public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

minijail: build and install constants.json

Browse Source 
This is a syscall table used for compiling Minijail policy files to
BPF.  The compiler is available in the minijail-tools package.  The
file is generated by compiling and running a small program named
dump_constants.

When cross-compiling, we have to get the syscall table for the host
platform.  To do this, dump_constants is run under QEMU user emulation
for the appropriate platform.  Google takes the same approach in their
minijail packages for ChromiumOS[1].

[1]: 729bd4269a/chromeos-base/minijail/minijail-9999.ebuild (49)
This commit is contained in:
Alyssa Ross 2020-03-27 08:46:03 +00:00
parent 2ed758481c
commit 139a15ea58
1 changed files with 28 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
pkgs/tools/system/minijail/default.nix
View File

@ -1,4 +1,13 @@
{ stdenv, fetchFromGitiles, libcap }: { stdenv, lib, fetchFromGitiles, glibc, libcap, qemu }:
let
dumpConstants =
if stdenv.buildPlatform == stdenv.hostPlatform then "./dump_constants"
else if stdenv.hostPlatform.isAarch32 then "qemu-arm dump_constants"
else if stdenv.hostPlatform.isAarch64 then "qemu-aarch64 dump_constants"
else if stdenv.hostPlatform.isx86_64 then "qemu-x86_64 dump_constants"
else throw "Unsupported host platform";
in
stdenv.mkDerivation rec { stdenv.mkDerivation rec {
pname = "minijail"; pname = "minijail";
@ -10,35 +19,42 @@ stdenv.mkDerivation rec {
sha256 = "00dq854n4zg3ca2b46f90k15n32zn2sgabi76mnq2w985k9v977n"; sha256 = "00dq854n4zg3ca2b46f90k15n32zn2sgabi76mnq2w985k9v977n";
}; };
nativeBuildInputs =
lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) qemu;
buildInputs = [ libcap ]; buildInputs = [ libcap ];
makeFlags = [ "LIBDIR=$(out)/lib" ]; makeFlags = [ "LIBDIR=$(out)/lib" ];
dumpConstantsFlags = lib.optional (stdenv.hostPlatform.libc == "glibc")
preConfigure = '' "LDFLAGS=-L${glibc.static}/lib";
substituteInPlace common.mk --replace /bin/echo echo
'';
postPatch = '' postPatch = ''
substituteInPlace common.mk --replace /bin/echo echo
patchShebangs platform2_preinstall.sh patchShebangs platform2_preinstall.sh
''; '';
postBuild = '' postBuild = ''
./platform2_preinstall.sh ${version} $out/include/chromeos make $makeFlags $buildFlags $dumpConstantsFlags dump_constants
${dumpConstants} > constants.json
''; '';
installPhase = '' installPhase = ''
mkdir -p $out/lib/pkgconfig $out/include/chromeos $out/bin ./platform2_preinstall.sh ${version} $out/include/chromeos
mkdir -p $out/lib/pkgconfig $out/include/chromeos $out/bin \
$out/share/minijail
cp -v *.so $out/lib cp -v *.so $out/lib
cp -v *.pc $out/lib/pkgconfig cp -v *.pc $out/lib/pkgconfig
cp -v libminijail.h scoped_minijail.h $out/include/chromeos cp -v libminijail.h scoped_minijail.h $out/include/chromeos
cp -v minijail0 $out/bin cp -v minijail0 $out/bin
cp -v constants.json $out/share/minijail
''; '';
meta = { meta = with lib; {
homepage = https://android.googlesource.com/platform/external/minijail/; homepage = "https://android.googlesource.com/platform/external/minijail/";
description = "Sandboxing library and application using Linux namespaces and capabilities"; description = "Sandboxing library and application using Linux namespaces and capabilities";
license = stdenv.lib.licenses.bsd3; license = licenses.bsd3;
maintainers = with stdenv.lib.maintainers; [ pcarrier qyliss ]; maintainers = with maintainers; [ pcarrier qyliss ];
platforms = stdenv.lib.platforms.linux; platforms = platforms.linux;
}; };
} }