mirrors/nixpkgs
1
0
Fork 1
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-21 21:21:06 +00:00
Code Issues Wiki Activity

Merge pull request #83515 from snicket2100/firejail-fix

Browse source 
firejail: local profile handling fixed
This commit is contained in:
Michael Raskin 2020-03-28 10:34:39 +00:00 committed by GitHub
parent e76a190ce7 a63f6a7d47
commit 7dc2439a1b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 20 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
pkgs/os-specific/linux/firejail/default.nix
View file

@ -36,10 +36,27 @@ stdenv.mkDerivation {
sed -e "s@/etc/@$out/etc/@g" -e "/chmod u+s/d" -i Makefile
'';
# We need to set the directory for the .local override files to
# /etc/firejail so we can actually override them
# The profile files provided with the firejail distribution include `.local`
# profile files using relative paths. The way firejail works when it comes to
# handling includes is by looking target files up in `~/.config/firejail`
# first, and then trying `SYSCONFDIR`. The latter normally points to
# `/etc/filejail`, but in the case of nixos points to the nix store. This
# makes it effectively impossible to place any profile files in
# `/etc/firejail`.
#
# The workaround applied below is by creating a set of `.local` files which
# only contain respective includes to `/etc/firejail`. This way
# `~/.config/firejail` still takes precedence, but `/etc/firejail` will also
# be searched in second order. This replicates the behaviour from
# non-nixos platforms.
#
# See https://github.com/netblue30/firejail/blob/e4cb6b42743ad18bd11d07fd32b51e8576239318/src/firejail/profile.c#L68-L83
# for the profile file lookup implementation.
postInstall = ''
sed -E -e 's@^include (.*.local)$@include /etc/firejail/\1@g' -i $out/etc/firejail/*.profile
for local in $(grep -Eh '^include.*local$' $out/etc/firejail/*.profile | awk '{print $2}' | sort | uniq)
do
echo "include /etc/firejail/$local" >$out/etc/firejail/$local
done
'';
# At high parallelism, the build sometimes fails with: