commit d8ecd5eb0d30c3dc302e336755a4a1d6d0cb1ba4 · pyrox.dev/nixpkgs

+26 -20
nixos/modules/security/wrappers/default.nix
···

       8
       8
        
             (n: v: (if v ? "program" then v else v // {program=n;}))

     

       9
       9
        
             wrappers);

     

       10
       10
        
       

     

       11
       11
       -
         mkWrapper = { program, source ? null, ...}: ''

     

       12
       12
       -
           parentWrapperDir=$(dirname ${wrapperDir})

     

       13
       13
       -
           gcc -Wall -O2 -DSOURCE_PROG=\"${source}\" -DWRAPPER_DIR=\"$parentWrapperDir\" \

     

       14
       14
       -
               -lcap-ng -lcap ${./wrapper.c} -o $out/bin/${program}.wrapper -L ${pkgs.libcap.lib}/lib -L ${pkgs.libcap_ng}/lib \

     

       15
       15
       -
               -I ${pkgs.libcap.dev}/include -I ${pkgs.libcap_ng}/include -I ${pkgs.linuxHeaders}/include

     

       16
       16
       -
         '';

     

       17
       17
       -
       

     

       18
       18
       -
         wrappedPrograms = pkgs.stdenv.mkDerivation {

     

       19
       19
       -
           name         = "permissions-wrapper";

     

       20
       20
       -
           unpackPhase  = "true";

     

       21
       21
       -
           installPhase = ''

     

       22
       22
       -
             mkdir -p $out/bin

     

       23
       23
       -
             ${lib.concatMapStrings mkWrapper programs}

     

       24
       24
       -
           '';

     

       25
       25
       -
         };

     

       11
       11
       +
         mkWrapper = { program, source ? null, ...}:

     

       12
       12
       +
           let buildWrapper = ''

     

       13
       13
       +
                 parentWrapperDir=$(dirname ${wrapperDir})

     

       14
       14
       +
                 gcc -Wall -O2 -DSOURCE_PROG=\"${source}\" -DWRAPPER_DIR=\"$parentWrapperDir\" \

     

       15
       15
       +
                     -Wformat -Wformat-security -Werror=format-security \

     

       16
       16
       +
                     -fstack-protector-strong --param ssp-buffer-size=4 \

     

       17
       17
       +
                     -D_FORTIFY_SOURCE=2 -fPIC \

     

       18
       18
       +
                     -lcap-ng -lcap ${./wrapper.c} -o $out/bin/${program}.wrapper -L ${pkgs.libcap.lib}/lib -L ${pkgs.libcap_ng}/lib \

     

       19
       19
       +
                     -I ${pkgs.libcap.dev}/include -I ${pkgs.libcap_ng}/include -I ${pkgs.linuxHeaders}/include

     

       20
       20
       +
               '';

     

       21
       21
       +
           in pkgs.stdenv.mkDerivation {

     

       22
       22
       +
             name         = "${program}-wrapper";

     

       23
       23
       +
             unpackPhase  = "true";

     

       24
       24
       +
             installPhase = ''

     

       25
       25
       +
               mkdir -p $out/bin

     

       26
       26
       +
               ${buildWrapper}

     

       27
       27
       +
             '';

     

       28
       28
       +
           };

     

       26
       29
        
       

     

       27
       30
        
         ###### Activation script for the setcap wrappers

     

       28
       31
        
         mkSetcapProgram =

     
···

       32
       35
        
           , owner  ? "nobody"

     

       33
       36
        
           , group  ? "nogroup"

     

       34
       37
        
           , ...

     

       35
       35
       -
           }: 

     

       38
       38
       +
           }:

     

       36
       39
        
           assert (lib.versionAtLeast (lib.getVersion config.boot.kernelPackages.kernel) "4.3");

     

       37
       37
       -
           ''

     

       38
       38
       -
             cp ${wrappedPrograms}/bin/${program}.wrapper $wrapperDir/${program}

     

       40
       40
       +
           let wrapperDrv = mkWrapper { inherit program source; };

     

       41
       41
       +
           in ''

     

       42
       42
       +
             cp ${wrapperDrv}/bin/${program}.wrapper $wrapperDir/${program}

     

       39
       43
        
       

     

       40
       44
        
             # Prevent races

     

       41
       45
        
             chmod 0000 $wrapperDir/${program}

     
···

       60
       64
        
           , setgid ? false

     

       61
       65
        
           , permissions ? "u+rx,g+x,o+x"

     

       62
       66
        
           , ...

     

       63
       63
       -
           }: ''

     

       64
       64
       -
             cp ${wrappedPrograms}/bin/${program}.wrapper $wrapperDir/${program}

     

       67
       67
       +
           }:

     

       68
       68
       +
           let wrapperDrv = mkWrapper { inherit program source; };

     

       69
       69
       +
           in ''

     

       70
       70
       +
             cp ${wrapperDrv}/bin/${program}.wrapper $wrapperDir/${program}

     

       65
       71
        
       

     

       66
       72
        
             # Prevent races

     

       67
       73
        
             chmod 0000 $wrapperDir/${program}