831c700c5d
- The `-overlay` flag runs the specified binary inside an OverlayFS, since the /nix store may be in a different mount point than the user home, this patch explicitly bind mounts it so it's available inside the overlay. - profile builder: firejail provides facilities to build a new profiles. To do so, it execute the helper binary `fbuilder`, which in turn will execute firejail back with different options. This patch makes it use the binary available in PATH instead of the one produced at compile time. The compiled firejail binary doesn't have the necessary permissions, so the firejail NixOS module wraps it in a SUID wrapper available on PATH at runtime. Signed-off-by: Roosembert Palacios <roosemberth@posteo.ch>
11 lines
233 B
Diff
11 lines
233 B
Diff
--- a/src/fbuilder/build_profile.c
|
|
+++ b/src/fbuilder/build_profile.c
|
|
@@ -67,7 +67,7 @@
|
|
errExit("asprintf");
|
|
|
|
char *cmdlist[] = {
|
|
- BINDIR "/firejail",
|
|
+ "firejail",
|
|
"--quiet",
|
|
"--noprofile",
|
|
"--caps.drop=all",
|