public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

start on sandbox stuff

Browse Source
This commit is contained in:
Jude Taylor
2015-11-19 11:31:06 -08:00
parent c296f64f19
commit 914e9baefe
13 changed files with 251 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/stdenv/generic/default.nix
+13 -13
View File
@@ -12,6 +12,8 @@ let lib = import ../../../lib; in lib.makeOverridable (
, extraBuildInputs ? []
, __stdenvImpureHostDeps ? []
, __extraImpureHostDeps ? []
, __stdenvSandboxProfile ? ""
, __extraSandboxProfile ? ""
}:
let
@@ -100,6 +102,8 @@ let
, outputs ? [ "out" ]
, __impureHostDeps ? []
, __propagatedImpureHostDeps ? []
, __sandboxProfile ? ""
, __propagatedSandboxProfile ? ""
, ... } @ attrs:
let
pos' =
@@ -149,13 +153,14 @@ let
lib.addPassthru (derivation (
(removeAttrs attrs
["meta" "passthru" "crossAttrs" "pos"
"__impureHostDeps" "__propagatedImpureHostDeps"])
"__impureHostDeps" "__propagatedImpureHostDeps"
"__sandboxProfile" "__propagatedSandboxProfile"])
// (let
# TODO: remove lib.unique once nix has a list canonicalization primitive
computedImpureHostDeps =
lib.unique (lib.concatMap (input: input.__propagatedImpureHostDeps or []) (extraBuildInputs ++ buildInputs ++ nativeBuildInputs));
computedPropagatedImpureHostDeps =
lib.unique (lib.concatMap (input: input.__propagatedImpureHostDeps or []) (propagatedBuildInputs ++ propagatedNativeBuildInputs));
computedSandboxProfile =
lib.concatStrings (lib.unique (builtins.map (input: input.__propagatedSandboxProfile or "") (extraBuildInputs ++ buildInputs ++ nativeBuildInputs)));
computedPropagatedSandboxProfile =
lib.concatStrings (lib.unique (builtins.map (input: input.__propagatedSandboxProfile or "") (propagatedBuildInputs ++ propagatedNativeBuildInputs)));
in
{
builder = attrs.realBuilder or shell;
@@ -173,13 +178,8 @@ let
propagatedNativeBuildInputs = propagatedNativeBuildInputs ++
(if crossConfig == null then propagatedBuildInputs else []);
} // ifDarwin {
__impureHostDeps = computedImpureHostDeps ++ computedPropagatedImpureHostDeps ++ __propagatedImpureHostDeps ++ __impureHostDeps ++ __extraImpureHostDeps ++ [
"/dev/zero"
"/dev/random"
"/dev/urandom"
"/bin/sh"
];
__propagatedImpureHostDeps = computedPropagatedImpureHostDeps ++ __propagatedImpureHostDeps;
__sandboxProfile = computedSandboxProfile + computedPropagatedSandboxProfile + __propagatedSandboxProfile + __sandboxProfile + __extraSandboxProfile;
__propagatedSandboxProfile = computedPropagatedSandboxProfile + __propagatedSandboxProfile;
} // (if outputs' != [ "out" ] then {
outputs = outputs';
} else { })))) (
@@ -216,7 +216,7 @@ let
inherit preHook initialPath shell defaultNativeBuildInputs;
}
// ifDarwin {
__impureHostDeps = __stdenvImpureHostDeps;
__sandboxProfile = __stdenvSandboxProfile;
})
// rec {
pkgs/stdenv/pure-darwin/default.nix
+24 -22
View File
@@ -5,18 +5,7 @@
}:
let
# libSystem and its transitive dependencies. Get used to this; it's a recurring theme in darwin land
libSystemClosure = [
"/usr/lib/libSystem.dylib"
"/usr/lib/libSystem.B.dylib"
"/usr/lib/libobjc.A.dylib"
"/usr/lib/libobjc.dylib"
"/usr/lib/libauto.dylib"
"/usr/lib/libc++abi.dylib"
"/usr/lib/libc++.1.dylib"
"/usr/lib/libDiagnosticMessagesClient.dylib"
"/usr/lib/system"
];
libSystemProfile = builtins.readFile ./standard-sandbox.sb;
fetch = { file, sha256, executable ? true }: import <nix/fetchurl.nix> {
url = "http://tarballs.nixos.org/stdenv-darwin/x86_64/4f07c88d467216d9692fefc951deb5cd3c4cc722/${file}";
@@ -46,7 +35,9 @@ in rec {
'';
# The one dependency of /bin/sh :(
binShClosure = [ "/usr/lib/libncurses.5.4.dylib" ];
binShClosure = ''
(allow file-read* (literal "/usr/lib/libncurses.5.4.dylib"))
'';
bootstrapTools = derivation rec {
inherit system tarball;
@@ -57,7 +48,7 @@ in rec {
inherit (bootstrapFiles) mkdir bzip2 cpio;
__impureHostDeps = binShClosure ++ libSystemClosure;
__sandboxProfile = binShClosure + libSystemProfile;
};
stageFun = step: last: {shell ? "${bootstrapTools}/bin/sh",
@@ -100,8 +91,8 @@ in rec {
};
# The stdenvs themselves don't use mkDerivation, so I need to specify this here
__stdenvImpureHostDeps = binShClosure ++ libSystemClosure;
__extraImpureHostDeps = binShClosure ++ libSystemClosure;
__stdenvSandboxProfile = binShClosure + libSystemProfile;
__extraSandboxProfile = binShClosure + libSystemProfile;
extraAttrs = { inherit platform; };
overrides = pkgs: (overrides pkgs) // { fetchurl = thisStdenv.fetchurlBoot; };
@@ -178,10 +169,14 @@ in rec {
};
stage2 = with stage1; stageFun 2 stage1 {
extraPreHook = ''
export PATH_LOCALE=${pkgs.darwin.locale}/share/locale
'';
allowedRequisites =
[ bootstrapTools ] ++
(with pkgs; [ xz libcxx libcxxabi icu ]) ++
(with pkgs.darwin; [ dyld Libsystem CF ]);
(with pkgs.darwin; [ dyld Libsystem CF locale ]);
overrides = persistent1;
};
@@ -196,7 +191,7 @@ in rec {
darwin = orig.darwin // {
inherit (darwin)
dyld Libsystem xnu configd libdispatch libclosure launchd libiconv;
dyld Libsystem xnu configd libdispatch libclosure launchd libiconv locale;
};
};
@@ -209,10 +204,14 @@ in rec {
# patches our shebangs back to point at bootstrapTools. This makes sure bash comes first.
extraInitialPath = [ pkgs.bash ];
extraPreHook = ''
export PATH_LOCALE=${pkgs.darwin.locale}/share/locale
'';
allowedRequisites =
[ bootstrapTools ] ++
(with pkgs; [ icu bash libcxx libcxxabi ]) ++
(with pkgs.darwin; [ dyld Libsystem ]);
(with pkgs.darwin; [ dyld Libsystem locale ]);
overrides = persistent2;
};
@@ -230,13 +229,16 @@ in rec {
};
darwin = orig.darwin // {
inherit (darwin) dyld Libsystem libiconv;
inherit (darwin) dyld Libsystem libiconv locale;
};
};
stage4 = with stage3; stageFun 4 stage3 {
shell = "${pkgs.bash}/bin/bash";
extraInitialPath = [ pkgs.bash ];
extraPreHook = ''
export PATH_LOCALE=${pkgs.darwin.locale}/share/locale
'';
overrides = persistent3;
};
@@ -263,8 +265,8 @@ in rec {
preHook = commonPreHook;
__stdenvImpureHostDeps = binShClosure ++ libSystemClosure;
__extraImpureHostDeps = binShClosure ++ libSystemClosure;
__stdenvSandboxProfile = binShClosure + libSystemProfile;
__extraSandboxProfile = binShClosure + libSystemProfile;
initialPath = import ../common-path.nix { inherit pkgs; };
shell = "${pkgs.bash}/bin/bash";
pkgs/stdenv/pure-darwin/standard-sandbox.sb
+65
View File
@@ -0,0 +1,65 @@
(define TMPDIR (param "_GLOBAL_TMP_DIR"))
; obvious
(allow process-fork)
; allow reading system information like #CPUs, etc.
(allow sysctl-read)
; IPC
(allow ipc-posix-sem)
; Unix sockets
(allow system-socket)
; all runtime dependencies of libSystem.dylib
(allow file-read*
(literal "/usr/lib/libSystem.dylib")
(literal "/usr/lib/libSystem.B.dylib")
(literal "/usr/lib/libobjc.A.dylib")
(literal "/usr/lib/libobjc.dylib")
(literal "/usr/lib/libauto.dylib")
(literal "/usr/lib/libc++abi.dylib")
(literal "/usr/lib/libc++.1.dylib")
(literal "/usr/lib/libDiagnosticMessagesClient.dylib")
(subpath "/usr/lib/system"))
; tmp
(allow file* process-exec (literal "/tmp") (subpath TMPDIR))
; clang likes to read the system version
(allow file-read* (literal "/System/Library/CoreServices/SystemVersion.plist"))
; used for bootstrap builders
(allow process-exec* (literal "/bin/sh"))
; standard devices
(allow file*
(literal "/dev/null")
(literal "/dev/random")
(literal "/dev/stdin")
(literal "/dev/stdout")
(literal "/dev/tty")
(literal "/dev/urandom")
(literal "/dev/zero")
(subpath "/dev/fd"))
; does nothing, but reduces build noise
(allow file* (literal "/dev/dtracehelper"))
; ICU data and zoneinfo data are hardcoded
; both are in libicucore and zoneinfo is in libsystem_c as well
(allow file-read* (subpath "/usr/share/icu") (subpath "/usr/share/zoneinfo"))
; lots of autoconf projects want to list this directory
(allow file-read-metadata (literal "/var") (literal "/private/var/tmp"))
; mute annoying failures
(deny file-read-metadata (with no-log)
(literal "/etc")
(subpath "/usr/bin"))
(deny process-exec* (with no-log)
(literal "/usr/bin/arch")
(literal "/usr/bin/hostinfo")
(literal "/usr/bin/uname"))