about summary refs log tree commit diff
path: root/pkgs/games/build-support/build-game.nix
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/games/build-support/build-game.nix')
-rw-r--r--pkgs/games/build-support/build-game.nix20
1 files changed, 17 insertions, 3 deletions
diff --git a/pkgs/games/build-support/build-game.nix b/pkgs/games/build-support/build-game.nix
index b64f7457..e402787c 100644
--- a/pkgs/games/build-support/build-game.nix
+++ b/pkgs/games/build-support/build-game.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, file, unzip
+{ stdenv, lib, file, unzip, gcc, makeSetupHook
 
 , withPulseAudio ? true, libpulseaudio ? null
 , alsaLib
@@ -12,10 +12,19 @@ assert withPulseAudio -> libpulseaudio != null;
 , setSourceRoot ? ""
 , installCheckPhase ? ""
 , runtimeDependencies ? []
+, extraSandboxPaths ? [ "$XDG_DATA_HOME" "$XDG_CONFIG_HOME" ]
 , ...
 }@attrs:
 
-stdenv.mkDerivation ({
+let
+  sandboxHook = makeSetupHook {
+    substitutions = {
+      inherit gcc;
+      sandbox_main = ./sandbox.c;
+    };
+  } ./setup-hooks/make-sandbox.sh;
+
+in stdenv.mkDerivation ({
   buildInputs = [ stdenv.cc.cc ] ++ buildInputs;
 
   nativeBuildInputs = [
@@ -39,6 +48,11 @@ stdenv.mkDerivation ({
     fi
   '';
 
+  # Use ":!*!:" as delimiter as we can consider this highly unlikely to
+  # be part of a real path component and we're out of Nix territory, so
+  # the path components could contain almost anything.
+  extraSandboxPaths = lib.concatStringsSep ":!*!:" extraSandboxPaths;
+
   runtimeDependencies = let
     deps = lib.singleton alsaLib
         ++ lib.optional withPulseAudio libpulseaudio
@@ -71,5 +85,5 @@ stdenv.mkDerivation ({
   dontPatchELF = true;
 } // removeAttrs attrs [
   "buildInputs" "nativeBuildInputs" "preUnpack" "setSourceRoot"
-  "installCheckPhase" "runtimeDependencies"
+  "installCheckPhase" "runtimeDependencies" "extraSandboxPaths"
 ])