Motivation for this change

Enpass is a password manager. Browser extensions in Chrome and Firefox talk to it via websocket, but currently aren't working in NixOS. The issue comes from Enpass looking up the browser process through lsof, with argument the port from the client side (the browser).

Enpass requires lsof to be installed in /usr/bin in order to function correctly. Because the path is hardcoded inside Enpass binary, we try to wrap it in a user fhs compliant environment. Unfortunately this is not sufficient. NixOS uses Linux user namespaces to implement the fhs env, with restricted access to /proc/*/fd/* in particular. This prevents lsof to function fully.

This patch bypasses the restriction by talking to lsof outside of the user namespace via named pipe. The browser extensions for Enpass are now working. However a better fix might be to lessen the restrictions in NixOS user namespaces, if appropriate.

Can somebody help with this ? A way to reproduce is by creating a fhs user environment with nix-shell, running it with this shell.nix in the current directory :

{ pkgs ? import <nixpkgs> {} }:

(pkgs.buildFHSUserEnv {
  name = "test-user-namespacing";
  targetPkgs = pkgs: with pkgs; [ lsof strace ];
}).env

Outside of the namespace, lsof sees Firefox connections :

[guillaume@nixos:~/Downloads]$ lsof -i|grep firefox
firefox    1149 ...

Inside of it it doesn't, strace showing permission denied errors :

[guillaume@nixos:~/Downloads]$ nix-shell shell.nix 
test-user-namespacing-chrootenv:guillaume@nixos:~/Downloads$ lsof -i|grep firefox
test-user-namespacing-chrootenv:guillaume@nixos:~/Downloads$ strace lsof -i 2>&1 |grep /proc/1149/fd
open("/proc/1149/fd", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 4
readlink("/proc/1149/fd/0", 0x7ffec4e23740, 4096) = -1 EACCES (Permission denied)
open("/proc/1149/fdinfo/0", O_RDONLY)   = 5
readlink("/proc/1149/fd/1", 0x7ffec4e23740, 4096) = -1 EACCES (Permission denied)

Things done

• Tested using sandboxing
  (nix.useSandbox on NixOS,
  or option build-use-sandbox in nix.conf
  on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • Linux
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Fits CONTRIBUTING.md.