From d3b0f178ef74b3d69c48c72d7d03509b06746a2a Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Fri, 14 Dec 2018 04:50:21 +0100 Subject: crosvm: init at 77.12371.0.0-rc1 Co-Authored-By: hyperfekt --- .../crosvm/default-seccomp-policy-dir.patch | 15 ++++ .../applications/virtualization/crosvm/default.nix | 83 +++++++++++++++++++++ pkgs/applications/virtualization/crosvm/update.py | 85 ++++++++++++++++++++++ .../virtualization/crosvm/upstream-info.json | 19 +++++ 4 files changed, 202 insertions(+) create mode 100644 pkgs/applications/virtualization/crosvm/default-seccomp-policy-dir.patch create mode 100644 pkgs/applications/virtualization/crosvm/default.nix create mode 100755 pkgs/applications/virtualization/crosvm/update.py create mode 100644 pkgs/applications/virtualization/crosvm/upstream-info.json (limited to 'pkgs/applications/virtualization/crosvm') diff --git a/pkgs/applications/virtualization/crosvm/default-seccomp-policy-dir.patch b/pkgs/applications/virtualization/crosvm/default-seccomp-policy-dir.patch new file mode 100644 index 0000000000000..46b091b3a3532 --- /dev/null +++ b/pkgs/applications/virtualization/crosvm/default-seccomp-policy-dir.patch @@ -0,0 +1,15 @@ +diff --git a/src/main.rs b/src/main.rs +index 81f20a7..481ebd7 100644 +--- a/src/main.rs ++++ b/src/main.rs +@@ -158,7 +158,9 @@ impl Default for Config { + wayland_dmabuf: false, + shared_dirs: Vec::new(), + sandbox: !cfg!(feature = "default-no-sandbox"), +- seccomp_policy_dir: PathBuf::from(SECCOMP_POLICY_DIR), ++ seccomp_policy_dir: PathBuf::from( ++ option_env!("DEFAULT_SECCOMP_POLICY_DIR").unwrap_or(SECCOMP_POLICY_DIR), ++ ), + seccomp_log_failures: false, + cras_audio: false, + cras_capture: false, diff --git a/pkgs/applications/virtualization/crosvm/default.nix b/pkgs/applications/virtualization/crosvm/default.nix new file mode 100644 index 0000000000000..106b39b033660 --- /dev/null +++ b/pkgs/applications/virtualization/crosvm/default.nix @@ -0,0 +1,83 @@ +{ stdenv, rustPlatform, fetchgit, runCommand, symlinkJoin +, pkgconfig, minijail, dtc, libusb1, libcap +}: + +let + + upstreamInfo = with builtins; fromJSON (readFile ./upstream-info.json); + + arch = with stdenv.hostPlatform; + if isAarch64 then "arm" + else if isx86_64 then "x86_64" + else throw "no seccomp policy files available for host platform"; + + # used to turn symlinks into real files because write permissions are necessary for the vendoring process + delink = src: runCommand "${src.name}-delinked" { + preferLocalBuild = true; + allowSubstitutes = false; + } '' + cp -prL --reflink=auto ${src} $out + ''; + + # used to place subtrees into the location they have in the Chromium monorepo + move = src: target: runCommand "moved-${src.name}" { + preferLocalBuild = true; + allowSubstitutes = false; + } '' + mkdir -p $(dirname $out/${target}) + ln -s ${src} $out/${target} + ''; + + # used to check out subtrees from the Chromium monorepo + chromiumSource = name: subtrees: delink (symlinkJoin { + inherit name; + paths = stdenv.lib.mapAttrsToList ( + location: { url, rev, sha256, fetchSubmodules, ... }: + move (fetchgit { + inherit url rev sha256 fetchSubmodules; + }) location) subtrees; + }); + +in + + rustPlatform.buildRustPackage rec { + pname = "crosvm"; + inherit (upstreamInfo) version; + + src = chromiumSource "${pname}-sources" upstreamInfo.components; + + sourceRoot = "${src.name}/chromiumos/platform/crosvm"; + + patches = [ + ./default-seccomp-policy-dir.patch + ]; + + cargoSha256 = "16cfp79c13ng5jjcrvz00h3cg7cc9ywhjiq02vsm757knn9jgr1v"; + + nativeBuildInputs = [ pkgconfig ]; + + buildInputs = [ dtc libcap libusb1 minijail ]; + + postPatch = '' + sed -i "s|/usr/share/policy/crosvm/|$out/share/policy/|g" \ + seccomp/*/*.policy + ''; + + preBuild = '' + export DEFAULT_SECCOMP_POLICY_DIR=$out/share/policy + ''; + + postInstall = '' + mkdir -p $out/share/policy/ + cp seccomp/${arch}/* $out/share/policy/ + ''; + + passthru.updateScript = ./update.py; + + meta = with stdenv.lib; { + description = "A secure virtual machine monitor for KVM"; + homepage = "https://chromium.googlesource.com/chromiumos/platform/crosvm/"; + license = licenses.bsd3; + platforms = [ "aarch64-linux" "x86_64-linux" ]; + }; + } diff --git a/pkgs/applications/virtualization/crosvm/update.py b/pkgs/applications/virtualization/crosvm/update.py new file mode 100755 index 0000000000000..d00bffce3b8f6 --- /dev/null +++ b/pkgs/applications/virtualization/crosvm/update.py @@ -0,0 +1,85 @@ +#! /usr/bin/env nix-shell +#! nix-shell -p python3 -p nix-prefetch-git -i python + +import base64 +import csv +import json +import re +import subprocess +import xml.etree.ElementTree as ElementTree +from codecs import iterdecode +from operator import itemgetter +from os.path import dirname, splitext +from urllib.request import urlopen + +# ChromiumOS components required to build crosvm. +components = ['chromiumos/platform/crosvm', 'chromiumos/third_party/adhd'] + +git_root = 'https://chromium.googlesource.com/' +manifest_versions = f'{git_root}chromiumos/manifest-versions' +buildspecs_url = f'{manifest_versions}/+/refs/heads/master/paladin/buildspecs/' + +# CrOS version numbers look like this: +# [.].. +# +# As far as I can tell, branches are where internal Google +# modifications are added to turn Chromium OS into Chrome OS, and +# branch branches are used for fixes for specific devices. So for +# Chromium OS they will always be 0. This is a best guess, and is not +# documented. +with urlopen('https://cros-omahaproxy.appspot.com/all') as resp: + versions = csv.DictReader(iterdecode(resp, 'utf-8')) + stables = filter(lambda v: v['track'] == 'stable-channel', versions) + stable = sorted(stables, key=itemgetter('chrome_version'), reverse=True)[0] + +chrome_major_version = re.match(r'\d+', stable['chrome_version'])[0] +chromeos_tip_build = re.match(r'\d+', stable['chromeos_version'])[0] + +# Find the most recent buildspec for the stable Chrome version and +# Chromium OS build number. Its branch build and branch branch build +# numbers will (almost?) certainly be 0. It will then end with an rc +# number -- presumably these are release candidates, one of which +# becomes the final release. Presumably the one with the highest rc +# number. +with urlopen(f'{buildspecs_url}{chrome_major_version}/?format=TEXT') as resp: + listing = base64.decodebytes(resp.read()).decode('utf-8') + buildspecs = [(line.split('\t', 1)[1]) for line in listing.splitlines()] + buildspecs = [s for s in buildspecs if s.startswith(chromeos_tip_build)] + buildspecs.sort(reverse=True) + buildspec = splitext(buildspecs[0])[0] + +revisions = {} + +# Read the buildspec, and extract the git revisions for each component. +with urlopen(f'{buildspecs_url}{chrome_major_version}/{buildspec}.xml?format=TEXT') as resp: + xml = base64.decodebytes(resp.read()).decode('utf-8') + root = ElementTree.fromstring(xml) + for project in root.findall('project'): + revisions[project.get('name')] = project.get('revision') + +# Initialize the data that will be output from this script. Leave the +# rc number in buildspec so nobody else is subject to the same level +# of confusion I have been. +data = {'version': f'{chrome_major_version}.{buildspec}', 'components': {}} + +# Fill in the 'components' dictionary with the output from +# nix-prefetch-git, which can be passed straight to fetchGit when +# imported by Nix. +for component in components: + argv = ['nix-prefetch-git', + '--url', git_root + component, + '--rev', revisions[component]] + + output = subprocess.check_output(argv) + data['components'][component] = json.loads(output.decode('utf-8')) + +# Find the path to crosvm's default.nix, so the srcs data can be +# written into the same directory. +argv = ['nix-instantiate', '--eval', '--json', '-A', 'crosvm.meta.position'] +position = json.loads(subprocess.check_output(argv).decode('utf-8')) +filename = re.match(r'[^:]*', position)[0] + +# Finally, write the output. +with open(dirname(filename) + '/upstream-info.json', 'w') as out: + json.dump(data, out, indent=2) + out.write('\n') diff --git a/pkgs/applications/virtualization/crosvm/upstream-info.json b/pkgs/applications/virtualization/crosvm/upstream-info.json new file mode 100644 index 0000000000000..01921f9460a08 --- /dev/null +++ b/pkgs/applications/virtualization/crosvm/upstream-info.json @@ -0,0 +1,19 @@ +{ + "version": "77.12371.0.0-rc1", + "components": { + "chromiumos/platform/crosvm": { + "url": "https://chromium.googlesource.com/chromiumos/platform/crosvm", + "rev": "f5285c647acacb4f25ef8cf9334254b976e71686", + "date": "2019-07-25T22:15:48+00:00", + "sha256": "1ccjd540xmpad082w9ri13q78wkg95xxmq38b8ybcrj4f7lsxm6w", + "fetchSubmodules": false + }, + "chromiumos/third_party/adhd": { + "url": "https://chromium.googlesource.com/chromiumos/third_party/adhd", + "rev": "a1c0d93d991daffb042b979ac807bbe9c1f9a3ee", + "date": "2019-07-25T20:38:50-07:00", + "sha256": "11bijqd876adarq96syywn6znfbiflqssgb2j4w032iw2vfnnsyy", + "fetchSubmodules": false + } + } +} -- cgit 1.4.1