foodogsquared/nixos-config
1
0
Fork 0
mirror of https://github.com/foo-dogsquared/nixos-config.git synced 2025-01-31 04:58:01 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

wrapper-manager/sandboxing/bubblewrap: fix escaping arguments and launcher

Browse Source 
The makeWrapper arguments are not escaped anymore for the binary wrapper
that automatically does this anyways.
This commit is contained in:
Gabriel Arazas 2024-08-12 15:34:23 +08:00
parent 11e2ae7e33
commit 11e7d52350
No known key found for this signature in database
GPG Key ID: 62104B43D00AA360
3 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
modules/wrapper-manager/sandboxing/bubblewrap/default.nix
View File

@ -89,9 +89,9 @@ in
if metadata.action == "unset" then
"--unsetenv ${var}"
else if lib.elem metadata.action [ "prefix" "suffix" ] then
"--setenv ${lib.escapeShellArg var} ${lib.escapeShellArg (lib.concatStringsSep metadata.separator metadata.value)}"
"--setenv ${var} ${lib.concatStringsSep metadata.separator metadata.value}"
else
"--setenv ${lib.escapeShellArg var} ${lib.escapeShellArg metadata.value}")
"--setenv ${var} ${metadata.value}")
env';
}

6
modules/wrapper-manager/sandboxing/bubblewrap/filesystem.nix
View File

@ -219,8 +219,8 @@ in
let
makeFilesystemArgs = _: metadata:
let
src = lib.escapeShellArg metadata.source;
dst = lib.escapeShellArg metadata.destination;
src = metadata.source;
dst = metadata.destination;
hasPermissions = metadata.permissions != null;
isValidOperationWithPerms = lib.elem metadata.operation fileOperationsWithPerms;
in
@ -246,7 +246,7 @@ in
let
closurePaths = getClosurePaths submoduleCfg.sharedNixPaths;
in
builtins.map (p: "--ro-bind ${lib.escapeShellArg p} ${lib.escapeShellArg p}") closurePaths;
builtins.map (p: "--ro-bind ${p} ${p}") closurePaths;
})
]);
};

2
modules/wrapper-manager/sandboxing/bubblewrap/launcher/app.sh
View File

@ -51,7 +51,7 @@ case "$(uname)" in
for sysfs_dir in /sys/{block,bus,class,dev,devices}; do
if [[ -r "$sysfs_dir" ]] && [[ -x "$sysfs_dir" ]]; then
additional_flags+=(--ro-bind "${sysfs_dir}")
additional_flags+=(--ro-bind "${sysfs_dir}" "${sysfs_dir}")
fi
done
;;