commit f6d9b4b6fc7f376e5f5ecacace951f57c155045c · pyrox.dev/nixpkgs

+20 -5

nixos/modules/programs/singularity.nix

···

       56
        
           enableFakeroot = lib.mkOption {

     

       57
        
             type = lib.types.bool;

     

       58
        
             default = true;

     

       59
       -
             example = false;

     

       60
        
             description = ''

     

       61
        
               Whether to enable the `--fakeroot` support of Singularity/Apptainer.

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       62
        
             '';

     

       63
        
           };

     

       64
        
           enableSuid = lib.mkOption {

     
···

       74
        
               Whether to enable the SUID support of Singularity/Apptainer.

     

       75
        
             '';

     

       76
        
           };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       77
        
         };

     

       78
        
       

     

       79
        
         config = lib.mkIf cfg.enable {

     

       80
        
           programs.singularity.packageOverriden = (

     

       81
        
             cfg.package.override (

     

       82
       -
               lib.optionalAttrs cfg.enableExternalLocalStateDir { externalLocalStateDir = "/var/lib"; }

     

       83
       -
               // lib.optionalAttrs cfg.enableFakeroot {

     

       84
       -
                 newuidmapPath = "/run/wrappers/bin/newuidmap";

     

       85
       -
                 newgidmapPath = "/run/wrappers/bin/newgidmap";

     

       86
        
               }

     

       0
        
       
     

       87
        
               // lib.optionalAttrs cfg.enableSuid {

     

       88
        
                 enableSuid = true;

     

       89
        
                 starterSuidPath = "/run/wrappers/bin/${cfg.package.projectName}-suid";

     

       90
        
               }

     

       91
        
             )

     

       92
        
           );

     

       0
        
       
     

       93
        
           environment.systemPackages = [ cfg.packageOverriden ];

     

       94
        
           security.wrappers."${cfg.packageOverriden.projectName}-suid" = lib.mkIf cfg.enableSuid {

     

       95
        
             setuid = true;

···

       56
        
           enableFakeroot = lib.mkOption {

     

       57
        
             type = lib.types.bool;

     

       58
        
             default = true;

     

       0
        
       
     

       59
        
             description = ''

     

       60
        
               Whether to enable the `--fakeroot` support of Singularity/Apptainer.

     

       61
       +
       

     

       62
       +
               This option is deprecated and has no effect.

     

       63
       +
               `--fakeroot` support is enabled automatically,

     

       64
       +
               as `systemBinPaths = [ "/run/wrappers/bin" ]` is always specified.

     

       65
        
             '';

     

       66
        
           };

     

       67
        
           enableSuid = lib.mkOption {

     
···

       77
        
               Whether to enable the SUID support of Singularity/Apptainer.

     

       78
        
             '';

     

       79
        
           };

     

       80
       +
           systemBinPaths = lib.mkOption {

     

       81
       +
             type = lib.types.listOf lib.types.path;

     

       82
       +
             default = [ ];

     

       83
       +
             description = ''

     

       84
       +
               (Extra) system-wide /**/bin paths

     

       85
       +
               for Apptainer/Singularity to find command-line utilities in.

     

       86
       +
       

     

       87
       +
               `"/run/wrappers/bin"` is included by default to make

     

       88
       +
               utilities with SUID bit set available to Apptainer/Singularity.

     

       89
       +
               Use `lib.mkForce` to shadow the default values.

     

       90
       +
             '';

     

       91
       +
           };

     

       92
        
         };

     

       93
        
       

     

       94
        
         config = lib.mkIf cfg.enable {

     

       95
        
           programs.singularity.packageOverriden = (

     

       96
        
             cfg.package.override (

     

       97
       +
               {

     

       98
       +
                 systemBinPaths = cfg.systemBinPaths;

     

       0
        
       
     

       0
        
       
     

       99
        
               }

     

       100
       +
               // lib.optionalAttrs cfg.enableExternalLocalStateDir { externalLocalStateDir = "/var/lib"; }

     

       101
        
               // lib.optionalAttrs cfg.enableSuid {

     

       102
        
                 enableSuid = true;

     

       103
        
                 starterSuidPath = "/run/wrappers/bin/${cfg.package.projectName}-suid";

     

       104
        
               }

     

       105
        
             )

     

       106
        
           );

     

       107
       +
           programs.singularity.systemBinPaths = [ "/run/wrappers/bin" ];

     

       108
        
           environment.systemPackages = [ cfg.packageOverriden ];

     

       109
        
           security.wrappers."${cfg.packageOverriden.projectName}-suid" = lib.mkIf cfg.enableSuid {

     

       110
        
             setuid = true;

+24 -7

pkgs/applications/virtualization/singularity/generic.nix

···

       70
        
         # Whether to compile with SUID support

     

       71
        
         enableSuid ? false,

     

       72
        
         starterSuidPath ? null,

     

       73
       -
         # newuidmapPath and newgidmapPath are to support --fakeroot

     

       74
       -
         # where those SUID-ed executables are unavailable from the FHS system PATH.

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       75
        
         # Path to SUID-ed newuidmap executable

     

       0
        
       
     

       0
        
       
     

       76
        
         newuidmapPath ? null,

     

       77
        
         # Path to SUID-ed newgidmap executable

     

       0
        
       
     

       0
        
       
     

       78
        
         newgidmapPath ? null,

     

       79
        
         # External LOCALSTATEDIR

     

       80
        
         externalLocalStateDir ? null,

     
···

       99
        
         vendorHash ? _defaultGoVendorArgs.vendorHash,

     

       100
        
         deleteVendor ? _defaultGoVendorArgs.deleteVendor,

     

       101
        
         proxyVendor ? _defaultGoVendorArgs.proxyVendor,

     

       102
       -
       }:

     

       103
        
       

     

       104
        
       let

     

       0
        
       
     

       0
        
       
     

       105
        
         privileged-un-utils =

     

       106
        
           if ((newuidmapPath == null) && (newgidmapPath == null)) then

     

       107
        
             null

     

       108
        
           else

     

       109
       -
             (runCommandLocal "privileged-un-utils" { } ''

     

       110
        
               mkdir -p "$out/bin"

     

       111
        
               ln -s ${lib.escapeShellArg newuidmapPath} "$out/bin/newuidmap"

     

       112
        
               ln -s ${lib.escapeShellArg newgidmapPath} "$out/bin/newgidmap"

     

       113
       -
             '');

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       114
        
       

     

       115
        
         concatMapStringAttrsSep =

     

       116
        
           sep: f: attrs:

     
···

       207
        
           fuse2fs # Mount ext3 filesystems

     

       208
        
           go

     

       209
        
           mount # mount

     

       210
       -
           privileged-un-utils

     

       211
        
           squashfsTools # mksquashfs unsquashfs # Make / unpack squashfs image

     

       212
        
           squashfuse # squashfuse_ll squashfuse # Mount (without unpacking) a squashfs image without privileges

     

       213
        
         ] ++ lib.optional enableNvidiaContainerCli nvidia-docker;

     
···

       229
        
                   lib.concatStringsSep " " [

     

       230
        
                     "--replace-fail"

     

       231
        
                     (addShellDoubleQuotes (lib.escapeShellArg originalDefaultPath))

     

       232
       -
                     (addShellDoubleQuotes ''${lib.escapeShellArg originalDefaultPath}''${inputsDefaultPath:+:}$inputsDefaultPath'')

     

       233
        
                   ]

     

       234
        
                 ) originalDefaultPaths

     

       235
        
               }

     
···

       271
        
           # Respect PATH from the environment/the user.

     

       272
        
           # Fallback to bin paths provided by Nixpkgs packages.

     

       273
        
           wrapProgram "$out/bin/${projectName}" \

     

       0
        
       
     

       274
        
             --suffix PATH : "$inputsDefaultPath"

     

       275
        
           # Make changes in the config file

     

       276
        
           ${lib.optionalString forceNvcCli ''

     
···

       329
        
       }).overrideAttrs

     

       330
        
         (

     

       331
        
           finalAttrs: prevAttrs: {

     

       0
        
       
     

       332
        
             inputsDefaultPath = lib.makeBinPath finalAttrs.defaultPathInputs;

     

       333
        
             passthru = prevAttrs.passthru or { } // {

     

       334
        
               inherit sourceFilesWithDefaultPaths;

···

       70
        
         # Whether to compile with SUID support

     

       71
        
         enableSuid ? false,

     

       72
        
         starterSuidPath ? null,

     

       73
       +
         # Extra system-wide /**/bin paths to prefix,

     

       74
       +
         # useful to specify directories containing binaries with SUID bit set.

     

       75
       +
         # The paths take higher precedence over the FHS system PATH specified

     

       76
       +
         # inside the upstream source code.

     

       77
       +
         # Include "/run/wrappers/bin" by default for the convenience of NixOS users.

     

       78
       +
         systemBinPaths ? [ "/run/wrappers/bin" ],

     

       79
        
         # Path to SUID-ed newuidmap executable

     

       80
       +
         # Deprecated in favour of systemBinPaths

     

       81
       +
         # TODO(@ShamrockLee): Remove after Nixpkgs 24.05 branch-off

     

       82
        
         newuidmapPath ? null,

     

       83
        
         # Path to SUID-ed newgidmap executable

     

       84
       +
         # Deprecated in favour of systemBinPaths

     

       85
       +
         # TODO(@ShamrockLee): Remove after Nixpkgs 24.05 branch-off

     

       86
        
         newgidmapPath ? null,

     

       87
        
         # External LOCALSTATEDIR

     

       88
        
         externalLocalStateDir ? null,

     
···

       107
        
         vendorHash ? _defaultGoVendorArgs.vendorHash,

     

       108
        
         deleteVendor ? _defaultGoVendorArgs.deleteVendor,

     

       109
        
         proxyVendor ? _defaultGoVendorArgs.proxyVendor,

     

       110
       +
       }@args:

     

       111
        
       

     

       112
        
       let

     

       113
       +
         # Backward compatibility for privileged-un-utils.

     

       114
       +
         # TODO(@ShamrockLee): Remove after Nixpkgs 24.05 branch-off.

     

       115
        
         privileged-un-utils =

     

       116
        
           if ((newuidmapPath == null) && (newgidmapPath == null)) then

     

       117
        
             null

     

       118
        
           else

     

       119
       +
             runCommandLocal "privileged-un-utils" { } ''

     

       120
        
               mkdir -p "$out/bin"

     

       121
        
               ln -s ${lib.escapeShellArg newuidmapPath} "$out/bin/newuidmap"

     

       122
        
               ln -s ${lib.escapeShellArg newgidmapPath} "$out/bin/newgidmap"

     

       123
       +
             '';

     

       124
       +
       

     

       125
       +
         # Backward compatibility for privileged-un-utils.

     

       126
       +
         # TODO(@ShamrockLee): Remove after Nixpkgs 24.05 branch-off.

     

       127
       +
         systemBinPaths =

     

       128
       +
           lib.optional (privileged-un-utils != null) (lib.makeBinPath [ privileged-un-utils ])

     

       129
       +
           ++ args.systemBinPaths or [ "/run/wrappers/bin" ];

     

       130
        
       

     

       131
        
         concatMapStringAttrsSep =

     

       132
        
           sep: f: attrs:

     
···

       223
        
           fuse2fs # Mount ext3 filesystems

     

       224
        
           go

     

       225
        
           mount # mount

     

       0
        
       
     

       226
        
           squashfsTools # mksquashfs unsquashfs # Make / unpack squashfs image

     

       227
        
           squashfuse # squashfuse_ll squashfuse # Mount (without unpacking) a squashfs image without privileges

     

       228
        
         ] ++ lib.optional enableNvidiaContainerCli nvidia-docker;

     
···

       244
        
                   lib.concatStringsSep " " [

     

       245
        
                     "--replace-fail"

     

       246
        
                     (addShellDoubleQuotes (lib.escapeShellArg originalDefaultPath))

     

       247
       +
                     (addShellDoubleQuotes ''$systemDefaultPath''${systemDefaultPath:+:}${lib.escapeShellArg originalDefaultPath}''${inputsDefaultPath:+:}$inputsDefaultPath'')

     

       248
        
                   ]

     

       249
        
                 ) originalDefaultPaths

     

       250
        
               }

     
···

       286
        
           # Respect PATH from the environment/the user.

     

       287
        
           # Fallback to bin paths provided by Nixpkgs packages.

     

       288
        
           wrapProgram "$out/bin/${projectName}" \

     

       289
       +
             --suffix PATH : "$systemDefaultPath" \

     

       290
        
             --suffix PATH : "$inputsDefaultPath"

     

       291
        
           # Make changes in the config file

     

       292
        
           ${lib.optionalString forceNvcCli ''

     
···

       345
        
       }).overrideAttrs

     

       346
        
         (

     

       347
        
           finalAttrs: prevAttrs: {

     

       348
       +
             systemDefaultPath = lib.concatStringsSep ":" systemBinPaths;

     

       349
        
             inputsDefaultPath = lib.makeBinPath finalAttrs.defaultPathInputs;

     

       350
        
             passthru = prevAttrs.passthru or { } // {

     

       351
        
               inherit sourceFilesWithDefaultPaths;