···

       
102
       
 
       
                source=/nix/var/nix/profiles/default/bin/${program}

     

       
103
       
 
       
            fi

     

       
104
       
 
       


     

       
105
       
-
       
            cp ${setuidWrapper}/bin/setuid-wrapper $wrapperDir/${program}

     

       
106
       
-
       
            echo -n "$source" > $wrapperDir/${program}.real

     

       
107
       
-
       
            chmod 0000 $wrapperDir/${program} # to prevent races

     

       
108
       
-
       
            chown ${owner}.${group} $wrapperDir/${program}

     

       
109
       
-
       
            chmod "u${if setuid then "+" else "-"}s,g${if setgid then "+" else "-"}s,${permissions}" $wrapperDir/${program}

     

       
110
       
 
       
          '';

     

       
111
       
 
       


     

       
112
       
 
       
      in stringAfter [ "users" ]

     
···

       
115
       
 
       
          # programs to be wrapped.

     

       
116
       
 
       
          SETUID_PATH=${config.system.path}/bin:${config.system.path}/sbin

     

       
117
       
 
       


     

       
118
       
-
       
          mkdir -p /run/setuid-wrapper-dirs

     

       
119
       
-
       
          wrapperDir=$(mktemp --directory --tmpdir=/run/setuid-wrapper-dirs setuid-wrappers.XXXXXXXXXX)

     

       
120
       
 
       


     

       
121
       
 
       
          ${concatMapStrings makeSetuidWrapper setuidPrograms}

     

       
122
       
-
       


     

       
123
       
-
       
          if [ -d ${wrapperDir} ]; then

     

       
124
       
-
       
            mv --no-target-directory ${wrapperDir} ${wrapperDir}-old

     

       
125
       
-
       
            ln --symbolic $wrapperDir ${wrapperDir}

     

       
126
       
-
       
            rm --force --recursive ${wrapperDir}-old

     

       
127
       
-
       
          elif [ -L ${wrapperDir} ]; then

     

       
128
       
-
       
            ln --symbolic --force --no-dereference $wrapperDir ${wrapperDir}-tmp

     

       
129
       
-
       
            old=$(readlink ${wrapperDir})

     

       
130
       
-
       
            mv --no-target-directory ${wrapperDir}-tmp ${wrapperDir}

     

       
131
       
-
       
            rm --force --recursive $old

     

       
132
       
-
       
          else

     

       
133
       
-
       
            ln --symbolic $wrapperDir ${wrapperDir}

     

       
134
       
-
       
          fi

     

       
135
       
 
       
        '';

     

       
136
       
 
       


     

       
137
       
 
       
  };

     

···

       
102
       
 
       
                source=/nix/var/nix/profiles/default/bin/${program}

     

       
103
       
 
       
            fi

     

       
104
       
 
       


     

       
105
       
+
       
            cp ${setuidWrapper}/bin/setuid-wrapper ${wrapperDir}/${program}

     

       
106
       
+
       
            echo -n "$source" > ${wrapperDir}/${program}.real

     

       
107
       
+
       
            chmod 0000 ${wrapperDir}/${program} # to prevent races

     

       
108
       
+
       
            chown ${owner}.${group} ${wrapperDir}/${program}

     

       
109
       
+
       
            chmod "u${if setuid then "+" else "-"}s,g${if setgid then "+" else "-"}s,${permissions}" ${wrapperDir}/${program}

     

       
110
       
 
       
          '';

     

       
111
       
 
       


     

       
112
       
 
       
      in stringAfter [ "users" ]

     
···

       
115
       
 
       
          # programs to be wrapped.

     

       
116
       
 
       
          SETUID_PATH=${config.system.path}/bin:${config.system.path}/sbin

     

       
117
       
 
       


     

       
118
       
+
       
          rm -f ${wrapperDir}/* # */

     

       
0
       
 
       

     

       
119
       
 
       


     

       
120
       
 
       
          ${concatMapStrings makeSetuidWrapper setuidPrograms}

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
121
       
 
       
        '';

     

       
122
       
 
       


     

       
123
       
 
       
  };