nixos-install: remove root requirement for bind mount

This moves the creation of the bind mount inside the `nixos-enter`
invocation. The command are executed in an unshared mount namespace, so
they can be run as an unprivileged user.

rnhmjoj 2bc56258 4f50411c

Changed files
+14 -12
nixos
modules
installer
+14 -12
nixos/modules/installer/tools/nixos-install.sh
···
mkdir -m 0755 -p "$mountPoint/etc"
touch "$mountPoint/etc/NIXOS"
-
# Create a bind mount for each of the mount points inside the target file
-
# system. This preserves the validity of their absolute paths after changing
-
# the root with `nixos-enter`.
-
# Without this the bootloader installation may fail due to options that
-
# contain paths referenced during evaluation, like initrd.secrets.
-
if (( EUID == 0 )); then
-
mount --rbind --mkdir "$mountPoint" "$mountPoint$mountPoint"
-
mount --make-rslave "$mountPoint$mountPoint"
-
trap 'umount -R "$mountPoint$mountPoint" && rmdir "$mountPoint$mountPoint"' EXIT
-
fi
-
# Switch to the new system configuration. This will install Grub with
# a menu default pointing at the kernel/initrd/etc of the new
# configuration.
···
echo "installing the boot loader..."
# Grub needs an mtab.
ln -sfn /proc/mounts "$mountPoint"/etc/mtab
-
NIXOS_INSTALL_BOOTLOADER=1 nixos-enter --root "$mountPoint" -- /run/current-system/bin/switch-to-configuration boot
fi
# Ask the user to set a root password, but only if the passwd command
···
mkdir -m 0755 -p "$mountPoint/etc"
touch "$mountPoint/etc/NIXOS"
# Switch to the new system configuration. This will install Grub with
# a menu default pointing at the kernel/initrd/etc of the new
# configuration.
···
echo "installing the boot loader..."
# Grub needs an mtab.
ln -sfn /proc/mounts "$mountPoint"/etc/mtab
+
export mountPoint
+
NIXOS_INSTALL_BOOTLOADER=1 nixos-enter --root "$mountPoint" -c "$(cat <<'EOF'
+
# Create a bind mount for each of the mount points inside the target file
+
# system. This preserves the validity of their absolute paths after changing
+
# the root with `nixos-enter`.
+
# Without this the bootloader installation may fail due to options that
+
# contain paths referenced during evaluation, like initrd.secrets.
+
# when not root, re-execute the script in an unshared namespace
+
mount --rbind --mkdir / "$mountPoint"
+
mount --make-rslave "$mountPoint"
+
/run/current-system/bin/switch-to-configuration boot
+
umount -R "$mountPoint" && rmdir "$mountPoint"
+
EOF
+
)"
fi
# Ask the user to set a root password, but only if the passwd command