Parnell Springmeyer
4aa0923009
Getting rid of the var indirection and using a bin path instead
2017-01-29 04:11:01 -06:00
Parnell Springmeyer
e92b8402b0
Addressing PR feedback
2017-01-28 20:48:03 -08:00
Parnell Springmeyer
bae00e8aa8
setcap-wrapper: Merging with upstream master and resolving conflicts
2017-01-25 11:08:05 -08:00
Nikolay Amiantov
7a73ecc18e
buildFHSEnv: link /etc/zoneinfo
...
This is needed because now /etc/localtime symlink points there.
2016-10-11 16:56:11 +03:00
Parnell Springmeyer
98c058a1ee
Adapting everything for the merged permissions wrappers work.
2016-09-01 19:21:06 -05:00
Benno Fünfstück
a368b27270
fhs-user-env: keep DBUS_SESSION_BUS_ADDRESS env
...
Steam requires this variable or some games run incredibly slow.
See ValveSoftware/Dota-2#921 for more information.
2016-06-28 23:55:43 +02:00
Nikolay Amiantov
5cec134c70
buildFHSUserEnv: don't set CHROOTENV_EXTRA_BINDS
2016-06-28 18:59:33 +03:00
Nikolay Amiantov
3d8664ee42
buildFHSUserEnv: mark CHROOTENV_EXTRA_BINDS as discussed for deprecation
2016-06-07 14:22:38 +03:00
Nikolay Amiantov
3e90b00c10
buildFHSEnv: link 'bin' output
2016-06-07 04:06:35 +03:00
Nikolay Amiantov
8d9e5d297d
buildFHSEnv: don't link GCC compiler part
2016-06-07 04:06:35 +03:00
Nikolay Amiantov
74107a7867
buildFHSEnv: refactor and simplify, drop buildFHSChrootEnv
...
This takes another approach at binding FHS directory structure. We
now bind-mount all the root filesystem to directory "/host" in the target tree.
From that we symlink all the directories into the tree if they do not already
exist in FHS structure.
This probably makes `CHROOTENV_EXTRA_BINDS` unnecessary -- its main usecase was
to add bound directories from the host to the sandbox, and we not just symlink
all of them. I plan to get some feedback on its usage and maybe deprecate it.
This also drops old `buildFHSChrootEnv` infrastructure. The main problem with it
is it's very difficult to unmount a recursive-bound directory when mount is not
sandboxed. This problem is a bug even without these changes -- if
you have for example `/home/alice` mounted to somewhere, you wouldn't see
it in `buildFHSChrootEnv` now. With the new directory structure, it's
impossible to use regular bind at all. After some tackling with this I realized
that the fix would be brittle and dangerous (if you don't unmount everything
clearly and proceed to removing the temporary directory, bye-bye fs!). It also
probably doesn't worth it because I haven't heard that someone actually uses it
for a long time, and `buildFHSUserEnv` should cover most cases while being much
more maintainable and safe for the end-user.
2016-06-07 04:06:35 +03:00
Nikolay Amiantov
ca38376566
buildFHSUserEnv: don't run bash in login mode for .env
...
Fixes https://github.com/NixOS/nixpkgs/issues/12406 for `.env`
2016-05-20 14:17:49 +03:00
Nikolay Amiantov
375c410d07
userFHSEnv: add passthru, rename meta
2016-04-03 04:19:58 +03:00
Nikolay Amiantov
a5322efd95
Revert "Remove PATH assumption from fhs-userenv."
...
This reverts commit 2f26b82411
2016-03-29 17:58:07 +03:00
Nikolay Amiantov
f18317885a
fhs-userenv: don't use bash login mode
...
Login mode can cause hidden problems, e.g. #12406 . Generally we don't want
to read user's .bash_profile when we don't start an interactive shell inside
a chroot.
2016-01-23 15:55:53 +03:00
lethalman
091c74b1c8
Merge pull request #12062 from mogorman/platformio
...
platformio: init at 2.7.0
2016-01-13 15:47:25 +01:00
Matthew O'Gorman
c87ef76027
build-fhs-userenv: added the option meta to be passed down to the final derivation.
2016-01-06 04:06:28 -05:00
Nikolay Amiantov
230898ceb2
chrootenv-user: don't unshare user namespace if we are root
2015-12-17 14:21:06 +03:00
Kevin Cox
2f26b82411
Remove PATH assumption from fhs-userenv.
...
Previously is was assumed that bash was in the path when calling the
environment setup script. This changes all of the references of bash to
be absolute paths so that the user doesn't have to worry about the
environment they call it with.
2015-12-14 11:14:53 -05:00
zimbatm
9b33ec1764
build-fhs-userenv: don't leak file descriptors
...
This re-uses the capabilities documented in `Process.spawn` to avoid leaking
unecessary file-descriptors to the sandbox
2015-12-10 16:01:04 +00:00
Nikolay Amiantov
00f6ce133c
buildFHS{Chroot,User}Env: support extraInstallCommands
2015-12-04 00:58:47 +03:00
Nikolay Amiantov
46de04489b
build-fhs-userenv: fix extraBindMounts
2015-10-07 14:58:37 +03:00
Nikolay Amiantov
5897433b31
build-fhs-userenv: add extraBindMounts support
2015-10-06 15:32:37 +03:00
Nikolay Amiantov
47ea8c097c
buildFHSUserEnv: add .env support
2015-08-26 19:39:08 +03:00
Nikolay Amiantov
f1187c5b14
build-fhs-userenv: move /tmp handling to bash part
2015-08-24 02:01:00 +03:00
Nikolay Amiantov
ec27ba44d0
build-fhs-{chroot,user}env: expose sockets in /tmp
2015-08-24 01:47:19 +03:00
Nikolay Amiantov
19c497050e
fhs-userenv: refactor and try to chdir to the current directory
...
runScript now expects a filename instead of a Bash snippet; thus, "exec" should be
omitted.
2015-04-22 17:50:41 +03:00
Nikolay Amiantov
508ef7e629
fhs-userenv: fix mkdirs
2015-04-22 17:50:41 +03:00
Nikolay Amiantov
b66be2a549
fhs-userenv: move mounts map
2015-04-22 17:50:40 +03:00
Nikolay Amiantov
97931361d7
fhs-userenv: refactor envvars and propagate SSL_CERT_FILE
2015-04-22 17:50:40 +03:00
Luca Bruno
b1adfeb23d
fhs-userenv: Make it work on kernel < 3.19 cc @abbradar
...
It may not be very secure, but I think it's better to make it work
with older kernel since 3.19 is not the default on nixos.
2015-03-10 18:12:38 +01:00
lethalman
fcfe8ecc33
Merge pull request #6737 from anderspapitto/fhs
...
build-fhs-userenv passes through command line args
2015-03-10 17:53:32 +01:00
Anders Papitto
4bcc817521
build-fhs-userenv passes through command line args
...
The motivation for this change is to allow things like the
following derivation, which wraps the debian-packaged
hello binary.
let nixpkgs = import <nixpkgs> {};
stdenv = nixpkgs.stdenv;
in rec {
dumb-hello = stdenv.mkDerivation {
name = "dumb-hello";
builder = ./builder.sh;
dpkg = nixpkgs.dpkg;
src = nixpkgs.fetchurl {
url = "http://ftp.us.debian.org/debian/pool/main/h/hello-traditional/hello-traditional_2.9-2_amd64.deb ";
md5 = "f5f3c28b65221dae44dda6f242c23316";
};
};
full-hello = nixpkgs.buildFHSUserEnv {
name = "full-hello";
targetPkgs = pkgs: [ dumb-hello ];
multiPkgs = pkgs: [ pkgs.dpkg ];
runScript = "hello";
};
}
2015-03-09 23:44:51 -07:00
Nikolay Amiantov
3e395b71da
chroot-env: add locales, refactor environment
2015-03-09 17:29:43 +03:00
Nikolay Amiantov
4aba7639c8
chroot-env: build /etc
2015-03-09 17:29:43 +03:00
Nikolay Amiantov
3500978b8f
build-fhs-*: prefer local build
2015-02-05 20:39:01 +03:00
Nikolay Amiantov
4b3bb7b448
userFHSEnv: add build tool
2015-02-05 19:46:25 +03:00
