git.iko.soy/typeable/nixpkgs
on master help sign in
firejail: fix -overlay and -build functionality on NixOS

- The `-overlay` flag runs the specified binary inside an OverlayFS, since the /nix store may be in a different mount point than the user home, this patch explicitly bind mounts it so it's available inside the overlay. - profile builder: firejail provides facilities to build a new profiles. To do so, it execute the helper binary `fbuilder`, which in turn will execute firejail back with different options. This patch makes it use the binary available in PATH instead of the one produced at compile time. The compiled firejail binary doesn't have the necessary permissions, so the firejail NixOS module wraps it in a SUID wrapper available on PATH at runtime. Signed-off-by: Roosembert Palacios <roosemberth@posteo.ch>

commit831c700c5d04c791c9384991d38ac146067daa64 authorRoosembert Palacios <roosemberth@posteo.ch> dateFri 27 Nov 2020, 22:42 (6 years ago) parent67d7a67
3 files changed+47
compare with master
unifiedsplit
pkgs/os-specific/linux/firejail/default.nix+9 pkgs/os-specific/linux/firejail/fbuilder-call-firejail-on-path.patch+11 pkgs/os-specific/linux/firejail/mount-nix-dir-on-overlay.patch+27
pkgs/os-specific/linux/firejail/default.nix+9
@@ -20,6 +20,15 @@ stdenv.mkDerivation {
2020 name = "${s.name}.tar.bz2";
2121 };
2222
23+ patches = [
24+ # Adds the /nix directory when using an overlay.
25+ # Required to run any programs under this mode.
26+ ./mount-nix-dir-on-overlay.patch
27+ # By default fbuilder hardcodes the firejail binary to the install path.
28+ # On NixOS the firejail binary is a setuid wrapper available in $PATH.
29+ ./fbuilder-call-firejail-on-path.patch
30+ ];
31+
2332 prePatch = ''
2433 # Allow whitelisting ~/.nix-profile
2534 substituteInPlace etc/firejail.config --replace \
pkgs/os-specific/linux/firejail/fbuilder-call-firejail-on-path.patchnew file+11
@@ -0,0 +1,11 @@
1+--- a/src/fbuilder/build_profile.c
2++++ b/src/fbuilder/build_profile.c
3+@@ -67,7 +67,7 @@
4+ errExit("asprintf");
5+
6+ char *cmdlist[] = {
7+- BINDIR "/firejail",
8++ "firejail",
9+ "--quiet",
10+ "--noprofile",
11+ "--caps.drop=all",
pkgs/os-specific/linux/firejail/mount-nix-dir-on-overlay.patchnew file+27
@@ -0,0 +1,27 @@
1+--- a/src/firejail/fs.c
2++++ b/src/firejail/fs.c
3+@@ -1143,6 +1143,16 @@
4+ errExit("mounting /dev");
5+ fs_logger("whitelist /dev");
6+
7++ // mount-bind /nix
8++ if (arg_debug)
9++ printf("Mounting /nix\n");
10++ char *nix;
11++ if (asprintf(&nix, "%s/nix", oroot) == -1)
12++ errExit("asprintf");
13++ if (mount("/nix", nix, NULL, MS_BIND|MS_REC, NULL) < 0)
14++ errExit("mounting /nix");
15++ fs_logger("whitelist /nix");
16++
17+ // mount-bind run directory
18+ if (arg_debug)
19+ printf("Mounting /run\n");
20+@@ -1201,6 +1211,7 @@
21+ free(odiff);
22+ free(owork);
23+ free(dev);
24++ free(nix);
25+ free(run);
26+ free(tmp);
27+ }