Skip to content

Commit bd0e645

Browse files
authored
Merge pull request #94442 from Atemu/buildFHSUserEnvBw
2 parents b7f3c99 + dca51dc commit bd0e645

File tree

7 files changed

+309
-8
lines changed

7 files changed

+309
-8
lines changed

pkgs/applications/editors/android-studio/default.nix

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
1-
{ callPackage, makeFontsConf, gnome2 }:
1+
{ callPackage, makeFontsConf, gnome2, buildFHSUserEnv }:
22

33
let
44
mkStudio = opts: callPackage (import ./common.nix opts) {
55
fontsConf = makeFontsConf {
66
fontDirectories = [];
77
};
88
inherit (gnome2) GConf gnome_vfs;
9+
inherit buildFHSUserEnv;
910
};
1011
stableVersion = {
1112
version = "4.0.1.0"; # "Android Studio 4.0.1"
File renamed without changes.
Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
{ callPackage, runCommandLocal, writeShellScriptBin, stdenv, coreutils, bubblewrap }:
2+
3+
let buildFHSEnv = callPackage ./env.nix { }; in
4+
5+
args @ {
6+
name,
7+
runScript ? "bash",
8+
extraInstallCommands ? "",
9+
meta ? {},
10+
passthru ? {},
11+
...
12+
}:
13+
14+
with builtins;
15+
let
16+
env = buildFHSEnv (removeAttrs args [
17+
"runScript" "extraInstallCommands" "meta" "passthru"
18+
]);
19+
20+
chrootenv = callPackage ./chrootenv {};
21+
22+
etcBindFlags = let
23+
files = [
24+
# NixOS Compatibility
25+
"static"
26+
# Users, Groups, NSS
27+
"passwd"
28+
"group"
29+
"shadow"
30+
"hosts"
31+
"resolv.conf"
32+
"nsswitch.conf"
33+
# Sudo & Su
34+
"login.defs"
35+
"sudoers"
36+
"sudoers.d"
37+
# Time
38+
"localtime"
39+
"zoneinfo"
40+
# Other Core Stuff
41+
"machine-id"
42+
"os-release"
43+
# PAM
44+
"pam.d"
45+
# Fonts
46+
"fonts"
47+
# ALSA
48+
"asound.conf"
49+
# SSL
50+
"ssl/certs"
51+
"pki"
52+
];
53+
in concatStringsSep " \\\n "
54+
(map (file: "--ro-bind-try /etc/${file} /etc/${file}") files);
55+
56+
init = run: writeShellScriptBin "${name}-init" ''
57+
source /etc/profile
58+
exec ${run} "$@"
59+
'';
60+
61+
bwrapCmd = { initArgs ? "" }: ''
62+
blacklist="/nix /dev /proc /etc"
63+
ro_mounts=""
64+
for i in ${env}/*; do
65+
path="/''${i##*/}"
66+
if [[ $path == '/etc' ]]; then
67+
continue
68+
fi
69+
ro_mounts="$ro_mounts --ro-bind $i $path"
70+
blacklist="$blacklist $path"
71+
done
72+
73+
if [[ -d ${env}/etc ]]; then
74+
for i in ${env}/etc/*; do
75+
path="/''${i##*/}"
76+
ro_mounts="$ro_mounts --ro-bind $i /etc$path"
77+
done
78+
fi
79+
80+
auto_mounts=""
81+
# loop through all directories in the root
82+
for dir in /*; do
83+
# if it is a directory and it is not in the blacklist
84+
if [[ -d "$dir" ]] && grep -v "$dir" <<< "$blacklist" >/dev/null; then
85+
# add it to the mount list
86+
auto_mounts="$auto_mounts --bind $dir $dir"
87+
fi
88+
done
89+
90+
exec ${bubblewrap}/bin/bwrap \
91+
--dev-bind /dev /dev \
92+
--proc /proc \
93+
--chdir "$(pwd)" \
94+
--unshare-all \
95+
--share-net \
96+
--die-with-parent \
97+
--ro-bind /nix /nix \
98+
${etcBindFlags} \
99+
$ro_mounts \
100+
$auto_mounts \
101+
${init runScript}/bin/${name}-init ${initArgs}
102+
'';
103+
104+
bin = writeShellScriptBin name (bwrapCmd { initArgs = ''"$@"''; });
105+
106+
in runCommandLocal name {
107+
inherit meta;
108+
109+
passthru = passthru // {
110+
env = runCommandLocal "${name}-shell-env" {
111+
shellHook = bwrapCmd {};
112+
} ''
113+
echo >&2 ""
114+
echo >&2 "*** User chroot 'env' attributes are intended for interactive nix-shell sessions, not for building! ***"
115+
echo >&2 ""
116+
exit 1
117+
'';
118+
};
119+
} ''
120+
mkdir -p $out/bin
121+
ln -s ${bin}/bin/${name} $out/bin/${name}
122+
${extraInstallCommands}
123+
''
Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
{ stdenv, buildEnv, writeText, pkgs, pkgsi686Linux }:
2+
3+
{ name, profile ? ""
4+
, targetPkgs ? pkgs: [], multiPkgs ? pkgs: []
5+
, extraBuildCommands ? "", extraBuildCommandsMulti ? ""
6+
, extraOutputsToInstall ? []
7+
}:
8+
9+
# HOWTO:
10+
# All packages (most likely programs) returned from targetPkgs will only be
11+
# installed once--matching the host's architecture (64bit on x86_64 and 32bit on
12+
# x86).
13+
#
14+
# Packages (most likely libraries) returned from multiPkgs are installed
15+
# once on x86 systems and twice on x86_64 systems.
16+
# On x86 they are merged with packages from targetPkgs.
17+
# On x86_64 they are added to targetPkgs and in addition their 32bit
18+
# versions are also installed. The final directory structure looks as
19+
# follows:
20+
# /lib32 will include 32bit libraries from multiPkgs
21+
# /lib64 will include 64bit libraries from multiPkgs and targetPkgs
22+
# /lib will link to /lib32
23+
24+
let
25+
is64Bit = stdenv.hostPlatform.parsed.cpu.bits == 64;
26+
isMultiBuild = multiPkgs != null && is64Bit;
27+
isTargetBuild = !isMultiBuild;
28+
29+
# list of packages (usually programs) which are only be installed for the
30+
# host's architecture
31+
targetPaths = targetPkgs pkgs ++ (if multiPkgs == null then [] else multiPkgs pkgs);
32+
33+
# list of packages which are installed for both x86 and x86_64 on x86_64
34+
# systems
35+
multiPaths = multiPkgs pkgsi686Linux;
36+
37+
# base packages of the chroot
38+
# these match the host's architecture, glibc_multi is used for multilib
39+
# builds. glibcLocales must be before glibc or glibc_multi as otherwiese
40+
# the wrong LOCALE_ARCHIVE will be used where only C.UTF-8 is available.
41+
basePkgs = with pkgs;
42+
[ glibcLocales
43+
(if isMultiBuild then glibc_multi else glibc)
44+
(toString gcc.cc.lib) bashInteractive coreutils less shadow su
45+
gawk diffutils findutils gnused gnugrep
46+
gnutar gzip bzip2 xz
47+
];
48+
baseMultiPkgs = with pkgsi686Linux;
49+
[ (toString gcc.cc.lib)
50+
];
51+
52+
etcProfile = writeText "profile" ''
53+
export PS1='${name}-chrootenv:\u@\h:\w\$ '
54+
export LOCALE_ARCHIVE='/usr/lib/locale/locale-archive'
55+
export LD_LIBRARY_PATH="/run/opengl-driver/lib:/run/opengl-driver-32/lib:/usr/lib:/usr/lib32''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
56+
export PATH="/run/wrappers/bin:/usr/bin:/usr/sbin:$PATH"
57+
export TZDIR='/etc/zoneinfo'
58+
59+
# Force compilers and other tools to look in default search paths
60+
unset NIX_ENFORCE_PURITY
61+
export NIX_CC_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt}=1
62+
export NIX_CFLAGS_COMPILE='-idirafter /usr/include'
63+
export NIX_CFLAGS_LINK='-L/usr/lib -L/usr/lib32'
64+
export NIX_LDFLAGS='-L/usr/lib -L/usr/lib32'
65+
export PKG_CONFIG_PATH=/usr/lib/pkgconfig
66+
export ACLOCAL_PATH=/usr/share/aclocal
67+
68+
${profile}
69+
'';
70+
71+
# Compose /etc for the chroot environment
72+
etcPkg = stdenv.mkDerivation {
73+
name = "${name}-chrootenv-etc";
74+
buildCommand = ''
75+
mkdir -p $out/etc
76+
cd $out/etc
77+
78+
# environment variables
79+
ln -s ${etcProfile} profile
80+
81+
# symlink /etc/mtab -> /proc/mounts (compat for old userspace progs)
82+
ln -s /proc/mounts mtab
83+
'';
84+
};
85+
86+
# Composes a /usr-like directory structure
87+
staticUsrProfileTarget = buildEnv {
88+
name = "${name}-usr-target";
89+
paths = [ etcPkg ] ++ basePkgs ++ targetPaths;
90+
extraOutputsToInstall = [ "out" "lib" "bin" ] ++ extraOutputsToInstall;
91+
ignoreCollisions = true;
92+
};
93+
94+
staticUsrProfileMulti = buildEnv {
95+
name = "${name}-usr-multi";
96+
paths = baseMultiPkgs ++ multiPaths;
97+
extraOutputsToInstall = [ "out" "lib" ] ++ extraOutputsToInstall;
98+
ignoreCollisions = true;
99+
};
100+
101+
# setup library paths only for the targeted architecture
102+
setupLibDirsTarget = ''
103+
# link content of targetPaths
104+
cp -rsHf ${staticUsrProfileTarget}/lib lib
105+
ln -s lib lib${if is64Bit then "64" else "32"}
106+
'';
107+
108+
# setup /lib, /lib32 and /lib64
109+
setupLibDirsMulti = ''
110+
mkdir -m0755 lib32
111+
mkdir -m0755 lib64
112+
ln -s lib64 lib
113+
114+
# copy glibc stuff
115+
cp -rsHf ${staticUsrProfileTarget}/lib/32/* lib32/ && chmod u+w -R lib32/
116+
117+
# copy content of multiPaths (32bit libs)
118+
[ -d ${staticUsrProfileMulti}/lib ] && cp -rsHf ${staticUsrProfileMulti}/lib/* lib32/ && chmod u+w -R lib32/
119+
120+
# copy content of targetPaths (64bit libs)
121+
cp -rsHf ${staticUsrProfileTarget}/lib/* lib64/ && chmod u+w -R lib64/
122+
123+
# symlink 32-bit ld-linux.so
124+
ln -Ls ${staticUsrProfileTarget}/lib/32/ld-linux.so.2 lib/
125+
'';
126+
127+
setupLibDirs = if isTargetBuild then setupLibDirsTarget
128+
else setupLibDirsMulti;
129+
130+
# the target profile is the actual profile that will be used for the chroot
131+
setupTargetProfile = ''
132+
mkdir -m0755 usr
133+
cd usr
134+
${setupLibDirs}
135+
for i in bin sbin share include; do
136+
if [ -d "${staticUsrProfileTarget}/$i" ]; then
137+
cp -rsHf "${staticUsrProfileTarget}/$i" "$i"
138+
fi
139+
done
140+
cd ..
141+
142+
for i in var etc; do
143+
if [ -d "${staticUsrProfileTarget}/$i" ]; then
144+
cp -rsHf "${staticUsrProfileTarget}/$i" "$i"
145+
fi
146+
done
147+
for i in usr/{bin,sbin,lib,lib32,lib64}; do
148+
if [ -d "$i" ]; then
149+
ln -s "$i"
150+
fi
151+
done
152+
'';
153+
154+
in stdenv.mkDerivation {
155+
name = "${name}-fhs";
156+
buildCommand = ''
157+
mkdir -p $out
158+
cd $out
159+
${setupTargetProfile}
160+
cd $out
161+
${extraBuildCommands}
162+
cd $out
163+
${if isMultiBuild then extraBuildCommandsMulti else ""}
164+
'';
165+
preferLocalBuild = true;
166+
allowSubstitutes = false;
167+
}

pkgs/games/steam/default.nix

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{ pkgs, newScope }:
1+
{ pkgs, newScope, buildFHSUserEnv }:
22

33
let
44
callPackage = newScope self;
@@ -12,12 +12,13 @@ let
1212
steam-runtime-wrapped = callPackage ./runtime-wrapped.nix { };
1313
steam = callPackage ./steam.nix { };
1414
steam-fonts = callPackage ./fonts.nix { };
15-
steam-chrootenv = callPackage ./chrootenv.nix {
15+
steam-fhsenv = callPackage ./fhsenv.nix {
1616
glxinfo-i686 = pkgs.pkgsi686Linux.glxinfo;
1717
steam-runtime-wrapped-i686 =
1818
if steamArch == "amd64"
1919
then pkgs.pkgsi686Linux.steamPackages.steam-runtime-wrapped
2020
else null;
21+
inherit buildFHSUserEnv;
2122
};
2223
steamcmd = callPackage ./steamcmd.nix { };
2324
};

pkgs/top-level/all-packages.nix

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,10 @@ in
155155

156156
buildEnv = callPackage ../build-support/buildenv { }; # not actually a package
157157

158-
buildFHSUserEnv = callPackage ../build-support/build-fhs-userenv { };
158+
# TODO: eventually migrate everything to buildFHSUserEnvBubblewrap
159+
buildFHSUserEnv = buildFHSUserEnvChroot;
160+
buildFHSUserEnvChroot = callPackage ../build-support/build-fhs-userenv { };
161+
buildFHSUserEnvBubblewrap = callPackage ../build-support/build-fhs-userenv-bubblewrap { };
159162

160163
buildMaven = callPackage ../build-support/build-maven.nix {};
161164

@@ -19197,7 +19200,9 @@ in
1919719200
amsn = callPackage ../applications/networking/instant-messengers/amsn { };
1919819201

1919919202
androidStudioPackages = recurseIntoAttrs
19200-
(callPackage ../applications/editors/android-studio { });
19203+
(callPackage ../applications/editors/android-studio {
19204+
buildFHSUserEnv = buildFHSUserEnvBubblewrap;
19205+
});
1920119206
android-studio = androidStudioPackages.stable;
1920219207

1920319208
animbar = callPackage ../applications/graphics/animbar { };
@@ -21343,7 +21348,9 @@ in
2134321348
inherit (gnome3) gnome-desktop libgnome-keyring;
2134421349
wine = wineWowPackages.staging;
2134521350
};
21346-
lutris = callPackage ../applications/misc/lutris/chrootenv.nix { };
21351+
lutris = callPackage ../applications/misc/lutris/fhsenv.nix {
21352+
buildFHSUserEnv = buildFHSUserEnvBubblewrap;
21353+
};
2134721354
lutris-free = lutris.override {
2134821355
steamSupport = false;
2134921356
};
@@ -24796,9 +24803,11 @@ in
2479624803

2479724804
stockfish = callPackage ../games/stockfish { };
2479824805

24799-
steamPackages = dontRecurseIntoAttrs (callPackage ../games/steam { });
24806+
steamPackages = dontRecurseIntoAttrs (callPackage ../games/steam {
24807+
buildFHSUserEnv = buildFHSUserEnvBubblewrap;
24808+
});
2480024809

24801-
steam = steamPackages.steam-chrootenv;
24810+
steam = steamPackages.steam-fhsenv;
2480224811

2480324812
steam-run = steam.run;
2480424813
steam-run-native = (steam.override {

0 commit comments

Comments
 (0)