1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
|
{ stdenv, lib, pkgconfig, closureInfo, nix, boost, dash }:
drv: { paths ? {}, ... }@attrs:
let
# Extra paths that are required so they are created prior to bind-mounting.
pathsRequired = paths.required or [];
# Extra paths that are skipped if they don't exist.
pathsWanted = paths.wanted or [];
# Paths extracted from PATH-like environment variables, eg. LD_LIBRARY_PATH.
pathsRuntimeVars = paths.runtimeVars or [];
# Mount a dash shell in /bin/sh inside the chroot.
allowBinSh = attrs.allowBinSh or false;
# Enable nix builds from within the sandbox.
# Has to write the full nix store to make the outputs accessible.
# TODO: get rid of nix & pkg-config if this is enabled (in the Makefile)
fullNixStore = attrs.fullNixStore or false;
# The mount and user namespaces are needed for this functionality, so these
# namespaces are always enabled.
#
# However, the following namespaces can be enabled/disabled:
# +----------------+---------+--------------------------------------+
# | Attribute path | Default | Isolates |
# +----------------+---------+--------------------------------------+
# | namespaces.pid | true | Process IDs |
# | namespaces.uts | true | Hostname and NIS domain name |
# | namespaces.ipc | true | System V IPC, POSIX message queues |
# | namespaces.net | false | Network devices, stacks, ports, etc. |
# +----------------+---------+--------------------------------------+
extraNamespaceFlags = let
flags = lib.optional (attrs.namespaces.pid or true) "CLONE_NEWPID"
++ lib.optional (attrs.namespaces.uts or true) "CLONE_NEWUTS"
++ lib.optional (attrs.namespaces.ipc or true) "CLONE_NEWIPC"
++ lib.optional (attrs.namespaces.net or false) "CLONE_NEWNET";
in if flags == [] then "0" else lib.concatStringsSep "|" flags;
# Create code snippets for params.c to add extra_mount() calls.
mkExtraMountParams = isRequired: lib.concatMapStringsSep "\n" (extra: let
escaped = lib.escape ["\\" "\""] extra;
reqBool = if isRequired then "true" else "false";
code = "if (!extra_mount(\"${escaped}\", ${reqBool})) return false;";
in "echo ${lib.escapeShellArg code} >> params.c");
in stdenv.mkDerivation ({
name = "${drv.name}-sandboxed";
src = ./src;
inherit drv;
closureInfo = closureInfo {
rootPaths = lib.singleton drv ++ lib.optional allowBinSh dash;
};
configurePhase = ''
echo '#include "setup.h"' > params.c
echo 'bool setup_app_paths(void) {' >> params.c
${if fullNixStore then ''
# /nix/var needs to be writable for nix to work inside the sandbox
echo 'if (!bind_mount("/nix/var", false, true, true)) return false;' \
>> params.c
echo 'if (!bind_mount("/nix/store", true, true, true)) return false;' \
>> params.c
'' else ''
for dep in $(< "$closureInfo/store-paths"); do
echo 'if (!bind_mount("'"$dep"'", true, true, true)) return false;' \
>> params.c
done
''}
${mkExtraMountParams true pathsRequired}
${mkExtraMountParams false pathsWanted}
echo 'return true; }' >> params.c
${lib.optionalString (!fullNixStore) ''
echo 'bool mount_runtime_path_vars(struct query_state *qs) {' >> params.c
${lib.concatMapStringsSep "\n" (pathvar: let
escaped = lib.escapeShellArg (lib.escape ["\\" "\""] pathvar);
fun = "mount_from_path_var";
result = "echo 'if (!${fun}(qs, \"'${escaped}'\")) return false;'";
in "${result} >> params.c") pathsRuntimeVars}
echo 'return true; }' >> params.c
''}
'';
postInstall = ''
for df in "$drv/share/applications/"*.desktop; do
mkdir -p "$out/share/applications"
sed -e 's!'"$drv"'/bin!'"$out"'/bin!g' "$df" \
> "$out/share/applications/$(basename "$df")"
done
'';
nativeBuildInputs = [ pkgconfig ];
buildInputs = [ boost nix ];
makeFlags = [ "BINDIR=${drv}/bin" "EXTRA_NS_FLAGS=${extraNamespaceFlags}" ]
++ lib.optional allowBinSh "BINSH_EXECUTABLE=${dash}/bin/dash"
++ lib.optional fullNixStore "FULL_NIX_STORE=1";
} // removeAttrs attrs [ "namespaces" "paths" "allowBinSh" ])
|
