nixpkgs-suyu/pkgs/applications/networking/browsers
aszlig c06c636604
chromium: Add patch for user namespace sandboxing.
This patch adds support for unprivileged user namespaces found in kernel
versions 3.8.0 and later. In case of Nix, this is especially useful to prevent
having to set up setuid wrappers.

The implementation details about this patch can be found at the top of the file
"sandbox_userns.patch". My first attempt of creating this patch was by modifying
the SUID sandbox. Unfortunately this didn't work out well, because in the event
of a sandbox failure, the host zygote process waits for an answer of the inner
zygote with no timeout. Even if I'd have set a timeout, this would have been
very ugly, giving users which don't have unprivileged user namespaces a delay on
startup.

An alternative approach to the mentioned problem would be to use select() on the
host zygote, watching for changes stdout or stderr and the synchronization
socket. But even that approach isn't feasible because it requires a whole bunch
of even more patching.

Patch was tested with older kernels (3.2.x, 3.7.x) and kernels without user
namespace support enabled, where in case the feature is unavailable it reverts
back to the previous behaviour (no zygote sandbox, only seccomp BPF).

In order to support all Chromium channels, I manually changed the first hunk of
the patch to not include the starting context of the diff, because there is a
whitespace change in more recent versions of the Chromium source tree.

See SVN revision 199882 for the change (revert in this case) in detail:

http://src.chromium.org/viewvc/chrome?view=revision&revision=199882

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2013-05-16 21:03:07 +02:00
..
arora Arora: version bump 2010-10-15 23:43:21 +00:00
chromium chromium: Add patch for user namespace sandboxing. 2013-05-16 21:03:07 +02:00
conkeror conkeror: Update to 1.0pre-20130401. 2013-04-03 22:48:17 +04:00
elinks elinks: allow building without guile 2013-03-16 13:39:30 +01:00
firefox firefoxWrapper: Add libcanberra gtk module to firefox 2013-05-10 00:44:03 +00:00
icecat-3 * Cleanup: remove obsolete references to ‘xz’, which is in stdenv now. 2012-01-18 20:53:01 +00:00
kwebkitpart KWebKitPart: new package 2013-05-10 05:03:54 +03:00
links * Reverted r6713, r6711, r4623, r3660, r2237. There rewrote fetchurl 2007-08-24 12:32:36 +00:00
links2 Rename buildNativeInputs -> nativeBuildInputs 2012-12-28 19:20:09 +01:00
lynx Rename buildNativeInputs -> nativeBuildInputs 2012-12-28 19:20:09 +01:00
midori Update/fix Midori 2012-03-25 11:22:32 +00:00
mozilla * Got rid of a lot of "postInstall=postInstall" and similar lines in 2009-04-23 13:31:10 +00:00
mozilla-plugins google-talk-plugin: Update to version 3.17.0.0. 2013-04-26 08:10:44 +02:00
netsurf Mark some packages as low priority and disambiguate some others 2012-11-29 15:26:13 +01:00
opera opera: Update to 12.12 2012-12-20 14:45:15 +01:00
rekonq rekonq: update 2013-03-02 14:44:51 +01:00
uzbl Update Uzbl 2012-11-08 10:34:06 +04:00
vimprobable2 vimprobable2, surf: fix the settings-schemas problem 2013-03-14 16:01:53 +01:00
w3m w3m: Disable parallel building 2013-01-17 14:35:52 +01:00