foodogsquared/nixos-config
1
0
Fork 0
mirror of https://github.com/foo-dogsquared/nixos-config.git synced 2025-04-25 18:19:10 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

wrapper-manager/sandboxing/bubblewrap: update closure path mount binds

Browse Source 
It could be done by removing the string context but it is more tedious
to maintain in the long run so it would be best to have them separate.
This commit is contained in:
Gabriel Arazas 2024-08-06 11:06:28 +08:00
parent c127b79eb1
commit 7524d87b49
No known key found for this signature in database
GPG Key ID: 62104B43D00AA360
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
modules/wrapper-manager/sandboxing/bubblewrap/filesystem.nix
View File

@ -173,12 +173,12 @@ let
# TODO: There has to be a better way to get this info without relying on # TODO: There has to be a better way to get this info without relying on
# pkgs.closureInfo builder, right? # pkgs.closureInfo builder, right?
getClosurePaths = rootpaths: getClosurePaths = rootPaths:
let let
sharedNixPathsClosureInfo = pkgs.closureInfo { inherit rootpaths; }; sharedNixPathsClosureInfo = pkgs.closureInfo { inherit rootPaths; };
closurePaths = lib.readFile "${sharedNixPathsClosureInfo}/store-paths"; closurePaths = lib.readFile "${sharedNixPathsClosureInfo}/store-paths";
in in
lib.lists.filter (p: p != "") (lib.splitStrings "\n" closurePaths); lib.lists.filter (p: p != "") (lib.splitString "\n" closurePaths);
in in
{ {
options.sandboxing.bubblewrap = bubblewrapModuleFactory { isGlobal = true; }; options.sandboxing.bubblewrap = bubblewrapModuleFactory { isGlobal = true; };
@ -198,7 +198,6 @@ in
} }
{ {
sandboxing.bubblewrap.binds.ro = getClosurePaths submoduleCfg.sharedNixPaths;
sandboxing.bubblewrap.filesystem = sandboxing.bubblewrap.filesystem =
let let
renameNixStorePaths = path: renameNixStorePaths = path:
@ -241,6 +240,14 @@ in
(lib.mkIf submoduleCfg.enableSharedNixStore { (lib.mkIf submoduleCfg.enableSharedNixStore {
sandboxing.bubblewrap.binds.ro = [ builtins.storeDir ] ++ lib.optionals (builtins.storeDir != "/nix/store") [ "/nix/store" ]; sandboxing.bubblewrap.binds.ro = [ builtins.storeDir ] ++ lib.optionals (builtins.storeDir != "/nix/store") [ "/nix/store" ];
}) })
(lib.mkIf (submoduleCfg.sharedNixPaths != [ ]) {
sandboxing.bubblewrap.extraArgs =
let
closurePaths = getClosurePaths submoduleCfg.sharedNixPaths;
in
builtins.map (p: "--ro-bind ${lib.escapeShellArg p} ${lib.escapeShellArg p}") closurePaths;
})
]); ]);
}; };
in in