4bcc817521
The motivation for this change is to allow things like the
following derivation, which wraps the debian-packaged
hello binary.
let nixpkgs = import <nixpkgs> {};
stdenv = nixpkgs.stdenv;
in rec {
dumb-hello = stdenv.mkDerivation {
name = "dumb-hello";
builder = ./builder.sh;
dpkg = nixpkgs.dpkg;
src = nixpkgs.fetchurl {
url = "http://ftp.us.debian.org/debian/pool/main/h/hello-traditional/hello-traditional_2.9-2_amd64.deb";
md5 = "f5f3c28b65221dae44dda6f242c23316";
};
};
full-hello = nixpkgs.buildFHSUserEnv {
name = "full-hello";
targetPkgs = pkgs: [ dumb-hello ];
multiPkgs = pkgs: [ pkgs.dpkg ];
runScript = "hello";
};
}
37 lines
808 B
Nix
37 lines
808 B
Nix
{ writeTextFile, stdenv, ruby } : { env, runScript } :
|
|
|
|
let
|
|
name = env.pname;
|
|
|
|
# Sandboxing script
|
|
chroot-user = writeTextFile {
|
|
name = "chroot-user";
|
|
executable = true;
|
|
destination = "/bin/chroot-user";
|
|
text = ''
|
|
#! ${ruby}/bin/ruby
|
|
${builtins.readFile ./chroot-user.rb}
|
|
'';
|
|
};
|
|
|
|
in stdenv.mkDerivation {
|
|
name = "${name}-userenv";
|
|
buildInputs = [ ruby ];
|
|
preferLocalBuild = true;
|
|
buildCommand = ''
|
|
mkdir -p $out/bin
|
|
cat > $out/bin/${name} <<EOF
|
|
#! ${stdenv.shell}
|
|
exec ${chroot-user}/bin/chroot-user ${env} $out/libexec/run "\$@"
|
|
EOF
|
|
chmod +x $out/bin/${name}
|
|
|
|
mkdir -p $out/libexec
|
|
cat > $out/libexec/run <<EOF
|
|
#! ${stdenv.shell}
|
|
source /etc/profile
|
|
${runScript} "\$@"
|
|
EOF
|
|
chmod +x $out/libexec/run
|
|
'';
|
|
}
|