alioth/nixpkgs
3
0
Fork 0
forked from mirrors/nixpkgs
Code Releases Activity

firejail: local profile handling fixed

Browse source 
made it possible to place local profiles in `~/.config/firejail`,
as well as in `/etc/firejail`.
This commit is contained in:
snicket2100 2020-03-27 17:36:57 +01:00
parent 749028e92b
commit a63f6a7d47
1 changed files with 20 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
pkgs/os-specific/linux/firejail/default.nix
View file

@ -36,10 +36,27 @@ stdenv.mkDerivation {
sed -e "s@/etc/@$out/etc/@g" -e "/chmod u+s/d" -i Makefile
'';
# We need to set the directory for the .local override files to
# /etc/firejail so we can actually override them
# The profile files provided with the firejail distribution include `.local`
# profile files using relative paths. The way firejail works when it comes to
# handling includes is by looking target files up in `~/.config/firejail`
# first, and then trying `SYSCONFDIR`. The latter normally points to
# `/etc/filejail`, but in the case of nixos points to the nix store. This
# makes it effectively impossible to place any profile files in
# `/etc/firejail`.
#
# The workaround applied below is by creating a set of `.local` files which
# only contain respective includes to `/etc/firejail`. This way
# `~/.config/firejail` still takes precedence, but `/etc/firejail` will also
# be searched in second order. This replicates the behaviour from
# non-nixos platforms.
#
# See https://github.com/netblue30/firejail/blob/e4cb6b42743ad18bd11d07fd32b51e8576239318/src/firejail/profile.c#L68-L83
# for the profile file lookup implementation.
postInstall = ''
sed -E -e 's@^include (.*.local)$@include /etc/firejail/\1@g' -i $out/etc/firejail/*.profile
for local in $(grep -Eh '^include.*local$' $out/etc/firejail/*.profile | awk '{print $2}' | sort | uniq)
do
echo "include /etc/firejail/$local" >$out/etc/firejail/$local
done
'';
# At high parallelism, the build sometimes fails with: