Fixing

nixos/modules/security/permissions-wrappers/default.nix

@@ -66,6 +66,39 @@ let
 
       chmod "u${if setuid then "+" else "-"}s,g${if setgid then "+" else "-"}s,${permissions}" ${permissionsWrapperDir}/${program}
     '';
+
+    mkActivationScript = programsToWrap:
+      lib.stringAfter [ "users" ]
+        ''
+          # Look in the system path and in the default profile for
+          # programs to be wrapped.
+          PERMISSIONS_WRAPPER_PATH=${config.system.path}/bin:${config.system.path}/sbin
+
+          mkdir -p /run/permissions-wrapper-dirs
+          permissionsWrapperDir=$(mktemp --directory --tmpdir=/run/permissions-wrapper-dirs permissions-wrappers.XXXXXXXXXX)
+          chmod a+rx $permissionsWrapperDir
+
+          ${programsToWrap}
+
+          if [ -L ${permissionsWrapperDir} ]; then
+            # Atomically replace the symlink
+            # See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
+            old=$(readlink ${permissionsWrapperDir})
+            ln --symbolic --force --no-dereference $permissionsWrapperDir ${permissionsWrapperDir}-tmp
+            mv --no-target-directory ${permissionsWrapperDir}-tmp ${permissionsWrapperDir}
+            rm --force --recursive $old
+          elif [ -d ${permissionsWrapperDir} ]; then
+            # Compatibility with old state, just remove the folder and symlink
+            rm -f ${permissionsWrapperDir}/*
+            # if it happens to be a tmpfs
+            ${pkgs.utillinux}/bin/umount ${permissionsWrapperDir} || true
+            rm -d ${permissionsWrapperDir}
+            ln -d --symbolic $permissionsWrapperDir ${permissionsWrapperDir}
+          else
+            # For initial setup
+            ln --symbolic $permissionsWrapperDir ${permissionsWrapperDir}
+          fi
+        '';
 in
 {
 
@@ -160,45 +193,10 @@ in
 
     ###### setcap activation script
     system.activationScripts.setcap =
-      lib.stringAfter [ "users" ]
+      mkActivationScript (lib.concatMapStrings configureSetcapWrapper (builtins.filter isNotNull cfg.setcap));
-        ''
-          # Look in the system path and in the default profile for
-          # programs to be wrapped.
-          PERMISSIONS_WRAPPER_PATH=${config.system.path}/bin:${config.system.path}/sbin
-
-          # When a program is removed from the security.permissionsWrappers.setcap
-          # list we have to remove all of the previous program wrappers
-          # and re-build them minus the wrapper for the program removed,
-          # hence the rm here in the activation script.
-
-          rm -f ${permissionsWrapperDir}/*
-
-          # Concatenate the generated shell slices to configure
-          # wrappers for each program needing specialized capabilities.
-
-          ${lib.concatMapStrings configureSetcapWrapper (builtins.filter isNotNull cfg.setcap)}
-        '';
 
     ###### setuid activation script
     system.activationScripts.setuid =
-      lib.stringAfter [ "users" ]
+      mkActivationScript (lib.concatMapStrings configureSetuidWrapper (builtins.filter isNotNull cfg.setuid));
-        ''
-          # Look in the system path and in the default profile for
-          # programs to be wrapped.
-          PERMISSIONS_WRAPPER_PATH=${config.system.path}/bin:${config.system.path}/sbin
-
-          # When a program is removed from the security.permissionsWrappers.setcap
-          # list we have to remove all of the previous program wrappers
-          # and re-build them minus the wrapper for the program removed,
-          # hence the rm here in the activation script.
-
-          rm -f ${permissionsWrapperDir}/*
-
-          # Concatenate the generated shell slices to configure
-          # wrappers for each program needing specialized capabilities.
-
-          ${lib.concatMapStrings configureSetuidWrapper (builtins.filter isNotNull cfg.setuid)}
-        '';
-
   };
 }

nixos/modules/security/permissions-wrappers/permissions-wrapper.c

@@ -211,7 +211,7 @@ int main(int argc, char * * argv)
     // Read the capabilities set on the file and raise them in to the
     // Ambient set so the program we're wrapping receives the
     // capabilities too!
-    assert(!make_caps_ambient(selfPath));
+    if (strcmp(wrapperType, "setcap") == 0) assert(!make_caps_ambient(selfPath));
 
     execve(sourceProg, argv, environ);
     

nixos/modules/security/permissions-wrappers/setuid-wrapper-drv.nix

@@ -5,15 +5,14 @@ let
 
      # Produce a shell-code splice intended to be stitched into one of
      # the build or install phases within the derivation.
-     mkSetuidWrapper = { program, source ? null, ...}:
+     mkSetuidWrapper = { program, source ? null, ...}: ''
-       ''
        if ! source=${if source != null then source else "$(readlink -f $(PATH=$PERMISSIONS_WRAPPER_PATH type -tP ${program}))"}; then
          # If we can't find the program, fall back to the
          # system profile.
          source=/nix/var/nix/profiles/default/bin/${program}
        fi
 
-         gcc -Wall -O2 -DWRAPPER_SETCAP=1 -DSOURCE_PROG=\"$source\" -DWRAPPER_DIR=\"${config.security.permissionsWrapperDir}\" \
+       gcc -Wall -O2 -DWRAPPER_SETUID=1 -DSOURCE_PROG=\"$source\" -DWRAPPER_DIR=\"${config.security.permissionsWrapperDir}\" \
            -lcap-ng -lcap ${./permissions-wrapper.c} -o $out/bin/${program}.wrapper -L ${pkgs.libcap.lib}/lib -L ${pkgs.libcap_ng}/lib \
            -I ${pkgs.libcap.dev}/include -I ${pkgs.libcap_ng}/include -I ${pkgs.linuxHeaders}/include
      '';