master..ebbcafa · nix-bundle

AppRun.c+1−9

since splitsnapshots

unifiedsplit

@@ -207,11 +207,6 @@ int main(int argc, char *argv[]) {

207 err_exit("mount(%s, %s)", usrdir, path_buf);

208 }

209

210− snprintf(path_buf, sizeof(path_buf), "%s/bin", rootdir);

211− if (symlink("/usr/bin", path_buf) < 0) {

212− err_exit("symlink(/usr/bin, %s)", path_buf);

213− }

214−

215 // fixes issue #1 where writing to /proc/self/gid_map fails

210 // fixes issue #1 where writing to /proc/self/gid_map fails

216 // see user_namespaces(7) for more documentation

211 // see user_namespaces(7) for more documentation

217 int fd_setgroups = open("/proc/self/setgroups", O_WRONLY);

212 int fd_setgroups = open("/proc/self/setgroups", O_WRONLY);

@@ -231,10 +226,8 @@ int main(int argc, char *argv[]) {

231 err_exit("chroot(%s)", rootdir);

226 err_exit("chroot(%s)", rootdir);

232 }

227 }

233

228

234− char *pwddir = getenv("PWD");

235− chdir(pwddir);

229+ chdir("/");

236

230

237− SAVE_ENV_VAR(PWD);

238 SAVE_ENV_VAR(DBUS_SESSION_BUS_ADDRESS);

231 SAVE_ENV_VAR(DBUS_SESSION_BUS_ADDRESS);

239 SAVE_ENV_VAR(USER);

232 SAVE_ENV_VAR(USER);

240 SAVE_ENV_VAR(HOSTNAME);

233 SAVE_ENV_VAR(HOSTNAME);

@@ -250,7 +243,6 @@ int main(int argc, char *argv[]) {

250

243

251 clearenv();

244 clearenv();

252

245

253− LOAD_ENV_VAR(PWD);

254 LOAD_ENV_VAR(DBUS_SESSION_BUS_ADDRESS);

246 LOAD_ENV_VAR(DBUS_SESSION_BUS_ADDRESS);

255 LOAD_ENV_VAR(USER);

247 LOAD_ENV_VAR(USER);

256 LOAD_ENV_VAR(HOSTNAME);

248 LOAD_ENV_VAR(HOSTNAME);

README.md+1−14

@@ -35,27 +35,14 @@ Some others to try:

35./nix-bundle.sh nano /bin/nano

36```

37

38−```sh

39−./nix-bundle.sh emacs /bin/emacs

40−```

41−

42−Or if you want to try graphical applications:

43−

44−```sh

45−# Simple X game. Very few dependencies. Quick to build and load. ~13MB

46−./nix-bundle.sh xskat /bin/xskat

47−```

48−

49```sh

38```sh

50./nix-bundle.sh firefox /bin/firefox

39./nix-bundle.sh firefox /bin/firefox

51```

40```

52

41

53```sh

42```sh

54−# SDL-based game. ~228MB

55−./nix-bundle.sh ivan /bin/ivan

43+./nix-bundle.sh emacs /bin/emacs

56```

44```

57

45

58−

59## Self-bundling (meta)

46## Self-bundling (meta)

60

47

61Starting with v0.1.3, you can bundle nix-bundle! To do this, just use nix-bundle normally:

48Starting with v0.1.3, you can bundle nix-bundle! To do this, just use nix-bundle normally:

appdir.nix+4−4

@@ -1,4 +1,4 @@

1−{ stdenv, lib, fetchurl, muslPkgs, perl, pathsFromGraph, fetchFromGitHub, coreutils, bash }:

1+{ stdenv, fetchurl, muslPkgs, perl, pathsFromGraph, fetchFromGitHub, coreutils, bash }:

2

3let

4 AppRun = targets: muslPkgs.stdenv.mkDerivation {

@@ -8,7 +8,7 @@ let

8

9 buildPhase = ''

10 CC="$CC -O2 -Wall -Wno-deprecated-declarations -Wno-unused-result -static"

11− $CC ${./AppRun.c} -o AppRun -DENV_PATH='"${lib.makeBinPath targets}"'

11+ $CC ${./AppRun.c} -o AppRun -DENV_PATH='"${stdenv.lib.makeBinPath targets}"'

12 '';

13

14 installPhase = ''

@@ -63,12 +63,12 @@ in

63

64 # icons

65 if [ -d ${target}/share/icons ]; then

66− icon=$(find ${target}/share/icons -name "${name}*.png" | head -n1)

66+ icon=$(find ${target}/share/icons -name "${name}.png" | head -n1)

67 if ! [ -z "$icon" ]; then

68 ln -s .$icon

69 ln -s .$icon .DirIcon

70 else

71− icon=$(find ${target}/share/icons -name "${name}*.svg" | head -n1)

71+ icon=$(find ${target}/share/icons -name "${name}.svg" | head -n1)

72 if ! [ -z "$icon" ]; then

73 ln -s .$icon

74 ln -s .$icon .DirIcon

appimage-bundle.nixdeleted−61

@@ -1,61 +0,0 @@

1−# use like this:

2−# nix-build appimage-bundle.nix --argstr package hello --argstr exec hello

3−# nix-build appimage-bundle.nix --arg package 'with import <nixpkgs>{}; writers.writePython3Bin "helloThere.py" {} "print(1)\n"' --argstr exec helloThere.py

4−

5−

6−{nixpkgs ? import <nixpkgs>{},

7−package,

8−exec,

9−... }:

10−let

11− appimage_src = drv : exec : with nixpkgs;

12− self.stdenv.mkDerivation rec {

13− name = drv.name + "-appdir";

14− env = buildEnv {

15− inherit name;

16− paths = buildInputs;

17− };

18− src = env;

19− inherit exec;

20− buildInputs = [ drv ];

21− buildCommand = ''

22− mkdir -p $out/share/icons/hicolor/256x256/apps

23− mkdir -p $out/share/applications

24−

25− shopt -s extglob

26− ln -s ${env}/!(share) $out/

27− ln -s ${env}/share/* $out/share/

28−

29− touch $out/share/icons/hicolor/256x256/apps/${drv.name}.png

30− touch $out/share/icons/${drv.name}.png

31−

32− cat <<EOF > $out/share/applications/${drv.name}.desktop

33− [Desktop Entry]

34− Type=Application

35− Version=1.0

36− Name=${drv.name}

37− Path=${env}

38− Icon=${drv.name}

39− Exec=$exec

40− Terminal=true

41− EOF

42− '';

43− system = builtins.currentSystem;

44− };

45−

46−in

47− let results =

48− if (nixpkgs.lib.isDerivation package && !(nixpkgs.lib.isString package))

49− then {

50− name = package.name;

51− target = appimage_src package "${exec}";

52− extraTargets = [];

53− }

54− else {

55− name = nixpkgs."${package}".name;

56− target = appimage_src (nixpkgs."${package}") "${exec}";

57− extraTargets = [];

58− };

59− in

60− with (import (./appimage-top.nix){nixpkgs' = nixpkgs.path;});

61− (appimage (appdir results )).overrideAttrs (old: {name = results.name;})

appimagetool.nix+2−2

@@ -1,4 +1,4 @@

1−{ stdenv, lib, fetchurl, fuse, zlib, squashfsTools, glib }:

1+{ stdenv, fetchurl, fuse, zlib, squashfsTools, glib }:

2

3# This is from some binaries.

4

@@ -37,7 +37,7 @@ in stdenv.mkDerivation rec {

37 for x in $out/bin/*; do

38 patchelf \

39 --set-interpreter ${dynamicLinker} \

40− --set-rpath ${lib.makeLibraryPath [ zlib stdenv.glibc.out fuse glib ]} \

40+ --set-rpath ${stdenv.lib.makeLibraryPath [ zlib stdenv.glibc.out fuse glib ]} \

41 $x

42 done

43 '';

default.nix+8−26

@@ -10,16 +10,6 @@ let

10 '';

11 });

12in rec {

13− toStorePath = target:

14− # If a store path has been given but is not a derivation, add the missing context

15− # to it so it will be propagated properly as a build input.

16− if !(lib.isDerivation target) && lib.isStorePath target then

17− let path = toString target; in

18− builtins.appendContext path { "${path}" = { path = true; }; }

19− # Otherwise, add to the store. This takes care of appending the store path

20− # in the context automatically.

21− else "${target}";

22−

23 arx = { archive, startup}:

13 arx = { archive, startup}:

24 stdenv.mkDerivation {

14 stdenv.mkDerivation {

25 name = "arx";

15 name = "arx";

@@ -45,7 +35,7 @@ in rec {

45 };

35 };

46

36

47 # TODO: eventually should this go in nixpkgs?

37 # TODO: eventually should this go in nixpkgs?

48− nix-user-chroot = lib.makeOverridable stdenv.mkDerivation {

38+ nix-user-chroot = stdenv.lib.makeOverridable stdenv.mkDerivation {

49 name = "nix-user-chroot-2c52b5f";

39 name = "nix-user-chroot-2c52b5f";

50 src = ./nix-user-chroot;

40 src = ./nix-user-chroot;

51

41

@@ -68,8 +58,6 @@ in rec {

68

58

69 runHook postInstall

59 runHook postInstall

70 '';

60 '';

71−

72− meta.platforms = lib.platforms.linux;

73 };

61 };

74

62

75 makebootstrap = { targets, startup }:

63 makebootstrap = { targets, startup }:

@@ -80,20 +68,14 @@ in rec {

80 };

68 };

81 };

69 };

82

70

83− makeStartup = { target, nixUserChrootFlags, nix-user-chroot', run, initScript }:

71+ makeStartup = { target, nixUserChrootFlags, nix-user-chroot', run }:

84− let

85− # Avoid re-adding a store path into the store

86− path = toStorePath target;

87− in

88 writeScript "startup" ''

72 writeScript "startup" ''

89− #!/bin/sh

90− ${initScript}

91− .${nix-user-chroot'}/bin/nix-user-chroot -n ./nix ${nixUserChrootFlags} -- ${path}${run} "$@"

73+.${nix-user-chroot'}/bin/nix-user-chroot -n ./nix ${nixUserChrootFlags} -- ${target}${run} $@

92 '';

74 '';

93

75

94− nix-bootstrap = { target, extraTargets ? [], run, nix-user-chroot' ? nix-user-chroot, nixUserChrootFlags ? "", initScript ? "" }:

76+ nix-bootstrap = { target, extraTargets ? [], run, nix-user-chroot' ? nix-user-chroot, nixUserChrootFlags ? "" }:

95 let

77 let

96− script = makeStartup { inherit target nixUserChrootFlags nix-user-chroot' run initScript; };

78+ script = makeStartup { inherit target nixUserChrootFlags nix-user-chroot' run; };

97 in makebootstrap {

79 in makebootstrap {

98 startup = ".${script} '\"$@\"'";

80 startup = ".${script} '\"$@\"'";

99 targets = [ "${script}" ] ++ extraTargets;

81 targets = [ "${script}" ] ++ extraTargets;

@@ -110,10 +92,10 @@ in rec {

110 nix-user-chroot'' = targets: nix-user-chroot.overrideDerivation (o: {

92 nix-user-chroot'' = targets: nix-user-chroot.overrideDerivation (o: {

111 buildInputs = o.buildInputs ++ targets;

93 buildInputs = o.buildInputs ++ targets;

112 makeFlags = o.makeFlags ++ [

94 makeFlags = o.makeFlags ++ [

113− ''ENV_PATH="${lib.makeBinPath targets}"''

95+ ''ENV_PATH="${stdenv.lib.makeBinPath targets}"''

114 ];

96 ];

115− }); in { target, extraTargets ? [], run, initScript ? "" }: nix-bootstrap {

97+ }); in { target, extraTargets ? [], run }: nix-bootstrap {

116− inherit target extraTargets run initScript;

98+ inherit target extraTargets run;

117 nix-user-chroot' = nix-user-chroot'' extraTargets;

99 nix-user-chroot' = nix-user-chroot'' extraTargets;

118 };

100 };

119}

101}

flake.nixdeleted−26

@@ -1,26 +0,0 @@

1−{

2− description = "The purely functional package manager";

3−

4− inputs.nixpkgs.url = "nixpkgs/nixos-20.03-small";

5−

6− outputs = { self, nixpkgs }: let

7− systems = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];

8− forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f system);

9− in {

10− bundlers = {

11− nix-bundle = { program, system }: let

12− nixpkgs' = nixpkgs.legacyPackages.${system};

13− nix-bundle = import self { nixpkgs = nixpkgs'; };

14− script = nixpkgs'.writeScript "startup" ''

15− #!/bin/sh

16− .${nix-bundle.nix-user-chroot}/bin/nix-user-chroot -n ./nix -- ${program} "$@"

17− '';

18− in nix-bundle.makebootstrap {

19− targets = [ script ];

20− startup = ".${builtins.unsafeDiscardStringContext script} '\"$@\"'";

21− };

22− };

23−

24− defaultBundler = self.bundlers.nix-bundle;

25− };

26−}

nix-bootstrap.sh+13−13

@@ -1,35 +1,35 @@

1#!/bin/sh

2

3+cmd=sh

3−if [ $# -gt 0 ]; then

4+if ! [ $# -eq 0 ]; then

4− set -- sh

5+ cmd=$@

5fi

6fi

6

7

7# should download this in the future

8# should download this in the future

8# but the mirror is down

9# but the mirror is down

9−proot=$(dirname "$0")/proot-$(uname -p)

10+proot=`dirname $0`/proot-`uname -p`

10export PROOT_NO_SECCOMP=1

11export PROOT_NO_SECCOMP=1

11

12

12nixdir=$HOME/.nix

13nixdir=$HOME/.nix

13

14

14OLD_NIX_PATH=$NIX_PATH

15OLD_NIX_PATH=$NIX_PATH

15−# shellcheck disable=SC1090

16−if [ -e "$HOME/.nix-profile/etc/profile.d/nix.sh" ]; then . "$HOME/.nix-profile/etc/profile.d/nix.sh"; fi

16+if [ -e $HOME/.nix-profile/etc/profile.d/nix.sh ]; then . $HOME/.nix-profile/etc/profile.d/nix.sh; fi

17−if [ -n "$OLD_NIX_PATH" ]; then NIX_PATH="$OLD_NIX_PATH"; fi

17+if ! [ -z "$OLD_NIX_PATH" ]; then NIX_PATH="$OLD_NIX_PATH"; fi

18

19if [ -z "$IN_PROOT" ]; then

20 export IN_PROOT=1

21

22− if ! [ -d "$nixdir" ]; then

22+ if ! [ -d $nixdir ]; then

23− mkdir -p "$nixdir"

23+ mkdir -p $nixdir

24 s=$(mktemp)

25− curl https://nixos.org/nix/install -o "$s"

25+ curl https://nixos.org/nix/install -o $s

26− $proot -b "$nixdir:/nix" "$0" sh "$s"

26+ $proot -b $nixdir:/nix $0 sh $s

27 fi

28

29− $proot -b "$nixdir:/nix" "$0" "$@"

29+ $proot -b $nixdir:/nix $0 $cmd

30

31 export IN_PROOT=

32 exit

33−elif [ $# -gt 0 ]; then

33+elif ! [ $# -eq 0 ]; then

34− exec "$@"

34+ exec $cmd

35fi

nix-bundle.sh+6−11

@@ -8,9 +8,6 @@ Usage: $0 TARGET EXECUTABLE

8Create a single-file bundle from the nixpkgs attribute "TARGET".

9EXECUTABLE should be relative to the TARGET's output path.

10

11−The TARGET is either an attribute in nixpkgs, or an absolute path to the

12−store.

13−

14For example:

11For example:

15

12

16$ $0 hello /bin/hello

13$ $0 hello /bin/hello

@@ -22,7 +19,7 @@ EOF

22 exit 1

19 exit 1

23fi

20fi

24

21

25−nix_file=$(dirname "$0")/default.nix

22+nix_file=`dirname $0`/default.nix

26

23

27target="$1"

24target="$1"

28shift

25shift

@@ -41,23 +38,21 @@ shift

41bootstrap=nix-bootstrap

38bootstrap=nix-bootstrap

42if [ "$target" = "nix-bundle" ] || [ "$target" = "nixStable" ] || [ "$target" = "nixUnstable" ] || [ "$target" = "nix" ]; then

39if [ "$target" = "nix-bundle" ] || [ "$target" = "nixStable" ] || [ "$target" = "nixUnstable" ] || [ "$target" = "nix" ]; then

43 bootstrap=nix-bootstrap-nix

40 bootstrap=nix-bootstrap-nix

44−elif [ -n "$extraTargets" ]; then

41+elif ! [ -z "$extraTargets" ]; then

45 bootstrap=nix-bootstrap-path

42 bootstrap=nix-bootstrap-path

46fi

43fi

47

44

48expr="with import <nixpkgs> {}; with import $nix_file {}; $bootstrap { target = $target; extraTargets = [ $extraTargets ]; run = \"$exec\"; }"

45expr="with import <nixpkgs> {}; with import $nix_file {}; $bootstrap { target = $target; extraTargets = [ $extraTargets ]; run = \"$exec\"; }"

49

46

50−drv=$(nix-instantiate --no-gc-warning -E "$expr")

47+out=$(nix-store --no-gc-warning -r $(nix-instantiate --no-gc-warning -E "$expr"))

51−

52−out=$(nix-store --no-gc-warning --realize "$drv")

53

48

54if [ -z "$out" ]; then

49if [ -z "$out" ]; then

55 >&2 echo "$0 failed. Exiting."

50 >&2 echo "$0 failed. Exiting."

56 exit 1

51 exit 1

57elif [ -t 1 ]; then

52elif [ -t 1 ]; then

58− filename=$(basename "$exec")

53+ filename=$(basename $exec)

59 echo "Nix bundle created at $filename."

54 echo "Nix bundle created at $filename."

60− cp -f "$out" "$filename"

55+ cp -f $out $filename

61else

56else

62− echo "$out"

57+ cat $out

63fi

58fi

nix-run.sh+21−23

@@ -18,11 +18,11 @@ if [ -z "$1" ]; then

18 exit 1

19fi

20

21−pkg="$1"

21+pkg=$1

22shift

23

24# A second argument will provide a hint to run

25−if [ -n "$1" ]; then

25+if ! [ -z "$1" ]; then

26 name="$1"

27 shift

28else

@@ -31,7 +31,7 @@ fi

31

32expr="with import <nixpkgs> {}; let x = ($pkg); in x"

33path=$(nix-instantiate --no-gc-warning -E "$expr")

34−out=$(nix-store --no-gc-warning -r "$path")

34+out=$(nix-store --no-gc-warning -r $path)

35

36if [ -z "$out" ]; then

37 >&2 echo "Could not evaluate $pkg to a Nix drv."

@@ -43,7 +43,7 @@ run_darwin_app () {

43 dir="$1"

44 shift

45

46− open -a "$dir" --args "$@"

46+ open -a "$dir" --args $@

47}

48

49# Run FILE as a Freedesktop application

@@ -53,16 +53,14 @@ run_linux_desktop_app () {

53 file="$1"

54 shift

55

56− cmd=$(grep '^Exec' "$file" | tail -1 | \

56+ cmd=$(grep '^Exec' $file | tail -1 | \

57− sed 's/Exec=//;s/^"//;s/" *$//')

57+ sed 's/Exec=//;s/^"//;s/" *$/')

58

59− if [ "$#" -gt 0 ]; then

59+ if ! [ -z "$@" ]; then

60− cmd=$(echo "$cmd" | sed "s/%[fu]/$1/;s/%[FU]/$*/")

60+ cmd=$(echo "$cmd" | sed "s/%[fu]/$1/;s/%[FU]/$@/")

61 fi

62

63 cmd=$(echo "$cmd" | sed "s/%k/$desktop/;s/%.//")

64−

65− "$cmd" "$@"

66}

64}

67

65

68# Run FILE as an ordinary binary

66# Run FILE as an ordinary binary

@@ -70,30 +68,30 @@ run_bin () {

70 file="$1"

68 file="$1"

71 shift

69 shift

72

70

73− "$file" "$@"

71+ $file $@

74}

72}

75

73

76if [ -x "$out/nix-support/run" ]; then

74if [ -x "$out/nix-support/run" ]; then

77− run_bin "$out/nix-support/run" "$@"

75+ run_bin "$out/nix-support/run" $@

78elif [ -x "$out/bin/run" ]; then

76elif [ -x "$out/bin/run" ]; then

79− run_bin "$out/bin/run" "$@"

77+ run_bin "$out/bin/run" $@

80elif [ "$(uname)" = Darwin ] && [ -d "$out/Applications/$name.app" ]; then

78elif [ "$(uname)" = Darwin ] && [ -d "$out/Applications/$name.app" ]; then

81− run_darwin_app "$out/Applications/$name.app" "$@"

79+ run_darwin_app "$out/Applications/$name.app" $@

82−elif [ "$(uname)" = Darwin ] && [ -d "$out"/Applications/*.app ]; then

80+elif [ "$(uname)" = Darwin ] && [ -d $out/Applications/*.app ]; then

83− for f in "$out"/Applications/*.app; do

81+ for f in $out/Applications/*.app; do

84− run_darwin_app "$f" "$@"

82+ run_darwin_app "$f" $@

85 done

83 done

86elif [ -f "$out/share/applications/$name.desktop" ]; then

84elif [ -f "$out/share/applications/$name.desktop" ]; then

87− run_linux_desktop_app "$out/share/applications/$name.desktop" "$@"

85+ run_linux_desktop_app "$out/share/applications/$name.desktop" $@

88−elif [ -d "$out"/share/applications ]; then

86+elif [ -d $out/share/applications ]; then

89− for f in "$out"/share/applications/*.desktop; do

87+ for f in $out/share/applications/*.desktop; do

90 run_linux_desktop_app "$f"

88 run_linux_desktop_app "$f"

91 done

89 done

92elif [ -x "$out/bin/$name" ]; then

90elif [ -x "$out/bin/$name" ]; then

93− run_bin "$out/bin/$name" "$@"

91+ run_bin "$out/bin/$name" $@

94elif [ -d "$out/bin" ]; then

92elif [ -d "$out/bin" ]; then

95− for bin in "$out"/bin/*; do

93+ for bin in $out/bin/*; do

96− run_bin "$bin" "$@"

94+ run_bin "$bin" $@

97 done

95 done

98else

96else

99 >&2 echo "Cannot find a way to run path $out."

97 >&2 echo "Cannot find a way to run path $out."

nix-user-chroot/main.cpp+4−78

@@ -26,10 +26,6 @@

26using namespace std;

27

28#define err_exit(format, ...) { fprintf(stderr, format ": %s\n", ##__VA_ARGS__, strerror(errno)); exit(EXIT_FAILURE); }

29−static int child_proc(const char *rootdir, const char *nixdir, uint8_t clear_env, list<struct DirMapping> dirMappings, list<struct SetEnv> envMappings, const char *executable, char * const new_argv[]);

30−

31−volatile uint8_t child_died = 0;

32−int child_pid = 0;

33

29

34static void usage(const char *pname) {

30static void usage(const char *pname) {

35 fprintf(stderr, "Usage: %s -n <nixpath> -- <command>\n", pname);

31 fprintf(stderr, "Usage: %s -n <nixpath> -- <command>\n", pname);

@@ -37,7 +33,6 @@ static void usage(const char *pname) {

37 fprintf(stderr, "\t-m <src>:<src>\tmap src on the host to dest in the sandbox\n");

33 fprintf(stderr, "\t-m <src>:<src>\tmap src on the host to dest in the sandbox\n");

38 fprintf(stderr, "\t-d\tdelete all default dir mappings, may break things\n");

34 fprintf(stderr, "\t-d\tdelete all default dir mappings, may break things\n");

39 fprintf(stderr, "\t-p <var>\tpreserve the value of a variable across the -c clear\n");

35 fprintf(stderr, "\t-p <var>\tpreserve the value of a variable across the -c clear\n");

40− fprintf(stderr, "\t-e\tadd an /escape-hatch to the sandbox, and run (outside the sandbox) any strings written to it\n");

41

36

42 exit(EXIT_FAILURE);

37 exit(EXIT_FAILURE);

43}

38}

@@ -96,15 +91,8 @@ struct DirMapping parseMapping(string input) {

96 return (struct DirMapping){ src, dest };

91 return (struct DirMapping){ src, dest };

97}

92}

98

93

99−static void handle_child_death(int signo, siginfo_t *info, void *context) {

100− if ( (child_pid == 0) || (info->si_pid == child_pid) ) {

101− child_died = 1;

102− }

103−}

104−

105int main(int argc, char *argv[]) {

94int main(int argc, char *argv[]) {

106 uint8_t clear_env = 0;

95 uint8_t clear_env = 0;

107− uint8_t enable_escape_hatch = 0;

108 char *nixdir = NULL;

96 char *nixdir = NULL;

109 list<struct DirMapping> dirMappings;

97 list<struct DirMapping> dirMappings;

110 list<struct SetEnv> envMappings;

98 list<struct SetEnv> envMappings;

@@ -119,19 +107,14 @@ int main(int argc, char *argv[]) {

119 x("var");

107 x("var");

120 x("etc");

108 x("etc");

121 x("usr");

109 x("usr");

122− x("home");

123− x("root");

124#undef x

110#undef x

125

111

126 int opt;

112 int opt;

127− while ((opt = getopt(argc, argv, "cen:m:dp:")) != -1) {

113+ while ((opt = getopt(argc, argv, "cn:m:dp:")) != -1) {

128 switch (opt) {

114 switch (opt) {

129 case 'c':

115 case 'c':

130 clear_env = 1;

116 clear_env = 1;

131 break;

117 break;

132− case 'e':

133− enable_escape_hatch = 1;

134− break;

135 case 'n':

118 case 'n':

136 // determine absolute directory for nix dir

119 // determine absolute directory for nix dir

137 nixdir = realpath(optarg, NULL);

120 nixdir = realpath(optarg, NULL);

@@ -179,62 +162,6 @@ int main(int argc, char *argv[]) {

179 err_exit("mkdtemp(%s)", template_);

162 err_exit("mkdtemp(%s)", template_);

180 }

163 }

181

164

182− int unrace[2];

183−

184− if (pipe(unrace)) {

185− err_exit("pipe()");

186− }

187−

188− struct sigaction handle_child;

189− handle_child.sa_sigaction = handle_child_death;

190− handle_child.sa_flags = SA_SIGINFO;

191−

192− struct sigaction old_handler;

193− if (sigaction(SIGCHLD, &handle_child, &old_handler)) {

194− err_exit("sigaction()");

195− }

196−

197− int child;

198− child = child_pid = fork();

199− if (child < 0) {

200− err_exit("fork()");

201− } else if (child == 0) {

202− sigaction(SIGCHLD, &old_handler, NULL);

203− close(unrace[1]);

204− char buf[10];

205− read(unrace[0], buf, 10);

206− close(unrace[0]);

207− return child_proc(rootdir, nixdir, clear_env, dirMappings, envMappings, argv[optind], argv + optind);

208− } else {

209− close(unrace[0]);

210− char fifopath[PATH_MAX];

211− if (enable_escape_hatch) {

212− snprintf(fifopath, PATH_MAX, "%s/escape-hatch", rootdir);

213− mkfifo(fifopath, 0600);

214− }

215− close(unrace[1]);

216− if (enable_escape_hatch) {

217− char buffer[1024];

218− while (!child_died) {

219− int fd = open(fifopath, O_RDONLY);

220− if (fd < 0) {

221− if (errno == EINTR) continue;

222− fprintf(stderr, "error opening escape-hatch: %s\n", strerror(errno));

223− continue;

224− }

225− int size = read(fd, buffer, 1024);

226− buffer[size] = 0;

227− system(buffer);

228− close(fd);

229− }

230− }

231− int status;

232− int ret = waitpid(child, &status, 0);

233− return WEXITSTATUS(status);

234− }

235−}

236−

237−static int child_proc(const char *rootdir, const char *nixdir, uint8_t clear_env, list<struct DirMapping> dirMappings, list<struct SetEnv> envMappings, const char *executable, char * const new_argv[]) {

238 // get uid, gid before going to new namespace

165 // get uid, gid before going to new namespace

239 uid_t uid = getuid();

166 uid_t uid = getuid();

240 gid_t gid = getgid();

167 gid_t gid = getgid();

@@ -242,7 +169,7 @@ static int child_proc(const char *rootdir, const char *nixdir, uint8_t clear_env

242 // "unshare" into new namespace

169 // "unshare" into new namespace

243 if (unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0) {

170 if (unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0) {

244 if (errno == EPERM) {

171 if (errno == EPERM) {

245− fputs("Run the following to enable unprivileged namespace use:\nsudo bash -c \"sysctl -w kernel.unprivileged_userns_clone=1 ; echo kernel.unprivileged_userns_clone=1 > /etc/sysctl.d/nix-user-chroot.conf\"\n\n", stderr);

172+ fputs("Run the following as root to enable unprivileged namespace use:\nsysctl -w kernel.unprivileged_userns_clone=1 ; echo kernel.unprivileged_userns_clone=1 > /etc/sysctl.d/nix-user-chroot.conf\n\n", stderr);

246 exit(EXIT_FAILURE);

173 exit(EXIT_FAILURE);

247 } else {

174 } else {

248 err_exit("unshare()");

175 err_exit("unshare()");

@@ -275,7 +202,6 @@ static int child_proc(const char *rootdir, const char *nixdir, uint8_t clear_env

275 int fd_setgroups = open("/proc/self/setgroups", O_WRONLY);

202 int fd_setgroups = open("/proc/self/setgroups", O_WRONLY);

276 if (fd_setgroups > 0) {

203 if (fd_setgroups > 0) {

277 write(fd_setgroups, "deny", 4);

204 write(fd_setgroups, "deny", 4);

278− close(fd_setgroups);

279 }

205 }

280

206

281 // map the original uid/gid in the new ns

207 // map the original uid/gid in the new ns

@@ -302,6 +228,6 @@ static int child_proc(const char *rootdir, const char *nixdir, uint8_t clear_env

302 }

228 }

303

229

304 // execute the command

230 // execute the command

305− execvp(executable, new_argv);

231+ execvp(argv[optind], argv + optind);

306− err_exit("execvp(%s)", executable);

232+ err_exit("execvp(%s)", argv[optind]);

307}

233}

release.nix+1−1

@@ -4,7 +4,7 @@

4stdenv.mkDerivation rec {

5 pname = "nix-bundle";

6 name = "${pname}-${version}";

7− version = "0.4.0";

7+ version = "0.3.0";

8

9 src = ./.;

10

test.shdeleted−10

@@ -1,10 +0,0 @@

1−#!/usr/bin/env bash

2−set -euo pipefail

3−export NIX_PATH=channel:nixos-20.09

4−

5−echo "Test with attribute name"

6−./nix-bundle.sh hello /bin/hello

7−

8−echo "Test with store path"

9−out=$(nix-build --no-out-link --expr '(import <nixpkgs> {})' -A hello)

10−./nix-bundle.sh "$out" /bin/hello