+ }

171 }

250 }

172

251

173 // add necessary system stuff to rootdir namespace

252 // add necessary system stuff to rootdir namespace

@@ -177,57 +256,52 @@ int main(int argc, char *argv[]) {

177 add_path(m.src, m.dest, rootdir);

256 add_path(m.src, m.dest, rootdir);

178 }

257 }

179

258

180− char path_buf[PATH_MAX];

181− snprintf(path_buf, sizeof(path_buf), "%s/tmp", rootdir);

182− mkdir(path_buf, ~0);

183− snprintf(path_buf, sizeof(path_buf), "%s/var", rootdir);

184−

185− // make sure nixdir exists

259+ // make sure nixdir exists

186− struct stat statbuf2;

260+ struct stat statbuf2;

187− if (stat(nixdir, &statbuf2) < 0) {

261+ if (stat(nixdir, &statbuf2) < 0) {

188− err_exit("stat(%s)", nixdir);

262+ err_exit("stat(%s)", nixdir);

189− }

263+ }

190

264

265+ char path_buf[PATH_MAX];

191− // mount /nix to new namespace

266+ // mount /nix to new namespace

192− snprintf(path_buf, sizeof(path_buf), "%s/nix", rootdir);

267+ snprintf(path_buf, sizeof(path_buf), "%s/nix", rootdir);

193− mkdir(path_buf, statbuf2.st_mode & ~S_IFMT);

268+ mkdir(path_buf, statbuf2.st_mode & ~S_IFMT);

194− if (mount(nixdir, path_buf, "none", MS_BIND | MS_REC, NULL) < 0) {

269+ if (mount(nixdir, path_buf, "none", MS_BIND | MS_REC, NULL) < 0) {

195− err_exit("mount(%s, %s)", nixdir, path_buf);

270+ err_exit("mount(%s, %s)", nixdir, path_buf);

196− }

271+ }

197

272

198− // fixes issue #1 where writing to /proc/self/gid_map fails

273+ // fixes issue #1 where writing to /proc/self/gid_map fails

199− // see user_namespaces(7) for more documentation

274+ // see user_namespaces(7) for more documentation

200− int fd_setgroups = open("/proc/self/setgroups", O_WRONLY);

275+ int fd_setgroups = open("/proc/self/setgroups", O_WRONLY);

201− if (fd_setgroups > 0) {

276+ if (fd_setgroups > 0) {

202− write(fd_setgroups, "deny", 4);

277+ write(fd_setgroups, "deny", 4);

278+ close(fd_setgroups);

203− }

279+ }

204

280

205− // map the original uid/gid in the new ns

281+ // map the original uid/gid in the new ns

206− char map_buf[1024];

282+ char map_buf[1024];

207− snprintf(map_buf, sizeof(map_buf), "%d %d 1", uid, uid);

283+ snprintf(map_buf, sizeof(map_buf), "%d %d 1", uid, uid);

208− update_map(map_buf, "/proc/self/uid_map");

284+ update_map(map_buf, "/proc/self/uid_map");

209− snprintf(map_buf, sizeof(map_buf), "%d %d 1", gid, gid);

285+ snprintf(map_buf, sizeof(map_buf), "%d %d 1", gid, gid);

210− update_map(map_buf, "/proc/self/gid_map");

286+ update_map(map_buf, "/proc/self/gid_map");

211

287

212− // chroot to rootdir

288+ // chroot to rootdir

213− if (chroot(rootdir) < 0) {

289+ if (chroot(rootdir) < 0) {

214− err_exit("chroot(%s)", rootdir);

290+ err_exit("chroot(%s)", rootdir);

215− }

291+ }

216

292

217− chdir("/");

293+ chdir("/");

218

294

219 if (clear_env) clearenv();

295 if (clear_env) clearenv();

220− setenv("NIX_PATH", NIX_PATH, 1);

221− setenv("NIX_SSL_CERT_FILE", NIX_SSL_CERT_FILE, 1);

222 setenv("PATH", ENV_PATH, 1);

296 setenv("PATH", ENV_PATH, 1);

223

297

224 for (list<struct SetEnv>::iterator it = envMappings.begin();

298 for (list<struct SetEnv>::iterator it = envMappings.begin();

225− it != envMappings.end(); ++it) {

299+ it != envMappings.end(); ++it) {

226 struct SetEnv e = *it;

300 struct SetEnv e = *it;

227 setenv(e.key.c_str(), e.value.c_str(), 1);

301 setenv(e.key.c_str(), e.value.c_str(), 1);

228 }

302 }

229

303

230 // execute the command

304 // execute the command

231− execvp(argv[optind], argv + optind);

305+ execvp(executable, new_argv);

232− err_exit("execvp(%s)", argv[optind]);

306+ err_exit("execvp(%s)", executable);

233}

307}

release.nix+1−1

@@ -4,7 +4,7 @@

4stdenv.mkDerivation rec {

5 pname = "nix-bundle";

6 name = "${pname}-${version}";

7− version = "0.3.0";

7+ version = "0.4.0";

9 src = ./.;

test.shnew file+10

@@ -0,0 +1,10 @@

1+#!/usr/bin/env bash

2+set -euo pipefail

3+export NIX_PATH=channel:nixos-20.09

5+echo "Test with attribute name"

6+./nix-bundle.sh hello /bin/hello

8+echo "Test with store path"

9+out=$(nix-build --no-out-link --expr '(import <nixpkgs> {})' -A hello)

10+./nix-bundle.sh "$out" /bin/hello