public
/
nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Getting rid of the var indirection and using a bin path instead

This commit is contained in:
Parnell Springmeyer 2017-01-29 04:11:01 -06:00
parent a8cb2afa98
commit 4aa0923009
No known key found for this signature in database
GPG Key ID: DCCF89258EAD874A
45 changed files with 86 additions and 65 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
nixos/modules/installer/tools/nixos-install.sh
View File

@ -259,9 +259,9 @@ chroot $mountPoint /nix/var/nix/profiles/system/activate
# Ask the user to set a root password.
if [ -z "$noRootPasswd" ] && chroot $mountPoint [ -x /run/wrappers/passwd ] && [ -t 0 ]; then
if [ -z "$noRootPasswd" ] && chroot $mountPoint [ -x /run/wrappers/bin/passwd ] && [ -t 0 ]; then
echo "setting root password..."
chroot $mountPoint /run/wrappers/passwd
chroot $mountPoint /run/wrappers/bin/passwd
fi

3
nixos/modules/security/apparmor-suid.nix
View File

@ -19,7 +19,7 @@ with lib;
config = mkIf (cfg.confineSUIDApplications) {
security.apparmor.profiles = [ (pkgs.writeText "ping" ''
#include <tunables/global>
/run/wrappers/ping {
/run/wrappers/bin/ping {
#include <abstractions/base>
#include <abstractions/consoles>
#include <abstractions/nameservice>
@ -33,7 +33,6 @@ with lib;
${pkgs.attr.out}/lib/libattr.so* mr,
${pkgs.iputils}/bin/ping mixr,
/run/wrappers/ping.real r,
#/etc/modules.conf r,

33
nixos/modules/security/wrappers/default.nix
View File

@ -17,7 +17,9 @@ let
source=/nix/var/nix/profiles/default/bin/${program}
fi
gcc -Wall -O2 -DSOURCE_PROG=\"$source\" -DWRAPPER_DIR=\"${config.security.wrapperDir}\" \
parentWrapperDir=$(dirname ${wrapperDir})
gcc -Wall -O2 -DSOURCE_PROG=\"$source\" -DWRAPPER_DIR=\"$parentWrapperDir\" \
-lcap-ng -lcap ${./wrapper.c} -o $out/bin/${program}.wrapper -L ${pkgs.libcap.lib}/lib -L ${pkgs.libcap_ng}/lib \
-I ${pkgs.libcap.dev}/include -I ${pkgs.libcap_ng}/include -I ${pkgs.linuxHeaders}/include
'';
@ -155,7 +157,7 @@ in
security.wrapperDir = lib.mkOption {
type = lib.types.path;
default = "/run/wrappers";
default = "/run/wrappers/bin";
internal = true;
description = ''
This option defines the path to the wrapper programs. It
@ -181,11 +183,36 @@ in
# programs to be wrapped.
WRAPPER_PATH=${config.system.path}/bin:${config.system.path}/sbin
if [ -d ${config.security.old-wrapperDir} ]; then
rm -rf ${config.security.old-wrapperDir}
fi
parentWrapperDir="$(dirname ${wrapperDir})"
mkdir -p ${wrapperDir}
wrapperDir=$(mktemp --directory --tmpdir=${wrapperDir} wrappers.XXXXXXXXXX)
wrapperDir=$(mktemp --directory --tmpdir="$parentWrapperDir" wrappers.XXXXXXXXXX)
chmod a+rx $wrapperDir
${lib.concatStringsSep "\n" mkWrappedPrograms}
if [ -L ${wrapperDir} ]; then
# Atomically replace the symlink
# See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
old=$(readlink ${wrapperDir})
ln --symbolic --force --no-dereference $wrapperDir ${wrapperDir}-tmp
mv --no-target-directory ${wrapperDir}-tmp ${wrapperDir}
rm --force --recursive $old
elif [ -d ${wrapperDir} ]; then
# Compatibility with old state, just remove the folder and symlink
rm -f ${wrapperDir}/*
# if it happens to be a tmpfs
${pkgs.utillinux}/bin/umount ${wrapperDir} || true
rm -d ${wrapperDir}
ln -d --symbolic $wrapperDir ${wrapperDir}
else
# For initial setup
ln --symbolic $wrapperDir ${wrapperDir}
fi
'';
};
}

4
nixos/modules/services/logging/logcheck.nix
View File

@ -29,8 +29,8 @@ let
};
cronJob = ''
@reboot logcheck env PATH=/run/wrappers:$PATH nice -n10 ${pkgs.logcheck}/sbin/logcheck -R ${flags}
2 ${cfg.timeOfDay} * * * logcheck env PATH=/run/wrappers:$PATH nice -n10 ${pkgs.logcheck}/sbin/logcheck ${flags}
@reboot logcheck env PATH=/run/wrappers/bin:$PATH nice -n10 ${pkgs.logcheck}/sbin/logcheck -R ${flags}
2 ${cfg.timeOfDay} * * * logcheck env PATH=/run/wrappers/bin:$PATH nice -n10 ${pkgs.logcheck}/sbin/logcheck ${flags}
'';
writeIgnoreRule = name: {level, regex, ...}:

2
nixos/modules/services/mail/dovecot.nix
View File

@ -13,7 +13,7 @@ let
''
base_dir = ${baseDir}
protocols = ${concatStringsSep " " cfg.protocols}
sendmail_path = /run/wrappers/sendmail
sendmail_path = /run/wrappers/bin/sendmail
''
(if isNull cfg.sslServerCert then ''

2
nixos/modules/services/mail/exim.nix
View File

@ -70,7 +70,7 @@ in
etc."exim.conf".text = ''
exim_user = ${cfg.user}
exim_group = ${cfg.group}
exim_path = /run/wrappers/exim
exim_path = /run/wrappers/bin/exim
spool_directory = ${cfg.spoolDir}
${cfg.config}
'';

4
nixos/modules/services/monitoring/munin.nix
View File

@ -34,7 +34,7 @@ let
cap=$(sed -nr 's/.*#%#\s+capabilities\s*=\s*(.+)/\1/p' $file)
wrapProgram $file \
--set PATH "/run/wrappers:/run/current-system/sw/bin:/run/current-system/sw/bin" \
--set PATH "/run/wrappers/bin:/run/current-system/sw/bin:/run/current-system/sw/bin" \
--set MUNIN_LIBDIR "${pkgs.munin}/lib" \
--set MUNIN_PLUGSTATE "/var/run/munin"
@ -183,7 +183,7 @@ in
mkdir -p /etc/munin/plugins
rm -rf /etc/munin/plugins/*
PATH="/run/wrappers:/run/current-system/sw/bin:/run/current-system/sw/bin" ${pkgs.munin}/sbin/munin-node-configure --shell --families contrib,auto,manual --config ${nodeConf} --libdir=${muninPlugins} --servicedir=/etc/munin/plugins 2>/dev/null | ${pkgs.bash}/bin/bash
PATH="/run/wrappers/bin:/run/current-system/sw/bin:/run/current-system/sw/bin" ${pkgs.munin}/sbin/munin-node-configure --shell --families contrib,auto,manual --config ${nodeConf} --libdir=${muninPlugins} --servicedir=/etc/munin/plugins 2>/dev/null | ${pkgs.bash}/bin/bash
'';
serviceConfig = {
ExecStart = "${pkgs.munin}/sbin/munin-node --config ${nodeConf} --servicedir /etc/munin/plugins/";

2
nixos/modules/services/monitoring/smartd.nix
View File

@ -124,7 +124,7 @@ in
};
mailer = mkOption {
default = "/run/wrappers/sendmail";
default = "/run/wrappers/bin/sendmail";
type = types.path;
description = ''
Sendmail-compatible binary to be used to send the messages.

2
nixos/modules/services/network-filesystems/samba.nix
View File

@ -30,7 +30,7 @@ let
''
[ global ]
security = ${cfg.securityType}
passwd program = /run/wrappers/passwd %u
passwd program = /run/wrappers/bin/passwd %u
pam password change = ${smbToString cfg.syncPasswordsByPam}
invalid users = ${smbToString cfg.invalidUsers}

2
nixos/modules/services/networking/prayer.nix
View File

@ -18,7 +18,7 @@ let
var_prefix = "${stateDir}"
prayer_user = "${prayerUser}"
prayer_group = "${prayerGroup}"
sendmail_path = "/run/wrappers/sendmail"
sendmail_path = "/run/wrappers/bin/sendmail"
use_http_port ${cfg.port}

2
nixos/modules/services/networking/smokeping.nix
View File

@ -226,7 +226,7 @@ in
sendmail = mkOption {
type = types.nullOr types.path;
default = null;
example = "/run/wrappers/sendmail";
example = "/run/wrappers/bin/sendmail";
description = "Use this sendmail compatible script to deliver alerts";
};
smokeMailTemplate = mkOption {

4
nixos/modules/services/scheduling/atd.nix
View File

@ -42,13 +42,13 @@ in
config = mkIf cfg.enable {
security.wrappers.setuid = map (program: "${program}" = {
security.wrappers = map (program: {"${program}" = {
source = "${pkgs.atd}/bin/${program}";
owner = "atd";
group = "atd";
setuid = true;
setgid = true;
}) [ "at" "atq" "atrm" "batch" ];
};}) [ "at" "atq" "atrm" "batch" ];
environment.systemPackages = [ at ];

2
nixos/modules/services/scheduling/cron.nix
View File

@ -20,7 +20,7 @@ let
cronNixosPkg = pkgs.cron.override {
# The mail.nix nixos module, if there is any local mail system enabled,
# should have sendmail in this path.
sendmailPath = "/run/wrappers/sendmail";
sendmailPath = "/run/wrappers/bin/sendmail";
};
allFiles =

2
nixos/modules/services/scheduling/fcron.nix
View File

@ -96,7 +96,7 @@ in
fcronallow = /etc/fcron.allow
fcrondeny = /etc/fcron.deny
shell = /bin/sh
sendmail = /run/wrappers/sendmail
sendmail = /run/wrappers/bin/sendmail
editor = /run/current-system/sw/bin/vi
'';
target = "fcron.conf";

5
nixos/modules/system/boot/stage-2-init.sh
View File

@ -131,11 +131,6 @@ if [ -n "@useHostResolvConf@" -a -e /etc/resolv.conf ]; then
cat /etc/resolv.conf | resolvconf -m 1000 -a host
fi
# Create /run/wrappers as a tmpfs.
rm -rf /run/wrappers
mkdir -m 0755 -p /run/wrappers
mount -t tmpfs -o "mode=0755" tmpfs /run/wrappers
# Log the script output to /dev/kmsg or /run/log/stage-2-init.log.
# Only at this point are all the necessary prerequisites ready for these commands.
exec {logOutFd}>&1 {logErrFd}>&2

4
nixos/modules/virtualisation/virtualbox-host.nix
View File

@ -69,12 +69,12 @@ in
environment.systemPackages = [ virtualbox ];
security.wrappers = let
mkSuid = program: "${program}" = {
mkSuid = program: {"${program}" = {
source = "${virtualbox}/libexec/virtualbox/${program}";
owner = "root";
group = "vboxusers";
setuid = true;
};
};};
in mkIf cfg.enableHardening (map mkSuid [
"VBoxHeadless"
"VBoxNetAdpCtl"

2
nixos/tests/smokeping.nix
View File

@ -14,7 +14,7 @@ import ./make-test.nix ({ pkgs, ...} : {
mailHost = "127.0.0.2";
probeConfig = ''
+ FPing
binary = /run/wrappers/fping
binary = /run/wrappers/bin/fping
offset = 0%
'';
};

2
pkgs/applications/editors/sublime3/default.nix
View File

@ -1,5 +1,5 @@
{ fetchurl, stdenv, glib, xorg, cairo, gtk2, pango, makeWrapper, openssl, bzip2,
pkexecPath ? "/run/wrappers/pkexec", libredirect,
pkexecPath ? "/run/wrappers/bin/pkexec", libredirect,
gksuSupport ? false, gksu}:
assert stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux";

4
pkgs/applications/networking/browsers/chromium/default.nix
View File

@ -83,9 +83,9 @@ in stdenv.mkDerivation {
ed -v -s "$out/bin/chromium" << EOF
2i
if [ -x "/run/wrappers/${sandboxExecutableName}" ]
if [ -x "/run/wrappers/bin/${sandboxExecutableName}" ]
then
export CHROME_DEVEL_SANDBOX="/run/wrappers/${sandboxExecutableName}"
export CHROME_DEVEL_SANDBOX="/run/wrappers/bin/${sandboxExecutableName}"
else
export CHROME_DEVEL_SANDBOX="$sandbox/bin/${sandboxExecutableName}"
fi

2
pkgs/applications/networking/instant-messengers/gale/gale-install.in.patch
View File

@ -26,7 +26,7 @@ index 50e8ad8..eec0ed2 100644
+ is_nixos=no
+fi
+
+if [ -u /run/wrappers/gksign ]; then
+if [ -u /run/wrappers/bin/gksign ]; then
+ cat <<EOM
+
+Gale appears to have already been set up via the NixOS module system (check

2
pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
View File

@ -11,7 +11,7 @@ index a9d8ac4..85f13f5 100644
- # # arguments: '-i -t'
- # # }
+ config.action_mailer.sendmail_settings = {
+ location: '/run/wrappers/sendmail',
+ location: '/run/wrappers/bin/sendmail',
+ arguments: '-i -t'
+ }
config.action_mailer.perform_deliveries = true

6
pkgs/applications/virtualization/virtualbox/hardened.patch
View File

@ -96,7 +96,7 @@ index 95dc9a7..39170bc 100644
/* get the path to the executable */
char szPath[RTPATH_MAX];
- RTPathAppPrivateArch(szPath, sizeof(szPath) - 1);
+ RTStrCopy(szPath, sizeof(szPath) - 1, "/run/wrappers");
+ RTStrCopy(szPath, sizeof(szPath) - 1, "/run/wrappers/bin");
size_t cchBufLeft = strlen(szPath);
szPath[cchBufLeft++] = RTPATH_DELIMITER;
szPath[cchBufLeft] = 0;
@ -154,7 +154,7 @@ index be2ad8f..7ddf105 100644
+RTDECL(int) RTPathSuidDir(char *pszPath, size_t cchPath)
+{
+ return RTStrCopy(pszPath, cchPath, "/run/wrappers");
+ return RTStrCopy(pszPath, cchPath, "/run/wrappers/bin");
+}
+
+
@ -174,7 +174,7 @@ index 7bde6af..2656cae 100644
+ * will cut off everything after the rightmost / as this function is analogous
+ * to RTProcGetExecutablePath().
+ */
+#define SUIDDIR "/run/wrappers/"
+#define SUIDDIR "/run/wrappers/bin/"
+
+RTR3DECL(char *) RTProcGetSuidPath(char *pszExecPath, size_t cbExecPath)
+{

2
pkgs/build-support/build-fhs-userenv/env.nix
View File

@ -51,7 +51,7 @@ let
export PS1='${name}-chrootenv:\u@\h:\w\$ '
export LOCALE_ARCHIVE='/usr/lib/locale/locale-archive'
export LD_LIBRARY_PATH='/run/opengl-driver/lib:/run/opengl-driver-32/lib:/usr/lib:/usr/lib32'
export PATH='/run/wrappers:/usr/bin:/usr/sbin'
export PATH='/run/wrappers/bin:/usr/bin:/usr/sbin'
export PKG_CONFIG_PATH=/usr/lib/pkgconfig
# Force compilers to look in default search paths

6
pkgs/desktops/enlightenment/enlightenment.nix
View File

@ -42,13 +42,13 @@ stdenv.mkDerivation rec {
# this is a hack and without this cpufreq module is not working. does the following:
# 1. moves the "freqset" binary to "e_freqset",
# 2. linkes "e_freqset" to enlightenment/bin so that,
# 3. wrappers.setuid detects it and places wrappers in /run/wrappers/e_freqset,
# 4. and finally, links /run/wrappers/e_freqset to original destination where enlightenment wants it
# 3. wrappers.setuid detects it and places wrappers in /run/wrappers/bin/e_freqset,
# 4. and finally, links /run/wrappers/bin/e_freqset to original destination where enlightenment wants it
postInstall = ''
export CPUFREQ_DIRPATH=`readlink -f $out/lib/enlightenment/modules/cpufreq/linux-gnu-*`;
mv $CPUFREQ_DIRPATH/freqset $CPUFREQ_DIRPATH/e_freqset
ln -sv $CPUFREQ_DIRPATH/e_freqset $out/bin/e_freqset
ln -sv /run/wrappers/e_freqset $CPUFREQ_DIRPATH/freqset
ln -sv /run/wrappers/bin/e_freqset $CPUFREQ_DIRPATH/freqset
'';
meta = with stdenv.lib; {

2
pkgs/development/libraries/kde-frameworks/kinit/start_kdeinit-path.patch
View File

@ -7,7 +7,7 @@ Index: kinit-5.24.0/src/start_kdeinit/start_kdeinit_wrapper.c
#include <unistd.h>
-#define EXECUTE CMAKE_INSTALL_FULL_LIBEXECDIR_KF5 "/start_kdeinit"
+#define EXECUTE "/run/wrappers/start_kdeinit"
+#define EXECUTE "/run/wrappers/bin/start_kdeinit"
#if KDEINIT_OOM_PROTECT

4
pkgs/development/libraries/libgksu/default.nix
View File

@ -57,8 +57,8 @@ stdenv.mkDerivation rec {
# Fix some binary paths
sed -i -e 's|/usr/bin/xauth|${xauth}/bin/xauth|g' libgksu/gksu-run-helper.c libgksu/libgksu.c
sed -i -e 's|/usr/bin/sudo|/run/wrappers/sudo|g' libgksu/libgksu.c
sed -i -e 's|/bin/su\([^d]\)|/run/wrappers/su\1|g' libgksu/libgksu.c
sed -i -e 's|/usr/bin/sudo|/run/wrappers/bin/sudo|g' libgksu/libgksu.c
sed -i -e 's|/bin/su\([^d]\)|/run/wrappers/bin/su\1|g' libgksu/libgksu.c
touch NEWS README
'';

2
pkgs/development/libraries/polkit/default.nix
View File

@ -5,7 +5,7 @@
let
system = "/var/run/current-system/sw";
setuid = "/run/wrappers"; #TODO: from <nixos> config.security.wrapperDir;
setuid = "/run/wrappers/bin"; #TODO: from <nixos> config.security.wrapperDir;
foolVars = {
SYSCONF = "/etc";

2
pkgs/development/tools/unity3d/default.nix
View File

@ -94,7 +94,7 @@ in stdenv.mkDerivation rec {
unitydir="$out/opt/Unity/Editor"
mkdir -p $unitydir
mv Editor/* $unitydir
ln -sf /run/wrappers/${chromium.sandboxExecutableName} $unitydir/chrome-sandbox
ln -sf /run/wrappers/bin/${chromium.sandboxExecutableName} $unitydir/chrome-sandbox
mkdir -p $out/share/applications
sed "/^Exec=/c\Exec=$out/bin/unity-editor" \

2
pkgs/os-specific/linux/fuse/default.nix
View File

@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
# Ensure that FUSE calls the setuid wrapper, not
# $out/bin/fusermount. It falls back to calling fusermount in
# $PATH, so it should also work on non-NixOS systems.
export NIX_CFLAGS_COMPILE="-DFUSERMOUNT_DIR=\"/run/wrappers\""
export NIX_CFLAGS_COMPILE="-DFUSERMOUNT_DIR=\"/run/wrappers/bin\""
sed -e 's@/bin/@${utillinux}/bin/@g' -i lib/mount_util.c
sed -e 's@CONFIG_RPATH=/usr/share/gettext/config.rpath@CONFIG_RPATH=${gettext}/share/gettext/config.rpath@' -i makeconf.sh

2
pkgs/os-specific/linux/mdadm/4.nix
View File

@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
preConfigure = ''
sed -e 's@/lib/udev@''${out}/lib/udev@' \
-e 's@ -Werror @ @' \
-e 's@/usr/sbin/sendmail@/run/wrappers/sendmail@' -i Makefile
-e 's@/usr/sbin/sendmail@/run/wrappers/bin/sendmail@' -i Makefile
'';
meta = {

2
pkgs/os-specific/linux/mdadm/default.nix
View File

@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
preConfigure = ''
sed -e 's@/lib/udev@''${out}/lib/udev@' \
-e 's@ -Werror @ @' \
-e 's@/usr/sbin/sendmail@/run/wrappers/sendmail@' -i Makefile
-e 's@/usr/sbin/sendmail@/run/wrappers/bin/sendmail@' -i Makefile
'';
meta = {

2
pkgs/os-specific/linux/pam/default.nix
View File

@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
postInstall = ''
mv -v $out/sbin/unix_chkpwd{,.orig}
ln -sv /run/wrappers/unix_chkpwd $out/sbin/unix_chkpwd
ln -sv /run/wrappers/bin/unix_chkpwd $out/sbin/unix_chkpwd
''; /*
rm -rf $out/etc
mkdir -p $modules/lib

2
pkgs/os-specific/linux/util-linux/default.nix
View File

@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
--enable-last
--enable-mesg
--disable-use-tty-group
--enable-fs-paths-default=/run/wrappers:/var/run/current-system/sw/bin:/sbin
--enable-fs-paths-default=/run/wrappers/bin:/var/run/current-system/sw/bin:/sbin
${if ncurses == null then "--without-ncurses" else ""}
${if systemd == null then "" else ''
--with-systemd

2
pkgs/servers/interlock/default.nix
View File

@ -30,7 +30,7 @@ buildGoPackage rec {
-e 's|/bin/chown|${coreutils}/bin/chown|' \
-e 's|/bin/date|${coreutils}/bin/date|' \
-e 's|/sbin/poweroff|${systemd}/sbin/poweroff|' \
-e 's|/usr/bin/sudo|/run/wrappers/sudo|' \
-e 's|/usr/bin/sudo|/run/wrappers/bin/sudo|' \
-e 's|/sbin/cryptsetup|${cryptsetup}/bin/cryptsetup|'
'';
}

2
pkgs/servers/mail/petidomo/default.nix
View File

@ -1,4 +1,4 @@
{ stdenv, fetchurl, flex, bison, sendmailPath ? "/run/wrappers/sendmail" }:
{ stdenv, fetchurl, flex, bison, sendmailPath ? "/run/wrappers/bin/sendmail" }:
stdenv.mkDerivation rec {
name = "petidomo-4.3";

4
pkgs/servers/monitoring/nagios/plugins/official-2.x.nix
View File

@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
# configured on the build machine).
preConfigure= "
configureFlagsArray=(
--with-ping-command='/run/wrappers/ping -n -U -w %d -c %d %s'
--with-ping6-command='/run/wrappers/ping6 -n -U -w %d -c %d %s'
--with-ping-command='/run/wrappers/bin/ping -n -U -w %d -c %d %s'
--with-ping6-command='/run/wrappers/bin/ping6 -n -U -w %d -c %d %s'
)
";

4
pkgs/tools/X11/x11vnc/default.nix
View File

@ -20,10 +20,10 @@ stdenv.mkDerivation rec {
configureFlags="--mandir=$out/share/man"
substituteInPlace x11vnc/unixpw.c \
--replace '"/bin/su"' '"/run/wrappers/su"' \
--replace '"/bin/su"' '"/run/wrappers/bin/su"' \
--replace '"/bin/true"' '"${coreutils}/bin/true"'
sed -i -e '/#!\/bin\/sh/a"PATH=${xorg.xdpyinfo}\/bin:${xorg.xauth}\/bin:$PATH\\n"' -e 's|/bin/su|/run/wrappers/su|g' x11vnc/ssltools.h
sed -i -e '/#!\/bin\/sh/a"PATH=${xorg.xdpyinfo}\/bin:${xorg.xauth}\/bin:$PATH\\n"' -e 's|/bin/su|/run/wrappers/bin/su|g' x11vnc/ssltools.h
'';
meta = {

2
pkgs/tools/admin/certbot/default.nix
View File

@ -31,7 +31,7 @@ python2Packages.buildPythonApplication rec {
buildInputs = [ dialog ] ++ (with python2Packages; [ nose mock gnureadline ]);
patchPhase = ''
substituteInPlace certbot/notify.py --replace "/usr/sbin/sendmail" "/run/wrappers/sendmail"
substituteInPlace certbot/notify.py --replace "/usr/sbin/sendmail" "/run/wrappers/bin/sendmail"
substituteInPlace certbot/util.py --replace "sw_vers" "/usr/bin/sw_vers"
'';

2
pkgs/tools/misc/debian-devscripts/default.nix
View File

@ -2,7 +2,7 @@
, FileDesktopEntry, libxslt, docbook_xsl, makeWrapper
, python3Packages
, perlPackages, curl, gnupg, diffutils
, sendmailPath ? "/run/wrappers/sendmail"
, sendmailPath ? "/run/wrappers/bin/sendmail"
}:
let

2
pkgs/tools/security/ecryptfs/default.nix
View File

@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
};
# TODO: replace wrapperDir below with from <nixos> config.security.wrapperDir;
wrapperDir = "/run/wrappers";
wrapperDir = "/run/wrappers/bin";
postPatch = ''
FILES="$(grep -r '/bin/sh' src/utils -l; find src -name \*.c)"

2
pkgs/tools/security/ecryptfs/helper.nix
View File

@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
buildInputs = [ makeWrapper ];
# Do not hardcode PATH to ${ecryptfs} as we need the script to invoke executables from /run/wrappers
# Do not hardcode PATH to ${ecryptfs} as we need the script to invoke executables from /run/wrappers/bin
installPhase = ''
mkdir -p $out/bin $out/libexec
cp $src $out/libexec/ecryptfs-helper.py

2
pkgs/tools/security/sudo/default.nix
View File

@ -1,5 +1,5 @@
{ stdenv, fetchurl, coreutils, pam, groff
, sendmailPath ? "/run/wrappers/sendmail"
, sendmailPath ? "/run/wrappers/bin/sendmail"
, withInsults ? false
}:

2
pkgs/tools/system/at/default.nix
View File

@ -1,4 +1,4 @@
{ fetchurl, stdenv, bison, flex, pam, sendmailPath ? "/run/wrappers/sendmail" }:
{ fetchurl, stdenv, bison, flex, pam, sendmailPath ? "/run/wrappers/bin/sendmail" }:
stdenv.mkDerivation {
name = "at-3.1.16";

2
pkgs/tools/system/cron/default.nix
View File

@ -23,7 +23,7 @@ stdenv.mkDerivation {
#define _PATH_SENDMAIL "${sendmailPath}"
#undef _PATH_DEFPATH
#define _PATH_DEFPATH "/run/wrappers:/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/run/current-system/sw/bin:/run/current-system/sw/sbin:/usr/bin:/bin"
#define _PATH_DEFPATH "/run/wrappers/bin:/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/run/current-system/sw/bin:/run/current-system/sw/sbin:/usr/bin:/bin"
__EOT__
# Implicit saved uids do not work here due to way NixOS uses setuid wrappers

2
pkgs/tools/system/ts/default.nix
View File

@ -1,5 +1,5 @@
{stdenv, fetchurl,
sendmailPath ? "/run/wrappers/sendmail" }:
sendmailPath ? "/run/wrappers/bin/sendmail" }:
stdenv.mkDerivation rec {