f18317885a
Login mode can cause hidden problems, e.g. #12406. Generally we don't want to read user's .bash_profile when we don't start an interactive shell inside a chroot.
53 lines
1.5 KiB
Nix
53 lines
1.5 KiB
Nix
{ runCommand, lib, writeText, writeScriptBin, stdenv, bash, ruby } :
|
|
{ env, runScript ? "${bash}/bin/bash", extraBindMounts ? [], extraInstallCommands ? "", importMeta ? {} } :
|
|
|
|
let
|
|
name = env.pname;
|
|
bash' = "${bash}/bin/bash";
|
|
|
|
# Sandboxing script
|
|
chroot-user = writeScriptBin "chroot-user" ''
|
|
#! ${ruby}/bin/ruby
|
|
${builtins.readFile ./chroot-user.rb}
|
|
'';
|
|
|
|
init = run: writeText "${name}-init" ''
|
|
source /etc/profile
|
|
|
|
# Make /tmp directory
|
|
mkdir -m 1777 /tmp
|
|
|
|
# Expose sockets in /tmp
|
|
for i in /host-tmp/.*-unix; do
|
|
ln -s "$i" "/tmp/$(basename "$i")"
|
|
done
|
|
|
|
[ -d "$1" ] && [ -r "$1" ] && cd "$1"
|
|
shift
|
|
exec ${run} "$@"
|
|
'';
|
|
|
|
in runCommand name {
|
|
meta = importMeta;
|
|
passthru.env =
|
|
runCommand "${name}-shell-env" {
|
|
shellHook = ''
|
|
export CHROOTENV_EXTRA_BINDS="${lib.concatStringsSep ":" extraBindMounts}:$CHROOTENV_EXTRA_BINDS"
|
|
exec ${chroot-user}/bin/chroot-user ${env} ${bash'} -l ${init bash'} "$(pwd)"
|
|
'';
|
|
} ''
|
|
echo >&2 ""
|
|
echo >&2 "*** User chroot 'env' attributes are intended for interactive nix-shell sessions, not for building! ***"
|
|
echo >&2 ""
|
|
exit 1
|
|
'';
|
|
} ''
|
|
mkdir -p $out/bin
|
|
cat <<EOF >$out/bin/${name}
|
|
#! ${stdenv.shell}
|
|
export CHROOTENV_EXTRA_BINDS="${lib.concatStringsSep ":" extraBindMounts}:\$CHROOTENV_EXTRA_BINDS"
|
|
exec ${chroot-user}/bin/chroot-user ${env} ${bash'} ${init runScript} "\$(pwd)" "\$@"
|
|
EOF
|
|
chmod +x $out/bin/${name}
|
|
${extraInstallCommands}
|
|
''
|