Merge pull request #18365 from NixOS/fix-sshd-failure

Make /var/empty immutable (with chattr +i)

nixos/modules/system/activation/activation-script.nix

@@ -12,11 +12,13 @@ let
     '';
   });
 
-  path = map getBin
+  path = with pkgs; map getBin
-    [ pkgs.coreutils pkgs.gnugrep pkgs.findutils
+    [ coreutils
-      pkgs.glibc # needed for getent
+      gnugrep
-      pkgs.shadow
+      findutils
-      pkgs.nettools # needed for hostname
+      glibc # needed for getent
+      shadow
+      nettools # needed for hostname
     ];
 
 in
@@ -137,8 +139,13 @@ in
 
         mkdir -m 1777 -p /var/tmp
 
-        # Empty, read-only home directory of many system accounts.
+        # Empty, immutable home directory of many system accounts.
-        mkdir -m 0555 -p /var/empty
+        mkdir -p /var/empty
+        # Make sure it's really empty
+        ${pkgs.e2fsprogs}/bin/chattr -i /var/empty
+        find /var/empty -mindepth 1 -delete
+        chmod 0555 /var/empty
+        ${pkgs.e2fsprogs}/bin/chattr +i /var/empty
       '';
 
     system.activationScripts.usrbinenv = if config.environment.usrbinenv != null