Motivation for this change

Recently I had to use a nix-shell that installs setuid wrappers for some package-specific dependencies. Because the security wrapper logic was so deeply embedded in NixOS, I had to use NixOS to make the nix-shell work.

This change allows you to set up security wrappers in your nix-shells with the same functionality as in NixOS. E.g. this should work:

pkgs.stdenv.mkDerivation {
  # ...
  shellHook = ''
    sudo ${pkgs.security-wrappers {
        wrapperDir = toString ./wrappers/bin;
        wrappers = {
          fusermount.source = "${pkgs.fuse}/bin/fusermount";
        };
    }}/bin/setup
    export PATH="${toString ./wrappers/bin}:$PATH"
  '';
}

Or this is how you could build it directly:

nix-build '<nixpkgs>' -A security-wrapper --arg wrappers '{ fusermount.source = "${(import <nixpkgs> {}).fuse}/bin/fusermount"; }' --arg wrapperDir "toString $PWD/wrappers/bin"

Only very minimal tests were done, but it seems to work just fine. If anybody needs it, here you go.

I also made minor changes like quoting all bash variables and removing some legacy code that didn't do anything (WRAPPER_PATH).

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Assured whether relevant documentation is up to date
• Fits CONTRIBUTING.md.