From fafbfd2305f092b3ee2024e7b211bd6b5a5e1328 Mon Sep 17 00:00:00 2001
From: Atemu <atemu.main@gmail.com>
Date: Fri, 31 Jul 2020 14:58:03 +0200
Subject: [PATCH 1/9] fhs-userenv-bubblewrap: start with build-fhs-userenv

Just here to track @illegalprime's actual changes to build-fhs-userenv in the
next commits
---
 .../build-fhs-userenv-bubblewrap/default.nix  |  49 +++++
 .../build-fhs-userenv-bubblewrap/env.nix      | 202 ++++++++++++++++++
 pkgs/top-level/all-packages.nix               |   5 +-
 3 files changed, 255 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
 create mode 100644 pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix

diff --git a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
new file mode 100644
index 00000000000..e7db6a75297
--- /dev/null
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
@@ -0,0 +1,49 @@
+{ callPackage, runCommandLocal, writeScript, stdenv, coreutils }:
+
+let buildFHSEnv = callPackage ./env.nix { }; in
+
+args@{ name, runScript ? "bash", extraInstallCommands ? "", meta ? {}, passthru ? {}, ... }:
+
+let
+  env = buildFHSEnv (removeAttrs args [ "runScript" "extraInstallCommands" "meta" "passthru" ]);
+
+  chrootenv = callPackage ./chrootenv {};
+
+  init = run: writeScript "${name}-init" ''
+    #! ${stdenv.shell}
+    for i in ${env}/* /host/*; do
+      path="/''${i##*/}"
+      [ -e "$path" ] || ${coreutils}/bin/ln -s "$i" "$path"
+    done
+
+    [ -d "$1" ] && [ -r "$1" ] && cd "$1"
+    shift
+
+    source /etc/profile
+    exec ${run} "$@"
+  '';
+
+in runCommandLocal name {
+  inherit meta;
+
+  passthru = passthru // {
+    env = runCommandLocal "${name}-shell-env" {
+      shellHook = ''
+        exec ${chrootenv}/bin/chrootenv ${init runScript} "$(pwd)"
+      '';
+    } ''
+      echo >&2 ""
+      echo >&2 "*** User chroot 'env' attributes are intended for interactive nix-shell sessions, not for building! ***"
+      echo >&2 ""
+      exit 1
+    '';
+  };
+} ''
+  mkdir -p $out/bin
+  cat <<EOF >$out/bin/${name}
+  #! ${stdenv.shell}
+  exec ${chrootenv}/bin/chrootenv ${init runScript} "\$(pwd)" "\$@"
+  EOF
+  chmod +x $out/bin/${name}
+  ${extraInstallCommands}
+''
diff --git a/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix b/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
new file mode 100644
index 00000000000..083e7617b50
--- /dev/null
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
@@ -0,0 +1,202 @@
+{ stdenv, buildEnv, writeText, pkgs, pkgsi686Linux }:
+
+{ name, profile ? ""
+, targetPkgs ? pkgs: [], multiPkgs ? pkgs: []
+, extraBuildCommands ? "", extraBuildCommandsMulti ? ""
+, extraOutputsToInstall ? []
+}:
+
+# HOWTO:
+# All packages (most likely programs) returned from targetPkgs will only be
+# installed once--matching the host's architecture (64bit on x86_64 and 32bit on
+# x86).
+#
+# Packages (most likely libraries) returned from multiPkgs are installed
+# once on x86 systems and twice on x86_64 systems.
+# On x86 they are merged with packages from targetPkgs.
+# On x86_64 they are added to targetPkgs and in addition their 32bit
+# versions are also installed. The final directory structure looks as
+# follows:
+# /lib32 will include 32bit libraries from multiPkgs
+# /lib64 will include 64bit libraries from multiPkgs and targetPkgs
+# /lib will link to /lib32
+
+let
+  is64Bit = stdenv.hostPlatform.parsed.cpu.bits == 64;
+  isMultiBuild  = multiPkgs != null && is64Bit;
+  isTargetBuild = !isMultiBuild;
+
+  # list of packages (usually programs) which are only be installed for the
+  # host's architecture
+  targetPaths = targetPkgs pkgs ++ (if multiPkgs == null then [] else multiPkgs pkgs);
+
+  # list of packages which are installed for both x86 and x86_64 on x86_64
+  # systems
+  multiPaths = multiPkgs pkgsi686Linux;
+
+  # base packages of the chroot
+  # these match the host's architecture, glibc_multi is used for multilib
+  # builds. glibcLocales must be before glibc or glibc_multi as otherwiese
+  # the wrong LOCALE_ARCHIVE will be used where only C.UTF-8 is available.
+  basePkgs = with pkgs;
+    [ glibcLocales
+      (if isMultiBuild then glibc_multi else glibc)
+      (toString gcc.cc.lib) bashInteractive coreutils less shadow su
+      gawk diffutils findutils gnused gnugrep
+      gnutar gzip bzip2 xz
+    ];
+  baseMultiPkgs = with pkgsi686Linux;
+    [ (toString gcc.cc.lib)
+    ];
+
+  etcProfile = writeText "profile" ''
+    export PS1='${name}-chrootenv:\u@\h:\w\$ '
+    export LOCALE_ARCHIVE='/usr/lib/locale/locale-archive'
+    export LD_LIBRARY_PATH="/run/opengl-driver/lib:/run/opengl-driver-32/lib:/usr/lib:/usr/lib32''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
+    export PATH="/run/wrappers/bin:/usr/bin:/usr/sbin:$PATH"
+    export TZDIR='/etc/zoneinfo'
+
+    # Force compilers and other tools to look in default search paths
+    unset NIX_ENFORCE_PURITY
+    export NIX_CC_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt}=1
+    export NIX_CFLAGS_COMPILE='-idirafter /usr/include'
+    export NIX_CFLAGS_LINK='-L/usr/lib -L/usr/lib32'
+    export NIX_LDFLAGS='-L/usr/lib -L/usr/lib32'
+    export PKG_CONFIG_PATH=/usr/lib/pkgconfig
+    export ACLOCAL_PATH=/usr/share/aclocal
+
+    ${profile}
+  '';
+
+  # Compose /etc for the chroot environment
+  etcPkg = stdenv.mkDerivation {
+    name         = "${name}-chrootenv-etc";
+    buildCommand = ''
+      mkdir -p $out/etc
+      cd $out/etc
+
+      # environment variables
+      ln -s ${etcProfile} profile
+
+      # compatibility with NixOS
+      ln -s /host/etc/static static
+
+      # symlink some NSS stuff
+      ln -s /host/etc/passwd passwd
+      ln -s /host/etc/group group
+      ln -s /host/etc/shadow shadow
+      ln -s /host/etc/hosts hosts
+      ln -s /host/etc/resolv.conf resolv.conf
+      ln -s /host/etc/nsswitch.conf nsswitch.conf
+
+      # symlink sudo and su stuff
+      ln -s /host/etc/login.defs login.defs
+      ln -s /host/etc/sudoers sudoers
+      ln -s /host/etc/sudoers.d sudoers.d
+
+      # symlink other core stuff
+      ln -s /host/etc/localtime localtime
+      ln -s /host/etc/zoneinfo zoneinfo
+      ln -s /host/etc/machine-id machine-id
+      ln -s /host/etc/os-release os-release
+
+      # symlink PAM stuff
+      ln -s /host/etc/pam.d pam.d
+
+      # symlink fonts stuff
+      ln -s /host/etc/fonts fonts
+
+      # symlink ALSA stuff
+      ln -s /host/etc/asound.conf asound.conf
+
+      # symlink SSL certs
+      mkdir -p ssl
+      ln -s /host/etc/ssl/certs ssl/certs
+
+      # symlink /etc/mtab -> /proc/mounts (compat for old userspace progs)
+      ln -s /proc/mounts mtab
+    '';
+  };
+
+  # Composes a /usr-like directory structure
+  staticUsrProfileTarget = buildEnv {
+    name = "${name}-usr-target";
+    paths = [ etcPkg ] ++ basePkgs ++ targetPaths;
+    extraOutputsToInstall = [ "out" "lib" "bin" ] ++ extraOutputsToInstall;
+    ignoreCollisions = true;
+  };
+
+  staticUsrProfileMulti = buildEnv {
+    name = "${name}-usr-multi";
+    paths = baseMultiPkgs ++ multiPaths;
+    extraOutputsToInstall = [ "out" "lib" ] ++ extraOutputsToInstall;
+    ignoreCollisions = true;
+  };
+
+  # setup library paths only for the targeted architecture
+  setupLibDirs_target = ''
+    # link content of targetPaths
+    cp -rsHf ${staticUsrProfileTarget}/lib lib
+    ln -s lib lib${if is64Bit then "64" else "32"}
+  '';
+
+  # setup /lib, /lib32 and /lib64
+  setupLibDirs_multi = ''
+    mkdir -m0755 lib32
+    mkdir -m0755 lib64
+    ln -s lib64 lib
+
+    # copy glibc stuff
+    cp -rsHf ${staticUsrProfileTarget}/lib/32/* lib32/ && chmod u+w -R lib32/
+
+    # copy content of multiPaths (32bit libs)
+    [ -d ${staticUsrProfileMulti}/lib ] && cp -rsHf ${staticUsrProfileMulti}/lib/* lib32/ && chmod u+w -R lib32/
+
+    # copy content of targetPaths (64bit libs)
+    cp -rsHf ${staticUsrProfileTarget}/lib/* lib64/ && chmod u+w -R lib64/
+
+    # symlink 32-bit ld-linux.so
+    ln -Ls ${staticUsrProfileTarget}/lib/32/ld-linux.so.2 lib/
+  '';
+
+  setupLibDirs = if isTargetBuild then setupLibDirs_target
+                                  else setupLibDirs_multi;
+
+  # the target profile is the actual profile that will be used for the chroot
+  setupTargetProfile = ''
+    mkdir -m0755 usr
+    cd usr
+    ${setupLibDirs}
+    for i in bin sbin share include; do
+      if [ -d "${staticUsrProfileTarget}/$i" ]; then
+        cp -rsHf "${staticUsrProfileTarget}/$i" "$i"
+      fi
+    done
+    cd ..
+
+    for i in var etc; do
+      if [ -d "${staticUsrProfileTarget}/$i" ]; then
+        cp -rsHf "${staticUsrProfileTarget}/$i" "$i"
+      fi
+    done
+    for i in usr/{bin,sbin,lib,lib32,lib64}; do
+      if [ -d "$i" ]; then
+        ln -s "$i"
+      fi
+    done
+  '';
+
+in stdenv.mkDerivation {
+  name         = "${name}-fhs";
+  buildCommand = ''
+    mkdir -p $out
+    cd $out
+    ${setupTargetProfile}
+    cd $out
+    ${extraBuildCommands}
+    cd $out
+    ${if isMultiBuild then extraBuildCommandsMulti else ""}
+  '';
+  preferLocalBuild = true;
+  allowSubstitutes = false;
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 42c87c667d7..f53d231b9c4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -153,7 +153,10 @@ in
 
   buildEnv = callPackage ../build-support/buildenv { }; # not actually a package
 
-  buildFHSUserEnv = callPackage ../build-support/build-fhs-userenv { };
+  # TODO: eventually migrate everything to buildFHSUserEnvBubblewrap
+  buildFHSUserEnv = buildFHSUserEnvChrootenv;
+  buildFHSUserEnvChrootenv = callPackage ../build-support/build-fhs-userenv { };
+  buildFHSUserEnvBubblewrap = callPackage ../build-support/build-fhs-userenv-bubblewrap { };
 
   buildMaven = callPackage ../build-support/build-maven.nix {};
 

From 2ddb43ec24d82e0d77c5f1402126dbb498ae0440 Mon Sep 17 00:00:00 2001
From: Michael Eden <themichaeleden@gmail.com>
Date: Wed, 20 Feb 2019 10:22:17 -0500
Subject: [PATCH 2/9] fhs-userenv-bubblewrap: change to using bubblewrap over
 chrootenv

---
 .../build-fhs-userenv-bubblewrap/default.nix  | 72 +++++++++++++------
 .../build-fhs-userenv-bubblewrap/env.nix      | 39 +++++-----
 2 files changed, 72 insertions(+), 39 deletions(-)

diff --git a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
index e7db6a75297..784aa754df7 100644
--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
@@ -1,36 +1,70 @@
-{ callPackage, runCommandLocal, writeScript, stdenv, coreutils }:
+{ callPackage, runCommandLocal, writeShellScriptBin, stdenv, coreutils, bubblewrap }:
 
 let buildFHSEnv = callPackage ./env.nix { }; in
 
-args@{ name, runScript ? "bash", extraInstallCommands ? "", meta ? {}, passthru ? {}, ... }:
+args @ {
+  name,
+  runScript ? "bash",
+  extraInstallCommands ? "",
+  meta ? {},
+  passthru ? {},
+  ...
+}:
 
+with builtins;
 let
-  env = buildFHSEnv (removeAttrs args [ "runScript" "extraInstallCommands" "meta" "passthru" ]);
+  env = buildFHSEnv (removeAttrs args [
+    "runScript" "extraInstallCommands" "meta" "passthru"
+  ]);
 
   chrootenv = callPackage ./chrootenv {};
 
-  init = run: writeScript "${name}-init" ''
-    #! ${stdenv.shell}
-    for i in ${env}/* /host/*; do
-      path="/''${i##*/}"
-      [ -e "$path" ] || ${coreutils}/bin/ln -s "$i" "$path"
-    done
-
-    [ -d "$1" ] && [ -r "$1" ] && cd "$1"
-    shift
-
+  init = run: writeShellScriptBin "${name}-init" ''
     source /etc/profile
     exec ${run} "$@"
   '';
 
+  bwrap_cmd = { init_args ? "" }: ''
+    blacklist="/nix /dev /proc"
+    ro_mounts=""
+    for i in ${env}/*; do
+      path="/''${i##*/}"
+      ro_mounts="$ro_mounts --ro-bind $i $path"
+      blacklist="$blacklist $path"
+    done
+
+    auto_mounts=""
+    # loop through all directories in the root
+    for dir in /*; do
+      # if it is a directory and it is not in the blacklist
+      if [[ -d "$dir" ]] && grep -v "$dir" <<< "$blacklist" >/dev/null; then
+        # add it to the mount list
+        auto_mounts="$auto_mounts --bind $dir $dir"
+      fi
+    done
+
+    exec ${bubblewrap}/bin/bwrap \
+      --dev /dev \
+      --proc /proc \
+      --chdir "$(pwd)" \
+      --unshare-all \
+      --share-net \
+      --die-with-parent \
+      --ro-bind /nix /nix \
+      --ro-bind /etc /host-etc \
+      $ro_mounts \
+      $auto_mounts \
+      ${init runScript}/bin/${name}-init ${init_args}
+  '';
+
+  bin = writeShellScriptBin name (bwrap_cmd { init_args = ''"$@"''; });
+
 in runCommandLocal name {
   inherit meta;
 
   passthru = passthru // {
     env = runCommandLocal "${name}-shell-env" {
-      shellHook = ''
-        exec ${chrootenv}/bin/chrootenv ${init runScript} "$(pwd)"
-      '';
+      shellHook = bwrap_cmd {};
     } ''
       echo >&2 ""
       echo >&2 "*** User chroot 'env' attributes are intended for interactive nix-shell sessions, not for building! ***"
@@ -40,10 +74,6 @@ in runCommandLocal name {
   };
 } ''
   mkdir -p $out/bin
-  cat <<EOF >$out/bin/${name}
-  #! ${stdenv.shell}
-  exec ${chrootenv}/bin/chrootenv ${init runScript} "\$(pwd)" "\$@"
-  EOF
-  chmod +x $out/bin/${name}
+  ln -s ${bin}/bin/${name} $out/bin/${name}
   ${extraInstallCommands}
 ''
diff --git a/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix b/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
index 083e7617b50..5e994abfd21 100644
--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
@@ -79,39 +79,42 @@ let
       ln -s ${etcProfile} profile
 
       # compatibility with NixOS
-      ln -s /host/etc/static static
+      ln -s /host-etc/static static
 
       # symlink some NSS stuff
-      ln -s /host/etc/passwd passwd
-      ln -s /host/etc/group group
-      ln -s /host/etc/shadow shadow
-      ln -s /host/etc/hosts hosts
-      ln -s /host/etc/resolv.conf resolv.conf
-      ln -s /host/etc/nsswitch.conf nsswitch.conf
+      ln -s /host-etc/passwd passwd
+      ln -s /host-etc/group group
+      ln -s /host-etc/shadow shadow
+      ln -s /host-etc/hosts hosts
+      ln -s /host-etc/resolv.conf resolv.conf
+      ln -s /host-etc/nsswitch.conf nsswitch.conf
 
       # symlink sudo and su stuff
-      ln -s /host/etc/login.defs login.defs
-      ln -s /host/etc/sudoers sudoers
-      ln -s /host/etc/sudoers.d sudoers.d
+      ln -s /host-etc/login.defs login.defs
+      ln -s /host-etc/sudoers sudoers
+      ln -s /host-etc/sudoers.d sudoers.d
 
       # symlink other core stuff
-      ln -s /host/etc/localtime localtime
-      ln -s /host/etc/zoneinfo zoneinfo
-      ln -s /host/etc/machine-id machine-id
-      ln -s /host/etc/os-release os-release
+      ln -s /host-etc/localtime localtime
+      ln -s /host-etc/zoneinfo zoneinfo
+      ln -s /host-etc/machine-id machine-id
+      ln -s /host-etc/os-release os-release
 
       # symlink PAM stuff
-      ln -s /host/etc/pam.d pam.d
+      ln -s /host-etc/pam.d pam.d
 
       # symlink fonts stuff
-      ln -s /host/etc/fonts fonts
+      ln -s /host-etc/fonts fonts
 
       # symlink ALSA stuff
-      ln -s /host/etc/asound.conf asound.conf
+      ln -s /host-etc/asound.conf asound.conf
 
       # symlink SSL certs
       mkdir -p ssl
-      ln -s /host/etc/ssl/certs ssl/certs
+      ln -s /host-etc/ssl/certs ssl/certs
+
+      # Fedora stores certs in another directory
+      ln -s /host-etc/pki pki
 
       # symlink /etc/mtab -> /proc/mounts (compat for old userspace progs)
       ln -s /proc/mounts mtab

From 2da4f24e2259d41419d14565bc371d34a227b599 Mon Sep 17 00:00:00 2001
From: Michael Eden <themichaeleden@gmail.com>
Date: Sun, 15 Sep 2019 09:29:53 -0400
Subject: [PATCH 3/9] fhs-userenv-bubblewrap: bind mount parts of host etc
 directly

---
 .../build-fhs-userenv-bubblewrap/default.nix  | 48 ++++++++++++++++++-
 .../build-fhs-userenv-bubblewrap/env.nix      | 38 ---------------
 2 files changed, 46 insertions(+), 40 deletions(-)

diff --git a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
index 784aa754df7..77958767c97 100644
--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
@@ -19,20 +19,64 @@ let
 
   chrootenv = callPackage ./chrootenv {};
 
+  etcBindFlags = let
+    files = [
+      # NixOS Compatibility
+      "static"
+      # Users, Groups, NSS
+      "passwd"
+      "group"
+      "shadow"
+      "hosts"
+      "resolv.conf"
+      "nsswitch.conf"
+      # Sudo & Su
+      "login.defs"
+      "sudoers"
+      "sudoers.d"
+      # Time
+      "localtime"
+      "zoneinfo"
+      # Other Core Stuff
+      "machine-id"
+      "os-release"
+      # PAM
+      "pam.d"
+      # Fonts
+      "fonts"
+      # ALSA
+      "asound.conf"
+      # SSL
+      "ssl/certs"
+      "pki"
+    ];
+  in concatStringsSep " \\\n  "
+  (map (file: "--ro-bind-try /etc/${file} /etc/${file}") files);
+
   init = run: writeShellScriptBin "${name}-init" ''
     source /etc/profile
     exec ${run} "$@"
   '';
 
   bwrap_cmd = { init_args ? "" }: ''
-    blacklist="/nix /dev /proc"
+    blacklist="/nix /dev /proc /etc"
     ro_mounts=""
     for i in ${env}/*; do
       path="/''${i##*/}"
+      if [[ $path == '/etc' ]]; then
+        continue
+      fi
       ro_mounts="$ro_mounts --ro-bind $i $path"
       blacklist="$blacklist $path"
     done
 
+    if [[ -d ${env}/etc ]]; then
+      for i in ${env}/etc/*; do
+        path="/''${i##*/}"
+        ro_mounts="$ro_mounts --ro-bind $i /etc$path"
+      done
+    fi
+
     auto_mounts=""
     # loop through all directories in the root
     for dir in /*; do
@@ -51,7 +95,7 @@ let
       --share-net \
       --die-with-parent \
       --ro-bind /nix /nix \
-      --ro-bind /etc /host-etc \
+      ${etcBindFlags} \
       $ro_mounts \
       $auto_mounts \
       ${init runScript}/bin/${name}-init ${init_args}
diff --git a/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix b/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
index 5e994abfd21..08f58471bf0 100644
--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
@@ -78,44 +78,6 @@ let
       # environment variables
       ln -s ${etcProfile} profile
 
-      # compatibility with NixOS
-      ln -s /host-etc/static static
-
-      # symlink some NSS stuff
-      ln -s /host-etc/passwd passwd
-      ln -s /host-etc/group group
-      ln -s /host-etc/shadow shadow
-      ln -s /host-etc/hosts hosts
-      ln -s /host-etc/resolv.conf resolv.conf
-      ln -s /host-etc/nsswitch.conf nsswitch.conf
-
-      # symlink sudo and su stuff
-      ln -s /host-etc/login.defs login.defs
-      ln -s /host-etc/sudoers sudoers
-      ln -s /host-etc/sudoers.d sudoers.d
-
-      # symlink other core stuff
-      ln -s /host-etc/localtime localtime
-      ln -s /host-etc/zoneinfo zoneinfo
-      ln -s /host-etc/machine-id machine-id
-      ln -s /host-etc/os-release os-release
-
-      # symlink PAM stuff
-      ln -s /host-etc/pam.d pam.d
-
-      # symlink fonts stuff
-      ln -s /host-etc/fonts fonts
-
-      # symlink ALSA stuff
-      ln -s /host-etc/asound.conf asound.conf
-
-      # symlink SSL certs
-      mkdir -p ssl
-      ln -s /host-etc/ssl/certs ssl/certs
-
-      # Fedora stores certs in another directory
-      ln -s /host-etc/pki pki
-
       # symlink /etc/mtab -> /proc/mounts (compat for old userspace progs)
       ln -s /proc/mounts mtab
     '';

From 8c91b3c5b76ca54e23ab2af29ae2546381155f7b Mon Sep 17 00:00:00 2001
From: Michael Eden <themichaeleden@gmail.com>
Date: Sun, 15 Sep 2019 15:41:48 -0400
Subject: [PATCH 4/9] fhs-userenv-bubblewrap: bind mount host's devfs

Allows us to talk to devices
---
 pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
index 77958767c97..267a0865f99 100644
--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
@@ -88,7 +88,7 @@ let
     done
 
     exec ${bubblewrap}/bin/bwrap \
-      --dev /dev \
+      --dev-bind /dev /dev \
       --proc /proc \
       --chdir "$(pwd)" \
       --unshare-all \

From b7c09b50ffabd19ba5ffe32d768e382254737a7c Mon Sep 17 00:00:00 2001
From: Atemu <atemu.main@gmail.com>
Date: Fri, 31 Jul 2020 14:52:12 +0200
Subject: [PATCH 5/9] steam: use buildFHSUserEnvBubblewrap

Fixes #92798
---
 pkgs/games/steam/default.nix                   | 5 +++--
 pkgs/games/steam/{chrootenv.nix => fhsenv.nix} | 0
 pkgs/top-level/all-packages.nix                | 6 ++++--
 3 files changed, 7 insertions(+), 4 deletions(-)
 rename pkgs/games/steam/{chrootenv.nix => fhsenv.nix} (100%)

diff --git a/pkgs/games/steam/default.nix b/pkgs/games/steam/default.nix
index 5aab54b8322..ff2c6e13288 100644
--- a/pkgs/games/steam/default.nix
+++ b/pkgs/games/steam/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, newScope }:
+{ pkgs, newScope, buildFHSUserEnv }:
 
 let
   callPackage = newScope self;
@@ -12,12 +12,13 @@ let
     steam-runtime-wrapped = callPackage ./runtime-wrapped.nix { };
     steam = callPackage ./steam.nix { };
     steam-fonts = callPackage ./fonts.nix { };
-    steam-chrootenv = callPackage ./chrootenv.nix {
+    steam-fhsenv = callPackage ./fhsenv.nix {
       glxinfo-i686 = pkgs.pkgsi686Linux.glxinfo;
       steam-runtime-wrapped-i686 =
         if steamArch == "amd64"
         then pkgs.pkgsi686Linux.steamPackages.steam-runtime-wrapped
         else null;
+      inherit buildFHSUserEnv;
     };
     steamcmd = callPackage ./steamcmd.nix { };
   };
diff --git a/pkgs/games/steam/chrootenv.nix b/pkgs/games/steam/fhsenv.nix
similarity index 100%
rename from pkgs/games/steam/chrootenv.nix
rename to pkgs/games/steam/fhsenv.nix
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f53d231b9c4..3dfa7f1f34b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -24673,9 +24673,11 @@ in
 
   stockfish = callPackage ../games/stockfish { };
 
-  steamPackages = dontRecurseIntoAttrs (callPackage ../games/steam { });
+  steamPackages = dontRecurseIntoAttrs (callPackage ../games/steam {
+    buildFHSUserEnv = buildFHSUserEnvBubblewrap;
+  });
 
-  steam = steamPackages.steam-chrootenv;
+  steam = steamPackages.steam-fhsenv;
 
   steam-run = steam.run;
   steam-run-native = (steam.override {

From 46d8f1a8a23a9b6e6cc9b12ff5af1e6bb83d53d1 Mon Sep 17 00:00:00 2001
From: Atemu <atemu.main@gmail.com>
Date: Fri, 31 Jul 2020 15:14:40 +0200
Subject: [PATCH 6/9] lutris: use buildFHSUserEnvBubblewrap

---
 pkgs/applications/misc/lutris/{chrootenv.nix => fhsenv.nix} | 0
 pkgs/top-level/all-packages.nix                             | 4 +++-
 2 files changed, 3 insertions(+), 1 deletion(-)
 rename pkgs/applications/misc/lutris/{chrootenv.nix => fhsenv.nix} (100%)

diff --git a/pkgs/applications/misc/lutris/chrootenv.nix b/pkgs/applications/misc/lutris/fhsenv.nix
similarity index 100%
rename from pkgs/applications/misc/lutris/chrootenv.nix
rename to pkgs/applications/misc/lutris/fhsenv.nix
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3dfa7f1f34b..1b3475ba449 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -21222,7 +21222,9 @@ in
     inherit (gnome3) gnome-desktop libgnome-keyring;
     wine = wineWowPackages.staging;
   };
-  lutris = callPackage ../applications/misc/lutris/chrootenv.nix { };
+  lutris = callPackage ../applications/misc/lutris/fhsenv.nix {
+    buildFHSUserEnv = buildFHSUserEnvBubblewrap;
+  };
   lutris-free = lutris.override {
     steamSupport = false;
   };

From 3f5157f12267e7502d0f5e6c913f18b007993377 Mon Sep 17 00:00:00 2001
From: Atemu <atemu.main@gmail.com>
Date: Fri, 31 Jul 2020 15:28:57 +0200
Subject: [PATCH 7/9] android-studio: use buildFHSUserEnvBubblewrap

---
 pkgs/applications/editors/android-studio/default.nix | 3 ++-
 pkgs/top-level/all-packages.nix                      | 4 +++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index c699f111e1e..c622a1fcead 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -1,4 +1,4 @@
-{ callPackage, makeFontsConf, gnome2 }:
+{ callPackage, makeFontsConf, gnome2, buildFHSUserEnv }:
 
 let
   mkStudio = opts: callPackage (import ./common.nix opts) {
@@ -6,6 +6,7 @@ let
       fontDirectories = [];
     };
     inherit (gnome2) GConf gnome_vfs;
+    inherit buildFHSUserEnv;
   };
   stableVersion = {
     version = "4.0.1.0"; # "Android Studio 4.0.1"
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1b3475ba449..0e23dee4469 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -19086,7 +19086,9 @@ in
   amsn = callPackage ../applications/networking/instant-messengers/amsn { };
 
   androidStudioPackages = recurseIntoAttrs
-    (callPackage ../applications/editors/android-studio { });
+    (callPackage ../applications/editors/android-studio {
+      buildFHSUserEnv = buildFHSUserEnvBubblewrap;
+    });
   android-studio = androidStudioPackages.stable;
 
   animbar = callPackage ../applications/graphics/animbar { };

From b1d86d0e51c9eafbb629f3cd782cfe954e687421 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 17 Aug 2020 08:49:34 +0100
Subject: [PATCH 8/9] build-fhs-user-env-bubblewrap: consistent camelCase

---
 .../build-fhs-userenv-bubblewrap/default.nix              | 8 ++++----
 pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix   | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
index 267a0865f99..c7cfd27d3fa 100644
--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
@@ -58,7 +58,7 @@ let
     exec ${run} "$@"
   '';
 
-  bwrap_cmd = { init_args ? "" }: ''
+  bwrapCmd = { initArgs ? "" }: ''
     blacklist="/nix /dev /proc /etc"
     ro_mounts=""
     for i in ${env}/*; do
@@ -98,17 +98,17 @@ let
       ${etcBindFlags} \
       $ro_mounts \
       $auto_mounts \
-      ${init runScript}/bin/${name}-init ${init_args}
+      ${init runScript}/bin/${name}-init ${initArgs}
   '';
 
-  bin = writeShellScriptBin name (bwrap_cmd { init_args = ''"$@"''; });
+  bin = writeShellScriptBin name (bwrapCmd { initArgs = ''"$@"''; });
 
 in runCommandLocal name {
   inherit meta;
 
   passthru = passthru // {
     env = runCommandLocal "${name}-shell-env" {
-      shellHook = bwrap_cmd {};
+      shellHook = bwrapCmd {};
     } ''
       echo >&2 ""
       echo >&2 "*** User chroot 'env' attributes are intended for interactive nix-shell sessions, not for building! ***"
diff --git a/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix b/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
index 08f58471bf0..8b2d46c4ae9 100644
--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
@@ -99,14 +99,14 @@ let
   };
 
   # setup library paths only for the targeted architecture
-  setupLibDirs_target = ''
+  setupLibDirsTarget = ''
     # link content of targetPaths
     cp -rsHf ${staticUsrProfileTarget}/lib lib
     ln -s lib lib${if is64Bit then "64" else "32"}
   '';
 
   # setup /lib, /lib32 and /lib64
-  setupLibDirs_multi = ''
+  setupLibDirsMulti = ''
     mkdir -m0755 lib32
     mkdir -m0755 lib64
     ln -s lib64 lib
@@ -124,8 +124,8 @@ let
     ln -Ls ${staticUsrProfileTarget}/lib/32/ld-linux.so.2 lib/
   '';
 
-  setupLibDirs = if isTargetBuild then setupLibDirs_target
-                                  else setupLibDirs_multi;
+  setupLibDirs = if isTargetBuild then setupLibDirsTarget
+                                  else setupLibDirsMulti;
 
   # the target profile is the actual profile that will be used for the chroot
   setupTargetProfile = ''

From dca51dc3fd6c6e49558296375093b62bf7b956e1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 18 Aug 2020 07:42:41 +0100
Subject: [PATCH 9/9] buildFHSUserEnvChrootenv: rename to buildFHSUserEnvChroot

---
 pkgs/top-level/all-packages.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0e23dee4469..101679891a9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -154,8 +154,8 @@ in
   buildEnv = callPackage ../build-support/buildenv { }; # not actually a package
 
   # TODO: eventually migrate everything to buildFHSUserEnvBubblewrap
-  buildFHSUserEnv = buildFHSUserEnvChrootenv;
-  buildFHSUserEnvChrootenv = callPackage ../build-support/build-fhs-userenv { };
+  buildFHSUserEnv = buildFHSUserEnvChroot;
+  buildFHSUserEnvChroot = callPackage ../build-support/build-fhs-userenv { };
   buildFHSUserEnvBubblewrap = callPackage ../build-support/build-fhs-userenv-bubblewrap { };
 
   buildMaven = callPackage ../build-support/build-maven.nix {};