pyrox.dev
1{ lib
2, stdenv
3, fetchFromGitHub
4, fetchpatch
5, pkg-config
6, libapparmor
7, which
8, xdg-dbus-proxy
9, nixosTests
10}:
11
12stdenv.mkDerivation rec {
13 pname = "firejail";
14 version = "0.9.72";
15
16 src = fetchFromGitHub {
17 owner = "netblue30";
18 repo = "firejail";
19 rev = version;
20 sha256 = "sha256-XAlb6SSyY2S1iWDaulIlghQ16OGvT/wBCog95/nxkog=";
21 };
22
23 nativeBuildInputs = [
24 pkg-config
25 ];
26
27 buildInputs = [
28 libapparmor
29 which
30 ];
31
32 configureFlags = [
33 "--enable-apparmor"
34 ];
35
36 patches = [
37 # Adds the /nix directory when using an overlay.
38 # Required to run any programs under this mode.
39 ./mount-nix-dir-on-overlay.patch
40
41 # By default fbuilder hardcodes the firejail binary to the install path.
42 # On NixOS the firejail binary is a setuid wrapper available in $PATH.
43 ./fbuilder-call-firejail-on-path.patch
44 ];
45
46 prePatch = ''
47 # Fix the path to 'xdg-dbus-proxy' hardcoded in the 'common.h' file
48 substituteInPlace src/include/common.h \
49 --replace '/usr/bin/xdg-dbus-proxy' '${xdg-dbus-proxy}/bin/xdg-dbus-proxy'
50
51 # Workaround for regression introduced in 0.9.72 preventing usage of
52 # end-of-options indicator "--"
53 # See https://github.com/netblue30/firejail/issues/5659
54 substituteInPlace src/firejail/sandbox.c \
55 --replace " && !arg_doubledash" ""
56 '';
57
58 preConfigure = ''
59 sed -e 's@/bin/bash@${stdenv.shell}@g' -i $( grep -lr /bin/bash .)
60 sed -e "s@/bin/cp@$(which cp)@g" -i $( grep -lr /bin/cp .)
61 '';
62
63 preBuild = ''
64 sed -e "s@/etc/@$out/etc/@g" -e "/chmod u+s/d" -i Makefile
65 '';
66
67 # The profile files provided with the firejail distribution include `.local`
68 # profile files using relative paths. The way firejail works when it comes to
69 # handling includes is by looking target files up in `~/.config/firejail`
70 # first, and then trying `SYSCONFDIR`. The latter normally points to
71 # `/etc/filejail`, but in the case of nixos points to the nix store. This
72 # makes it effectively impossible to place any profile files in
73 # `/etc/firejail`.
74 #
75 # The workaround applied below is by creating a set of `.local` files which
76 # only contain respective includes to `/etc/firejail`. This way
77 # `~/.config/firejail` still takes precedence, but `/etc/firejail` will also
78 # be searched in second order. This replicates the behaviour from
79 # non-nixos platforms.
80 #
81 # See https://github.com/netblue30/firejail/blob/e4cb6b42743ad18bd11d07fd32b51e8576239318/src/firejail/profile.c#L68-L83
82 # for the profile file lookup implementation.
83 postInstall = ''
84 for local in $(grep -Eh '^include.*local$' $out/etc/firejail/*{.inc,.profile} | awk '{print $2}' | sort | uniq)
85 do
86 echo "include /etc/firejail/$local" >$out/etc/firejail/$local
87 done
88 '';
89
90 # At high parallelism, the build sometimes fails with:
91 # bash: src/fsec-optimize/fsec-optimize: No such file or directory
92 enableParallelBuilding = false;
93
94 passthru.tests = nixosTests.firejail;
95
96 meta = {
97 description = "Namespace-based sandboxing tool for Linux";
98 license = lib.licenses.gpl2Plus;
99 maintainers = [ lib.maintainers.raskin ];
100 platforms = lib.platforms.linux;
101 homepage = "https://firejail.wordpress.com/";
102 };
103}