WIP: Fix missing privilege separation directory: /var/empty #15
16
flake.nix
16
flake.nix
|
@ -9,19 +9,13 @@
|
||||||
let
|
let
|
||||||
pkgs = import nixpkgs { system = "x86_64-linux"; };
|
pkgs = import nixpkgs { system = "x86_64-linux"; };
|
||||||
|
|
||||||
patched-not-os = let
|
patched-not-os = pkgs.applyPatches {
|
||||||
remote-patches = [
|
|
||||||
{
|
|
||||||
# Zynq image various fixes and cleanup
|
|
||||||
url = "https://patch-diff.githubusercontent.com/raw/cleverca22/not-os/pull/28.patch";
|
|
||||||
sha256 = "sha256-EnYb95QfwHmUHfbCT9tL291mC8Tze0Koadb11arvTDY=";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
local-patches = [ ./not-os.patch ];
|
|
||||||
in pkgs.applyPatches {
|
|
||||||
name = "not-os-patched";
|
name = "not-os-patched";
|
||||||
src = not-os;
|
src = not-os;
|
||||||
patches = map pkgs.fetchpatch remote-patches ++ local-patches;
|
patches = [
|
||||||
|
./pr-28.patch
|
||||||
|
./pr-29.patch
|
||||||
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
gnu-platform = "arm-none-eabi";
|
gnu-platform = "arm-none-eabi";
|
||||||
|
|
28
not-os.patch
28
not-os.patch
|
@ -1,28 +0,0 @@
|
||||||
diff --git a/base.nix b/base.nix
|
|
||||||
index 7eaee32..b5a61ee 100644
|
|
||||||
--- a/base.nix
|
|
||||||
+++ b/base.nix
|
|
||||||
@@ -155,7 +155,23 @@ with lib;
|
|
||||||
# dummy to make setup-etc happy
|
|
||||||
'';
|
|
||||||
system.activationScripts.etc = stringAfter [ "users" "groups" ] config.system.build.etcActivationCommands;
|
|
||||||
+ # Re-apply deprecated var value due to systemd preference in recent nixpkgs
|
|
||||||
+ # See https://github.com/NixOS/nixpkgs/commit/59e37267556eb917146ca3110ab7c96905b9ffbd
|
|
||||||
+ system.activationScripts.var = lib.mkForce ''
|
|
||||||
+ # Various log/runtime directories.
|
|
||||||
|
|
||||||
+ mkdir -p /var/tmp
|
|
||||||
+ chmod 1777 /var/tmp
|
|
||||||
+
|
|
||||||
+ # Empty, immutable home directory of many system accounts.
|
|
||||||
+ mkdir -p /var/empty
|
|
||||||
+ # Make sure it's really empty
|
|
||||||
+ ${pkgs.e2fsprogs}/bin/chattr -f -i /var/empty || true
|
|
||||||
+ find /var/empty -mindepth 1 -delete
|
|
||||||
+ chmod 0555 /var/empty
|
|
||||||
+ chown root:root /var/empty
|
|
||||||
+ ${pkgs.e2fsprogs}/bin/chattr -f +i /var/empty || true
|
|
||||||
+ '';
|
|
||||||
# nix-build -A system.build.toplevel && du -h $(nix-store -qR result) --max=0 -BM|sort -n
|
|
||||||
system.build.toplevel = pkgs.runCommand "not-os" {
|
|
||||||
activationScript = config.system.activationScripts.script;
|
|
Loading…
Reference in New Issue