blob: 3b41e1bd03df3532d4ca19afe7a6507359a89ebc (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
|
{ stdenv, lib }:
drv: { extraSandboxPaths ? [], ... }@attrs:
stdenv.mkDerivation ({
name = "${drv.name}-sandboxed";
src = drv;
phases = [ "buildPhase" "installPhase" ];
exportReferencesGraph = [ "sandbox-closure" drv ];
buildPhase = ''
runtimeDeps="$(sed -ne '
p; n; n
:cdown
/^0*$/b
:l; s/0\(X*\)$/X\1/; tl
s/^\(X*\)$/9\1/; tdone
${lib.concatMapStrings (num: ''
s/${toString num}\(X*\)$/${toString (num - 1)}\1/; tdone
'') (lib.range 1 9)}
:done
y/X/9/
x; n; p; x
bcdown
' sandbox-closure | sort -u)"
echo 'static bool setup_app_paths(void) {' > params.c
for dep in $runtimeDeps; do
echo 'if (!bind_mount("'"$dep"'", true)) return false;' >> params.c
done
${lib.concatMapStrings (extra: let
escaped = lib.escapeShellArg (lib.escape ["\\" "\""] extra);
result = "echo 'if (!extra_mount(\"'${escaped}'\")) return false;'";
in "${result} >> params.c") extraSandboxPaths}
echo 'return true; }' >> params.c
cat params.c
'';
installPhase = ''
mkdir -p "$out/bin"
for bin in "$src"/bin/*; do
progname="$(basename "$bin")"
gcc -g -std=gnu11 -Wall \
-DWRAPPED_PATH=\""$bin"\" \
-DWRAPPED_PROGNAME=\""$progname"\" \
-DPARAMS_FILE=\""$(pwd)/params.c"\" \
-o "$out/bin/$progname" ${./sandbox.c}
done
'';
} // removeAttrs attrs [ "extraSandboxPaths" ])
|