Getting rid of the var indirection and using a bin path instead
Parnell Springmeyer
parent
a8cb2afa98
commit
4aa0923009
|
|
@ -259,9 +259,9 @@ chroot $mountPoint /nix/var/nix/profiles/system/activate
|
|||
|
||||
|
||||
# Ask the user to set a root password.
|
||||
if [ -z "$noRootPasswd" ] && chroot $mountPoint [ -x /run/wrappers/passwd ] && [ -t 0 ]; then
|
||||
if [ -z "$noRootPasswd" ] && chroot $mountPoint [ -x /run/wrappers/bin/passwd ] && [ -t 0 ]; then
|
||||
echo "setting root password..."
|
||||
chroot $mountPoint /run/wrappers/passwd
|
||||
chroot $mountPoint /run/wrappers/bin/passwd
|
||||
fi
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ with lib;
|
|||
config = mkIf (cfg.confineSUIDApplications) {
|
||||
security.apparmor.profiles = [ (pkgs.writeText "ping" ''
|
||||
#include <tunables/global>
|
||||
/run/wrappers/ping {
|
||||
/run/wrappers/bin/ping {
|
||||
#include <abstractions/base>
|
||||
#include <abstractions/consoles>
|
||||
#include <abstractions/nameservice>
|
||||
|
|
@ -33,7 +33,6 @@ with lib;
|
|||
${pkgs.attr.out}/lib/libattr.so* mr,
|
||||
|
||||
${pkgs.iputils}/bin/ping mixr,
|
||||
/run/wrappers/ping.real r,
|
||||
|
||||
#/etc/modules.conf r,
|
||||
|
||||
|
|
|
|||
|
|
@ -17,7 +17,9 @@ let
|
|||
source=/nix/var/nix/profiles/default/bin/${program}
|
||||
fi
|
||||
|
||||
gcc -Wall -O2 -DSOURCE_PROG=\"$source\" -DWRAPPER_DIR=\"${config.security.wrapperDir}\" \
|
||||
parentWrapperDir=$(dirname ${wrapperDir})
|
||||
|
||||
gcc -Wall -O2 -DSOURCE_PROG=\"$source\" -DWRAPPER_DIR=\"$parentWrapperDir\" \
|
||||
-lcap-ng -lcap ${./wrapper.c} -o $out/bin/${program}.wrapper -L ${pkgs.libcap.lib}/lib -L ${pkgs.libcap_ng}/lib \
|
||||
-I ${pkgs.libcap.dev}/include -I ${pkgs.libcap_ng}/include -I ${pkgs.linuxHeaders}/include
|
||||
'';
|
||||
|
|
@ -155,7 +157,7 @@ in
|
|||
|
||||
security.wrapperDir = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = "/run/wrappers";
|
||||
default = "/run/wrappers/bin";
|
||||
internal = true;
|
||||
description = ''
|
||||
This option defines the path to the wrapper programs. It
|
||||
|
|
@ -181,11 +183,36 @@ in
|
|||
# programs to be wrapped.
|
||||
WRAPPER_PATH=${config.system.path}/bin:${config.system.path}/sbin
|
||||
|
||||
if [ -d ${config.security.old-wrapperDir} ]; then
|
||||
rm -rf ${config.security.old-wrapperDir}
|
||||
fi
|
||||
|
||||
parentWrapperDir="$(dirname ${wrapperDir})"
|
||||
|
||||
mkdir -p ${wrapperDir}
|
||||
wrapperDir=$(mktemp --directory --tmpdir=${wrapperDir} wrappers.XXXXXXXXXX)
|
||||
wrapperDir=$(mktemp --directory --tmpdir="$parentWrapperDir" wrappers.XXXXXXXXXX)
|
||||
chmod a+rx $wrapperDir
|
||||
|
||||
${lib.concatStringsSep "\n" mkWrappedPrograms}
|
||||
|
||||
if [ -L ${wrapperDir} ]; then
|
||||
# Atomically replace the symlink
|
||||
# See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
|
||||
old=$(readlink ${wrapperDir})
|
||||
ln --symbolic --force --no-dereference $wrapperDir ${wrapperDir}-tmp
|
||||
mv --no-target-directory ${wrapperDir}-tmp ${wrapperDir}
|
||||
rm --force --recursive $old
|
||||
elif [ -d ${wrapperDir} ]; then
|
||||
# Compatibility with old state, just remove the folder and symlink
|
||||
rm -f ${wrapperDir}/*
|
||||
# if it happens to be a tmpfs
|
||||
${pkgs.utillinux}/bin/umount ${wrapperDir} || true
|
||||
rm -d ${wrapperDir}
|
||||
ln -d --symbolic $wrapperDir ${wrapperDir}
|
||||
else
|
||||
# For initial setup
|
||||
ln --symbolic $wrapperDir ${wrapperDir}
|
||||
fi
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -29,8 +29,8 @@ let
|
|||
};
|
||||
|
||||
cronJob = ''
|
||||
@reboot logcheck env PATH=/run/wrappers:$PATH nice -n10 ${pkgs.logcheck}/sbin/logcheck -R ${flags}
|
||||
2 ${cfg.timeOfDay} * * * logcheck env PATH=/run/wrappers:$PATH nice -n10 ${pkgs.logcheck}/sbin/logcheck ${flags}
|
||||
@reboot logcheck env PATH=/run/wrappers/bin:$PATH nice -n10 ${pkgs.logcheck}/sbin/logcheck -R ${flags}
|
||||
2 ${cfg.timeOfDay} * * * logcheck env PATH=/run/wrappers/bin:$PATH nice -n10 ${pkgs.logcheck}/sbin/logcheck ${flags}
|
||||
'';
|
||||
|
||||
writeIgnoreRule = name: {level, regex, ...}:
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ let
|
|||
''
|
||||
base_dir = ${baseDir}
|
||||
protocols = ${concatStringsSep " " cfg.protocols}
|
||||
sendmail_path = /run/wrappers/sendmail
|
||||
sendmail_path = /run/wrappers/bin/sendmail
|
||||
''
|
||||
|
||||
(if isNull cfg.sslServerCert then ''
|
||||
|
|
|
|||
|
|
@ -70,7 +70,7 @@ in
|
|||
etc."exim.conf".text = ''
|
||||
exim_user = ${cfg.user}
|
||||
exim_group = ${cfg.group}
|
||||
exim_path = /run/wrappers/exim
|
||||
exim_path = /run/wrappers/bin/exim
|
||||
spool_directory = ${cfg.spoolDir}
|
||||
${cfg.config}
|
||||
'';
|
||||
|
|
|
|||
|
|
@ -34,7 +34,7 @@ let
|
|||
cap=$(sed -nr 's/.*#%#\s+capabilities\s*=\s*(.+)/\1/p' $file)
|
||||
|
||||
wrapProgram $file \
|
||||
--set PATH "/run/wrappers:/run/current-system/sw/bin:/run/current-system/sw/bin" \
|
||||
--set PATH "/run/wrappers/bin:/run/current-system/sw/bin:/run/current-system/sw/bin" \
|
||||
--set MUNIN_LIBDIR "${pkgs.munin}/lib" \
|
||||
--set MUNIN_PLUGSTATE "/var/run/munin"
|
||||
|
||||
|
|
@ -183,7 +183,7 @@ in
|
|||
|
||||
mkdir -p /etc/munin/plugins
|
||||
rm -rf /etc/munin/plugins/*
|
||||
PATH="/run/wrappers:/run/current-system/sw/bin:/run/current-system/sw/bin" ${pkgs.munin}/sbin/munin-node-configure --shell --families contrib,auto,manual --config ${nodeConf} --libdir=${muninPlugins} --servicedir=/etc/munin/plugins 2>/dev/null | ${pkgs.bash}/bin/bash
|
||||
PATH="/run/wrappers/bin:/run/current-system/sw/bin:/run/current-system/sw/bin" ${pkgs.munin}/sbin/munin-node-configure --shell --families contrib,auto,manual --config ${nodeConf} --libdir=${muninPlugins} --servicedir=/etc/munin/plugins 2>/dev/null | ${pkgs.bash}/bin/bash
|
||||
'';
|
||||
serviceConfig = {
|
||||
ExecStart = "${pkgs.munin}/sbin/munin-node --config ${nodeConf} --servicedir /etc/munin/plugins/";
|
||||
|
|
|
|||
|
|
@ -124,7 +124,7 @@ in
|
|||
};
|
||||
|
||||
mailer = mkOption {
|
||||
default = "/run/wrappers/sendmail";
|
||||
default = "/run/wrappers/bin/sendmail";
|
||||
type = types.path;
|
||||
description = ''
|
||||
Sendmail-compatible binary to be used to send the messages.
|
||||
|
|
|
|||
|
|
@ -30,7 +30,7 @@ let
|
|||
''
|
||||
[ global ]
|
||||
security = ${cfg.securityType}
|
||||
passwd program = /run/wrappers/passwd %u
|
||||
passwd program = /run/wrappers/bin/passwd %u
|
||||
pam password change = ${smbToString cfg.syncPasswordsByPam}
|
||||
invalid users = ${smbToString cfg.invalidUsers}
|
||||
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@ let
|
|||
var_prefix = "${stateDir}"
|
||||
prayer_user = "${prayerUser}"
|
||||
prayer_group = "${prayerGroup}"
|
||||
sendmail_path = "/run/wrappers/sendmail"
|
||||
sendmail_path = "/run/wrappers/bin/sendmail"
|
||||
|
||||
use_http_port ${cfg.port}
|
||||
|
||||
|
|
|
|||
|
|
@ -226,7 +226,7 @@ in
|
|||
sendmail = mkOption {
|
||||
type = types.nullOr types.path;
|
||||
default = null;
|
||||
example = "/run/wrappers/sendmail";
|
||||
example = "/run/wrappers/bin/sendmail";
|
||||
description = "Use this sendmail compatible script to deliver alerts";
|
||||
};
|
||||
smokeMailTemplate = mkOption {
|
||||
|
|
|
|||
|
|
@ -42,13 +42,13 @@ in
|
|||
|
||||
config = mkIf cfg.enable {
|
||||
|
||||
security.wrappers.setuid = map (program: "${program}" = {
|
||||
security.wrappers = map (program: {"${program}" = {
|
||||
source = "${pkgs.atd}/bin/${program}";
|
||||
owner = "atd";
|
||||
group = "atd";
|
||||
setuid = true;
|
||||
setgid = true;
|
||||
}) [ "at" "atq" "atrm" "batch" ];
|
||||
};}) [ "at" "atq" "atrm" "batch" ];
|
||||
|
||||
environment.systemPackages = [ at ];
|
||||
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ let
|
|||
cronNixosPkg = pkgs.cron.override {
|
||||
# The mail.nix nixos module, if there is any local mail system enabled,
|
||||
# should have sendmail in this path.
|
||||
sendmailPath = "/run/wrappers/sendmail";
|
||||
sendmailPath = "/run/wrappers/bin/sendmail";
|
||||
};
|
||||
|
||||
allFiles =
|
||||
|
|
|
|||
|
|
@ -96,7 +96,7 @@ in
|
|||
fcronallow = /etc/fcron.allow
|
||||
fcrondeny = /etc/fcron.deny
|
||||
shell = /bin/sh
|
||||
sendmail = /run/wrappers/sendmail
|
||||
sendmail = /run/wrappers/bin/sendmail
|
||||
editor = /run/current-system/sw/bin/vi
|
||||
'';
|
||||
target = "fcron.conf";
|
||||
|
|
|
|||
|
|
@ -131,11 +131,6 @@ if [ -n "@useHostResolvConf@" -a -e /etc/resolv.conf ]; then
|
|||
cat /etc/resolv.conf | resolvconf -m 1000 -a host
|
||||
fi
|
||||
|
||||
# Create /run/wrappers as a tmpfs.
|
||||
rm -rf /run/wrappers
|
||||
mkdir -m 0755 -p /run/wrappers
|
||||
mount -t tmpfs -o "mode=0755" tmpfs /run/wrappers
|
||||
|
||||
# Log the script output to /dev/kmsg or /run/log/stage-2-init.log.
|
||||
# Only at this point are all the necessary prerequisites ready for these commands.
|
||||
exec {logOutFd}>&1 {logErrFd}>&2
|
||||
|
|
|
|||
|
|
@ -69,12 +69,12 @@ in
|
|||
environment.systemPackages = [ virtualbox ];
|
||||
|
||||
security.wrappers = let
|
||||
mkSuid = program: "${program}" = {
|
||||
mkSuid = program: {"${program}" = {
|
||||
source = "${virtualbox}/libexec/virtualbox/${program}";
|
||||
owner = "root";
|
||||
group = "vboxusers";
|
||||
setuid = true;
|
||||
};
|
||||
};};
|
||||
in mkIf cfg.enableHardening (map mkSuid [
|
||||
"VBoxHeadless"
|
||||
"VBoxNetAdpCtl"
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ import ./make-test.nix ({ pkgs, ...} : {
|
|||
mailHost = "127.0.0.2";
|
||||
probeConfig = ''
|
||||
+ FPing
|
||||
binary = /run/wrappers/fping
|
||||
binary = /run/wrappers/bin/fping
|
||||
offset = 0%
|
||||
'';
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
{ fetchurl, stdenv, glib, xorg, cairo, gtk2, pango, makeWrapper, openssl, bzip2,
|
||||
pkexecPath ? "/run/wrappers/pkexec", libredirect,
|
||||
pkexecPath ? "/run/wrappers/bin/pkexec", libredirect,
|
||||
gksuSupport ? false, gksu}:
|
||||
|
||||
assert stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux";
|
||||
|
|
|
|||
|
|
@ -83,9 +83,9 @@ in stdenv.mkDerivation {
|
|||
ed -v -s "$out/bin/chromium" << EOF
|
||||
2i
|
||||
|
||||
if [ -x "/run/wrappers/${sandboxExecutableName}" ]
|
||||
if [ -x "/run/wrappers/bin/${sandboxExecutableName}" ]
|
||||
then
|
||||
export CHROME_DEVEL_SANDBOX="/run/wrappers/${sandboxExecutableName}"
|
||||
export CHROME_DEVEL_SANDBOX="/run/wrappers/bin/${sandboxExecutableName}"
|
||||
else
|
||||
export CHROME_DEVEL_SANDBOX="$sandbox/bin/${sandboxExecutableName}"
|
||||
fi
|
||||
|
|
|
|||
|
|
@ -26,7 +26,7 @@ index 50e8ad8..eec0ed2 100644
|
|||
+ is_nixos=no
|
||||
+fi
|
||||
+
|
||||
+if [ -u /run/wrappers/gksign ]; then
|
||||
+if [ -u /run/wrappers/bin/gksign ]; then
|
||||
+ cat <<EOM
|
||||
+
|
||||
+Gale appears to have already been set up via the NixOS module system (check
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ index a9d8ac4..85f13f5 100644
|
|||
- # # arguments: '-i -t'
|
||||
- # # }
|
||||
+ config.action_mailer.sendmail_settings = {
|
||||
+ location: '/run/wrappers/sendmail',
|
||||
+ location: '/run/wrappers/bin/sendmail',
|
||||
+ arguments: '-i -t'
|
||||
+ }
|
||||
config.action_mailer.perform_deliveries = true
|
||||
|
|
|
|||
|
|
@ -96,7 +96,7 @@ index 95dc9a7..39170bc 100644
|
|||
/* get the path to the executable */
|
||||
char szPath[RTPATH_MAX];
|
||||
- RTPathAppPrivateArch(szPath, sizeof(szPath) - 1);
|
||||
+ RTStrCopy(szPath, sizeof(szPath) - 1, "/run/wrappers");
|
||||
+ RTStrCopy(szPath, sizeof(szPath) - 1, "/run/wrappers/bin");
|
||||
size_t cchBufLeft = strlen(szPath);
|
||||
szPath[cchBufLeft++] = RTPATH_DELIMITER;
|
||||
szPath[cchBufLeft] = 0;
|
||||
|
|
@ -154,7 +154,7 @@ index be2ad8f..7ddf105 100644
|
|||
|
||||
+RTDECL(int) RTPathSuidDir(char *pszPath, size_t cchPath)
|
||||
+{
|
||||
+ return RTStrCopy(pszPath, cchPath, "/run/wrappers");
|
||||
+ return RTStrCopy(pszPath, cchPath, "/run/wrappers/bin");
|
||||
+}
|
||||
+
|
||||
+
|
||||
|
|
@ -174,7 +174,7 @@ index 7bde6af..2656cae 100644
|
|||
+ * will cut off everything after the rightmost / as this function is analogous
|
||||
+ * to RTProcGetExecutablePath().
|
||||
+ */
|
||||
+#define SUIDDIR "/run/wrappers/"
|
||||
+#define SUIDDIR "/run/wrappers/bin/"
|
||||
+
|
||||
+RTR3DECL(char *) RTProcGetSuidPath(char *pszExecPath, size_t cbExecPath)
|
||||
+{
|
||||
|
|
|
|||
|
|
@ -51,7 +51,7 @@ let
|
|||
export PS1='${name}-chrootenv:\u@\h:\w\$ '
|
||||
export LOCALE_ARCHIVE='/usr/lib/locale/locale-archive'
|
||||
export LD_LIBRARY_PATH='/run/opengl-driver/lib:/run/opengl-driver-32/lib:/usr/lib:/usr/lib32'
|
||||
export PATH='/run/wrappers:/usr/bin:/usr/sbin'
|
||||
export PATH='/run/wrappers/bin:/usr/bin:/usr/sbin'
|
||||
export PKG_CONFIG_PATH=/usr/lib/pkgconfig
|
||||
|
||||
# Force compilers to look in default search paths
|
||||
|
|
|
|||
|
|
@ -42,13 +42,13 @@ stdenv.mkDerivation rec {
|
|||
# this is a hack and without this cpufreq module is not working. does the following:
|
||||
# 1. moves the "freqset" binary to "e_freqset",
|
||||
# 2. linkes "e_freqset" to enlightenment/bin so that,
|
||||
# 3. wrappers.setuid detects it and places wrappers in /run/wrappers/e_freqset,
|
||||
# 4. and finally, links /run/wrappers/e_freqset to original destination where enlightenment wants it
|
||||
# 3. wrappers.setuid detects it and places wrappers in /run/wrappers/bin/e_freqset,
|
||||
# 4. and finally, links /run/wrappers/bin/e_freqset to original destination where enlightenment wants it
|
||||
postInstall = ''
|
||||
export CPUFREQ_DIRPATH=`readlink -f $out/lib/enlightenment/modules/cpufreq/linux-gnu-*`;
|
||||
mv $CPUFREQ_DIRPATH/freqset $CPUFREQ_DIRPATH/e_freqset
|
||||
ln -sv $CPUFREQ_DIRPATH/e_freqset $out/bin/e_freqset
|
||||
ln -sv /run/wrappers/e_freqset $CPUFREQ_DIRPATH/freqset
|
||||
ln -sv /run/wrappers/bin/e_freqset $CPUFREQ_DIRPATH/freqset
|
||||
'';
|
||||
|
||||
meta = with stdenv.lib; {
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@ Index: kinit-5.24.0/src/start_kdeinit/start_kdeinit_wrapper.c
|
|||
#include <unistd.h>
|
||||
|
||||
-#define EXECUTE CMAKE_INSTALL_FULL_LIBEXECDIR_KF5 "/start_kdeinit"
|
||||
+#define EXECUTE "/run/wrappers/start_kdeinit"
|
||||
+#define EXECUTE "/run/wrappers/bin/start_kdeinit"
|
||||
|
||||
#if KDEINIT_OOM_PROTECT
|
||||
|
||||
|
|
|
|||
|
|
@ -57,8 +57,8 @@ stdenv.mkDerivation rec {
|
|||
|
||||
# Fix some binary paths
|
||||
sed -i -e 's|/usr/bin/xauth|${xauth}/bin/xauth|g' libgksu/gksu-run-helper.c libgksu/libgksu.c
|
||||
sed -i -e 's|/usr/bin/sudo|/run/wrappers/sudo|g' libgksu/libgksu.c
|
||||
sed -i -e 's|/bin/su\([^d]\)|/run/wrappers/su\1|g' libgksu/libgksu.c
|
||||
sed -i -e 's|/usr/bin/sudo|/run/wrappers/bin/sudo|g' libgksu/libgksu.c
|
||||
sed -i -e 's|/bin/su\([^d]\)|/run/wrappers/bin/su\1|g' libgksu/libgksu.c
|
||||
|
||||
touch NEWS README
|
||||
'';
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
let
|
||||
|
||||
system = "/var/run/current-system/sw";
|
||||
setuid = "/run/wrappers"; #TODO: from <nixos> config.security.wrapperDir;
|
||||
setuid = "/run/wrappers/bin"; #TODO: from <nixos> config.security.wrapperDir;
|
||||
|
||||
foolVars = {
|
||||
SYSCONF = "/etc";
|
||||
|
|
|
|||
|
|
@ -94,7 +94,7 @@ in stdenv.mkDerivation rec {
|
|||
unitydir="$out/opt/Unity/Editor"
|
||||
mkdir -p $unitydir
|
||||
mv Editor/* $unitydir
|
||||
ln -sf /run/wrappers/${chromium.sandboxExecutableName} $unitydir/chrome-sandbox
|
||||
ln -sf /run/wrappers/bin/${chromium.sandboxExecutableName} $unitydir/chrome-sandbox
|
||||
|
||||
mkdir -p $out/share/applications
|
||||
sed "/^Exec=/c\Exec=$out/bin/unity-editor" \
|
||||
|
|
|
|||
|
|
@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
|
|||
# Ensure that FUSE calls the setuid wrapper, not
|
||||
# $out/bin/fusermount. It falls back to calling fusermount in
|
||||
# $PATH, so it should also work on non-NixOS systems.
|
||||
export NIX_CFLAGS_COMPILE="-DFUSERMOUNT_DIR=\"/run/wrappers\""
|
||||
export NIX_CFLAGS_COMPILE="-DFUSERMOUNT_DIR=\"/run/wrappers/bin\""
|
||||
|
||||
sed -e 's@/bin/@${utillinux}/bin/@g' -i lib/mount_util.c
|
||||
sed -e 's@CONFIG_RPATH=/usr/share/gettext/config.rpath@CONFIG_RPATH=${gettext}/share/gettext/config.rpath@' -i makeconf.sh
|
||||
|
|
|
|||
|
|
@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
|
|||
preConfigure = ''
|
||||
sed -e 's@/lib/udev@''${out}/lib/udev@' \
|
||||
-e 's@ -Werror @ @' \
|
||||
-e 's@/usr/sbin/sendmail@/run/wrappers/sendmail@' -i Makefile
|
||||
-e 's@/usr/sbin/sendmail@/run/wrappers/bin/sendmail@' -i Makefile
|
||||
'';
|
||||
|
||||
meta = {
|
||||
|
|
|
|||
|
|
@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
|
|||
preConfigure = ''
|
||||
sed -e 's@/lib/udev@''${out}/lib/udev@' \
|
||||
-e 's@ -Werror @ @' \
|
||||
-e 's@/usr/sbin/sendmail@/run/wrappers/sendmail@' -i Makefile
|
||||
-e 's@/usr/sbin/sendmail@/run/wrappers/bin/sendmail@' -i Makefile
|
||||
'';
|
||||
|
||||
meta = {
|
||||
|
|
|
|||
|
|
@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
|
|||
|
||||
postInstall = ''
|
||||
mv -v $out/sbin/unix_chkpwd{,.orig}
|
||||
ln -sv /run/wrappers/unix_chkpwd $out/sbin/unix_chkpwd
|
||||
ln -sv /run/wrappers/bin/unix_chkpwd $out/sbin/unix_chkpwd
|
||||
''; /*
|
||||
rm -rf $out/etc
|
||||
mkdir -p $modules/lib
|
||||
|
|
|
|||
|
|
@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
|
|||
--enable-last
|
||||
--enable-mesg
|
||||
--disable-use-tty-group
|
||||
--enable-fs-paths-default=/run/wrappers:/var/run/current-system/sw/bin:/sbin
|
||||
--enable-fs-paths-default=/run/wrappers/bin:/var/run/current-system/sw/bin:/sbin
|
||||
${if ncurses == null then "--without-ncurses" else ""}
|
||||
${if systemd == null then "" else ''
|
||||
--with-systemd
|
||||
|
|
|
|||
|
|
@ -30,7 +30,7 @@ buildGoPackage rec {
|
|||
-e 's|/bin/chown|${coreutils}/bin/chown|' \
|
||||
-e 's|/bin/date|${coreutils}/bin/date|' \
|
||||
-e 's|/sbin/poweroff|${systemd}/sbin/poweroff|' \
|
||||
-e 's|/usr/bin/sudo|/run/wrappers/sudo|' \
|
||||
-e 's|/usr/bin/sudo|/run/wrappers/bin/sudo|' \
|
||||
-e 's|/sbin/cryptsetup|${cryptsetup}/bin/cryptsetup|'
|
||||
'';
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ stdenv, fetchurl, flex, bison, sendmailPath ? "/run/wrappers/sendmail" }:
|
||||
{ stdenv, fetchurl, flex, bison, sendmailPath ? "/run/wrappers/bin/sendmail" }:
|
||||
|
||||
stdenv.mkDerivation rec {
|
||||
name = "petidomo-4.3";
|
||||
|
|
|
|||
|
|
@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
|
|||
# configured on the build machine).
|
||||
preConfigure= "
|
||||
configureFlagsArray=(
|
||||
--with-ping-command='/run/wrappers/ping -n -U -w %d -c %d %s'
|
||||
--with-ping6-command='/run/wrappers/ping6 -n -U -w %d -c %d %s'
|
||||
--with-ping-command='/run/wrappers/bin/ping -n -U -w %d -c %d %s'
|
||||
--with-ping6-command='/run/wrappers/bin/ping6 -n -U -w %d -c %d %s'
|
||||
)
|
||||
";
|
||||
|
||||
|
|
|
|||
|
|
@ -20,10 +20,10 @@ stdenv.mkDerivation rec {
|
|||
configureFlags="--mandir=$out/share/man"
|
||||
|
||||
substituteInPlace x11vnc/unixpw.c \
|
||||
--replace '"/bin/su"' '"/run/wrappers/su"' \
|
||||
--replace '"/bin/su"' '"/run/wrappers/bin/su"' \
|
||||
--replace '"/bin/true"' '"${coreutils}/bin/true"'
|
||||
|
||||
sed -i -e '/#!\/bin\/sh/a"PATH=${xorg.xdpyinfo}\/bin:${xorg.xauth}\/bin:$PATH\\n"' -e 's|/bin/su|/run/wrappers/su|g' x11vnc/ssltools.h
|
||||
sed -i -e '/#!\/bin\/sh/a"PATH=${xorg.xdpyinfo}\/bin:${xorg.xauth}\/bin:$PATH\\n"' -e 's|/bin/su|/run/wrappers/bin/su|g' x11vnc/ssltools.h
|
||||
'';
|
||||
|
||||
meta = {
|
||||
|
|
|
|||
|
|
@ -31,7 +31,7 @@ python2Packages.buildPythonApplication rec {
|
|||
buildInputs = [ dialog ] ++ (with python2Packages; [ nose mock gnureadline ]);
|
||||
|
||||
patchPhase = ''
|
||||
substituteInPlace certbot/notify.py --replace "/usr/sbin/sendmail" "/run/wrappers/sendmail"
|
||||
substituteInPlace certbot/notify.py --replace "/usr/sbin/sendmail" "/run/wrappers/bin/sendmail"
|
||||
substituteInPlace certbot/util.py --replace "sw_vers" "/usr/bin/sw_vers"
|
||||
'';
|
||||
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
, FileDesktopEntry, libxslt, docbook_xsl, makeWrapper
|
||||
, python3Packages
|
||||
, perlPackages, curl, gnupg, diffutils
|
||||
, sendmailPath ? "/run/wrappers/sendmail"
|
||||
, sendmailPath ? "/run/wrappers/bin/sendmail"
|
||||
}:
|
||||
|
||||
let
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
|
|||
};
|
||||
|
||||
# TODO: replace wrapperDir below with from <nixos> config.security.wrapperDir;
|
||||
wrapperDir = "/run/wrappers";
|
||||
wrapperDir = "/run/wrappers/bin";
|
||||
|
||||
postPatch = ''
|
||||
FILES="$(grep -r '/bin/sh' src/utils -l; find src -name \*.c)"
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
|
|||
|
||||
buildInputs = [ makeWrapper ];
|
||||
|
||||
# Do not hardcode PATH to ${ecryptfs} as we need the script to invoke executables from /run/wrappers
|
||||
# Do not hardcode PATH to ${ecryptfs} as we need the script to invoke executables from /run/wrappers/bin
|
||||
installPhase = ''
|
||||
mkdir -p $out/bin $out/libexec
|
||||
cp $src $out/libexec/ecryptfs-helper.py
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
{ stdenv, fetchurl, coreutils, pam, groff
|
||||
, sendmailPath ? "/run/wrappers/sendmail"
|
||||
, sendmailPath ? "/run/wrappers/bin/sendmail"
|
||||
, withInsults ? false
|
||||
}:
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ fetchurl, stdenv, bison, flex, pam, sendmailPath ? "/run/wrappers/sendmail" }:
|
||||
{ fetchurl, stdenv, bison, flex, pam, sendmailPath ? "/run/wrappers/bin/sendmail" }:
|
||||
|
||||
stdenv.mkDerivation {
|
||||
name = "at-3.1.16";
|
||||
|
|
|
|||
|
|
@ -23,7 +23,7 @@ stdenv.mkDerivation {
|
|||
#define _PATH_SENDMAIL "${sendmailPath}"
|
||||
|
||||
#undef _PATH_DEFPATH
|
||||
#define _PATH_DEFPATH "/run/wrappers:/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/run/current-system/sw/bin:/run/current-system/sw/sbin:/usr/bin:/bin"
|
||||
#define _PATH_DEFPATH "/run/wrappers/bin:/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/run/current-system/sw/bin:/run/current-system/sw/sbin:/usr/bin:/bin"
|
||||
__EOT__
|
||||
|
||||
# Implicit saved uids do not work here due to way NixOS uses setuid wrappers
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
{stdenv, fetchurl,
|
||||
sendmailPath ? "/run/wrappers/sendmail" }:
|
||||
sendmailPath ? "/run/wrappers/bin/sendmail" }:
|
||||
|
||||
stdenv.mkDerivation rec {
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue