git.iko.soy/typeable/nixpkgs
on master help sign in
Merge pull request #105182 from roosemberth/fixes/firejail

firejail: fix -overlay and -build functionality on NixOS

commit2d50a1f09ea140965aa41716f50cc1d4cb8d1fe1 authorMichael Raskin <7c6f434c@mail.ru> dateSat 28 Nov 2020, 12:27 (6 years ago) parentefe54d6831c700
3 files changed+47
compare with master
unifiedsplit
pkgs/os-specific/linux/firejail/default.nix+9 pkgs/os-specific/linux/firejail/fbuilder-call-firejail-on-path.patch+11 pkgs/os-specific/linux/firejail/mount-nix-dir-on-overlay.patch+27
pkgs/os-specific/linux/firejail/default.nix+9
@@ -20,6 +20,15 @@ stdenv.mkDerivation {
2020 name = "${s.name}.tar.bz2";
2121 };
2222
23+ patches = [
24+ # Adds the /nix directory when using an overlay.
25+ # Required to run any programs under this mode.
26+ ./mount-nix-dir-on-overlay.patch
27+ # By default fbuilder hardcodes the firejail binary to the install path.
28+ # On NixOS the firejail binary is a setuid wrapper available in $PATH.
29+ ./fbuilder-call-firejail-on-path.patch
30+ ];
31+
2332 prePatch = ''
2433 # Allow whitelisting ~/.nix-profile
2534 substituteInPlace etc/firejail.config --replace \
pkgs/os-specific/linux/firejail/fbuilder-call-firejail-on-path.patchnew file+11
@@ -0,0 +1,11 @@
1+--- a/src/fbuilder/build_profile.c
2++++ b/src/fbuilder/build_profile.c
3+@@ -67,7 +67,7 @@
4+ errExit("asprintf");
5+
6+ char *cmdlist[] = {
7+- BINDIR "/firejail",
8++ "firejail",
9+ "--quiet",
10+ "--noprofile",
11+ "--caps.drop=all",
pkgs/os-specific/linux/firejail/mount-nix-dir-on-overlay.patchnew file+27
@@ -0,0 +1,27 @@
1+--- a/src/firejail/fs.c
2++++ b/src/firejail/fs.c
3+@@ -1143,6 +1143,16 @@
4+ errExit("mounting /dev");
5+ fs_logger("whitelist /dev");
6+
7++ // mount-bind /nix
8++ if (arg_debug)
9++ printf("Mounting /nix\n");
10++ char *nix;
11++ if (asprintf(&nix, "%s/nix", oroot) == -1)
12++ errExit("asprintf");
13++ if (mount("/nix", nix, NULL, MS_BIND|MS_REC, NULL) < 0)
14++ errExit("mounting /nix");
15++ fs_logger("whitelist /nix");
16++
17+ // mount-bind run directory
18+ if (arg_debug)
19+ printf("Mounting /run\n");
20+@@ -1201,6 +1211,7 @@
21+ free(odiff);
22+ free(owork);
23+ free(dev);
24++ free(nix);
25+ free(run);
26+ free(tmp);
27+ }