Add --with-sandbox-shell configure flag

And add a 116 KiB ash shell from busybox to the release build. This
helps to make sandbox builds work out of the box on non-NixOS systems
and with diverted stores.
This commit is contained in:
Eelco Dolstra 2017-05-15 17:30:33 +02:00
parent b30f5784d0
commit a2d92bb20e
No known key found for this signature in database
GPG key ID: 8170B4726D7198DE
7 changed files with 38 additions and 12 deletions

View file

@ -28,6 +28,7 @@ localstatedir = @localstatedir@
mandir = @mandir@
pkglibdir = $(libdir)/$(PACKAGE_NAME)
prefix = @prefix@
sandbox_shell = @sandbox_shell@
storedir = @storedir@
sysconfdir = @sysconfdir@
doc_generate = @doc_generate@

View file

@ -240,6 +240,12 @@ fi
AC_SUBST(tarFlags)
AC_ARG_WITH(sandbox-shell, AC_HELP_STRING([--with-sandbox-shell=PATH],
[path of a statically-linked shell to use as /bin/sh in sandboxes]),
sandbox_shell=$withval)
AC_SUBST(sandbox_shell)
# Expand all variables in config.status.
test "$prefix" = NONE && prefix=$ac_default_prefix
test "$exec_prefix" = NONE && exec_prefix='${prefix}'

21
release-common.nix Normal file
View file

@ -0,0 +1,21 @@
{ pkgs }:
rec {
sh = pkgs.busybox.override {
useMusl = true;
enableStatic = true;
enableMinimal = true;
extraConfig = ''
CONFIG_ASH y
CONFIG_ASH_BUILTIN_ECHO y
CONFIG_ASH_BUILTIN_TEST y
CONFIG_ASH_OPTIMIZE_FOR_SIZE y
'';
};
configureFlags =
[ "--disable-init-state"
"--enable-gc"
"--with-sandbox-shell=${sh}/bin/busybox"
];
}

View file

@ -66,6 +66,8 @@ let
with import <nixpkgs> { inherit system; };
with import ./release-common.nix { inherit pkgs; };
releaseTools.nixBuild {
name = "nix";
src = tarball;
@ -83,11 +85,8 @@ let
customMemoryManagement = false;
});
configureFlags = ''
--disable-init-state
--enable-gc
--sysconfdir=/etc
'';
configureFlags = configureFlags ++
[ "--sysconfdir=/etc" ];
enableParallelBuilding = true;

View file

@ -2,6 +2,8 @@
with import <nixpkgs> {};
with import ./release-common.nix { inherit pkgs; };
(if useClang then clangStdenv else stdenv).mkDerivation {
name = "nix";
@ -22,10 +24,7 @@ with import <nixpkgs> {};
perlPackages.DBDSQLite
];
configureFlags =
[ "--disable-init-state"
"--enable-gc"
];
inherit configureFlags;
enableParallelBuilding = true;

View file

@ -47,8 +47,8 @@ Settings::Settings()
auto s = getEnv("NIX_REMOTE_SYSTEMS");
if (s != "") builderFiles = tokenizeString<Strings>(s, ":");
#if __linux__
sandboxPaths = tokenizeString<StringSet>("/bin/sh=" BASH_PATH);
#if defined(__linux__) && defined(SANDBOX_SHELL)
sandboxPaths = tokenizeString<StringSet>("/bin/sh=" SANDBOX_SHELL);
#endif
allowedImpureHostPrefixes = tokenizeString<StringSet>(DEFAULT_ALLOWED_IMPURE_PREFIXES);

View file

@ -27,7 +27,7 @@ libstore_CXXFLAGS = \
-DNIX_CONF_DIR=\"$(sysconfdir)/nix\" \
-DNIX_LIBEXEC_DIR=\"$(libexecdir)\" \
-DNIX_BIN_DIR=\"$(bindir)\" \
-DBASH_PATH="\"$(bash)\"" \
-DSANDBOX_SHELL="\"$(sandbox_shell)\"" \
-DLSOF=\"$(lsof)\"
$(d)/local-store.cc: $(d)/schema.sql.hh