{
name = "sandbox";
machine = { pkgs, lib, ... }: {
system.activationScripts.inject-link = ''
ln -svf ${pkgs.hello} /run/foo-test-sandbox
ln -svf ${pkgs.gnused} /run/bar-test-sandbox
ln -svf ${pkgs.gnugrep} /run/baz-test-sandbox
'';
environment.sessionVariables.COLLECT_ME = [
"/run/foo-test-sandbox"
"/run/bar-test-sandbox"
"/run/baz-test-sandbox"
];
# Only needed so we get the right XDG paths in the system path.
services.xserver.enable = true;
systemd.services.display-manager.enable = false;
environment.systemPackages = let
testPackage = pkgs.runCommand "test-sandbox" {
program = ''
#!${pkgs.stdenv.shell} -ex
if [ "$1" != canary ]; then
echo 'Canary check failed, so the test program probably' \
'was not executed via the XDG desktop entry.' >&2
exit 1
fi
# Should fail because we can't access the host's PATH
! echo foo | grep -qF foo
export PATH=/run/baz-test-sandbox/bin
echo foo > /home/foo/existing/bar
test ! -d /home/foo/nonexisting
/run/foo-test-sandbox/bin/hello
echo aaa | /run/bar-test-sandbox/bin/sed -e 's/a/b/g'
echo XDG1 > /home/foo/.local/share/xdg/1
echo XDG2 > /home/foo/.config/xdg/2
echo XDG3 > /home/foo/.cache/xdg/3
echo > /home/foo/.cache/xdg/done
'';
} ''
mkdir -p "$out/bin" "$out/share/applications" "$out/share/test-sandbox"
echo -n "$program" > "$out/bin/test-sandbox"
chmod +x "$out/bin/test-sandbox"
echo '' \
> "$out/share/test-sandbox/icon.svg"
cat > "$out/share/applications/test.desktop" <waitForUnit('multi-user.target');
$machine->succeed('su - -c "xvfb-run gtk-launch test" foo >&2');
$machine->waitForFile('/home/foo/.cache/xdg/done');
$machine->succeed('test -d /home/foo/existing');
$machine->succeed('grep -qF foo /home/foo/existing/bar');
$machine->fail('test -d /home/foo/nonexisting');
$machine->succeed('grep -qF XDG1 /home/foo/.local/share/xdg/1');
$machine->succeed('grep -qF XDG2 /home/foo/.config/xdg/2');
$machine->succeed('grep -qF XDG3 /home/foo/.cache/xdg/3');
'';
}