Merge branch 'staging', containing closure-size #7701

nixos/modules/security/apparmor-suid.nix

@@ -28,9 +28,9 @@ with lib;
         capability setuid,
         network inet raw,
 
-        ${pkgs.glibc}/lib/*.so mr,
-        ${pkgs.libcap}/lib/libcap.so* mr,
-        ${pkgs.attr}/lib/libattr.so* mr,
+        ${pkgs.glibc.out}/lib/*.so mr,
+        ${pkgs.libcap.out}/lib/libcap.so* mr,
+        ${pkgs.attr.out}/lib/libattr.so* mr,
 
         ${pkgs.iputils}/bin/ping mixr,
         /var/setuid-wrappers/ping.real r,

nixos/modules/security/polkit.nix

@@ -59,9 +59,9 @@ in
 
   config = mkIf cfg.enable {
 
-    environment.systemPackages = [ pkgs.polkit ];
+    environment.systemPackages = [ pkgs.polkit.bin pkgs.polkit.out ];
 
-    systemd.packages = [ pkgs.polkit ];
+    systemd.packages = [ pkgs.polkit.out ];
 
     systemd.services.polkit.restartTriggers = [ config.system.path ];
     systemd.services.polkit.unitConfig.X-StopIfChanged = false;
@@ -79,7 +79,7 @@ in
         ${cfg.extraConfig}
       ''; #TODO: validation on compilation (at least against typos)
 
-    services.dbus.packages = [ pkgs.polkit ];
+    services.dbus.packages = [ pkgs.polkit.out ];
 
     security.pam.services.polkit-1 = {};
 
@@ -90,7 +90,7 @@ in
         owner = "root";
         group = "root";
         setuid = true;
-        source = "${pkgs.polkit}/lib/polkit-1/polkit-agent-helper-1";
+        source = "${pkgs.polkit.out}/lib/polkit-1/polkit-agent-helper-1";
       }
     ];
 

nixos/modules/security/setuid-wrappers.nix

@@ -8,12 +8,12 @@ let
 
   setuidWrapper = pkgs.stdenv.mkDerivation {
     name = "setuid-wrapper";
-    buildCommand = ''
+    unpackPhase = "true";
+    installPhase = ''
       mkdir -p $out/bin
       cp ${./setuid-wrapper.c} setuid-wrapper.c
       gcc -Wall -O2 -DWRAPPER_DIR=\"${wrapperDir}\" \
           setuid-wrapper.c -o $out/bin/setuid-wrapper
-      strip -S $out/bin/setuid-wrapper
     '';
   };