New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[WIP]nixos/firejail:added program.firejail.firecfg option #64448
Conversation
This pull request has been mentioned on Nix community. There might be relevant details there: https://discourse.nixos.org/t/how-to-chroot-in-builder/3408/1 |
nixos/modules/programs/firejail.nix
Outdated
environment.extraSetup = optionalString cfg.firecfg '' | ||
mkdir tmp | ||
cp -r $out tmp | ||
chroot tmp firecfg |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think chroot could ever work in a Nix builder as it requires root. You might be able to use unshare, however: http://man7.org/linux/man-pages/man1/unshare.1.html
In this cast though, I think it might be best to patch firecfg to support a --prefix
option that it can look in instead of /usr
.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes,it does have a --bindir
option that does exactly that.
However,now it expects a username(see https://github.com/netblue30/firejail/blob/5e09cfb4f901d944c0418fcb041d4e96448028a2/src/firecfg/main.c#L286 )
How do I get the name of the current builder?
Thank you for your contributions.
|
I marked this as stale due to inactivity. → More info |
Motivation for this change
The firecfg program already knows how to wrap the correct comands and desktop files
Things done
Still work in progress
sandbox
innix.conf
on non-NixOS)nix-shell -p nix-review --run "nix-review wip"
./result/bin/
)nix path-info -S
before and after)