firejail-disable-sandbox-check: init at 0.9.74firejail-disable-sandbox-check

4 files changed, 127 insertions, 103 deletions

diff --git a/pkgs/by-name/fi/firejail/disable-sandbox-check.nix b/pkgs/by-name/fi/firejail/disable-sandbox-check.nix
new file mode 100644
index 000000000000..d419fc6fb327
--- /dev/null
+++ b/pkgs/by-name/fi/firejail/disable-sandbox-check.nix
@@ -0,0 +1,8 @@
+import ./generic.nix {
+  pname = "firejail-disable-sandbox-check";
+  extraConfigureFlags = [ "--disable-sandbox-check" ];
+  extraLongDescription = ''
+    Builded with --disable-sandbox-check, which is only intended for
+    development.
+  '';
+}
diff --git a/pkgs/by-name/fi/firejail/generic.nix b/pkgs/by-name/fi/firejail/generic.nix
new file mode 100644
index 000000000000..41ec9d691e7b
--- /dev/null
+++ b/pkgs/by-name/fi/firejail/generic.nix
@@ -0,0 +1,116 @@
+{
+  pname
+, extraConfigureFlags ? [ ]
+, extraLongDescription ? ""
+}:
+
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pkg-config,
+  libapparmor,
+  which,
+  xdg-dbus-proxy,
+  nixosTests,
+}:
+
+stdenv.mkDerivation rec {
+  inherit pname;
+  version = "0.9.74";
+
+  src = fetchFromGitHub {
+    owner = "netblue30";
+    repo = "firejail";
+    rev = version;
+    sha256 = "sha256-BKEW2IWatzePGREAA479eaP6bJb1i2fRs/GZcyLinrM=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    libapparmor
+    which
+  ];
+
+  configureFlags = [ "--enable-apparmor" ] ++ extraConfigureFlags;
+
+  patches = [
+    # Adds the /nix directory when using an overlay.
+    # Required to run any programs under this mode.
+    ./mount-nix-dir-on-overlay.patch
+
+    # By default fbuilder hardcodes the firejail binary to the install path.
+    # On NixOS the firejail binary is a setuid wrapper available in $PATH.
+    ./fbuilder-call-firejail-on-path.patch
+  ];
+
+  prePatch = ''
+    # Fix the path to 'xdg-dbus-proxy' hardcoded in the 'common.h' file
+    substituteInPlace src/include/common.h \
+      --replace '/usr/bin/xdg-dbus-proxy' '${xdg-dbus-proxy}/bin/xdg-dbus-proxy'
+
+    # Workaround for regression introduced in 0.9.72 preventing usage of
+    # end-of-options indicator "--"
+    # See https://github.com/netblue30/firejail/issues/5659
+    substituteInPlace src/firejail/sandbox.c \
+      --replace " && !arg_doubledash" ""
+  '';
+
+  preConfigure = ''
+    sed -e 's@/bin/bash@${stdenv.shell}@g' -i $( grep -lr /bin/bash .)
+    sed -e "s@/bin/cp@$(which cp)@g" -i $( grep -lr /bin/cp .)
+  '';
+
+  preBuild = ''
+    sed -e "s@/etc/@$out/etc/@g" -e "/chmod u+s/d" -i Makefile
+  '';
+
+  # The profile files provided with the firejail distribution include `.local`
+  # profile files using relative paths. The way firejail works when it comes to
+  # handling includes is by looking target files up in `~/.config/firejail`
+  # first, and then trying `SYSCONFDIR`. The latter normally points to
+  # `/etc/filejail`, but in the case of nixos points to the nix store. This
+  # makes it effectively impossible to place any profile files in
+  # `/etc/firejail`.
+  #
+  # The workaround applied below is by creating a set of `.local` files which
+  # only contain respective includes to `/etc/firejail`. This way
+  # `~/.config/firejail` still takes precedence, but `/etc/firejail` will also
+  # be searched in second order. This replicates the behaviour from
+  # non-nixos platforms.
+  #
+  # See https://github.com/netblue30/firejail/blob/e4cb6b42743ad18bd11d07fd32b51e8576239318/src/firejail/profile.c#L68-L83
+  # for the profile file lookup implementation.
+  postInstall = ''
+    for local in $(grep -Eh '^include.*local$' $out/etc/firejail/*{.inc,.profile} | awk '{print $2}' | sort | uniq)
+    do
+      echo "include /etc/firejail/$local" >$out/etc/firejail/$local
+    done
+  '';
+
+  # At high parallelism, the build sometimes fails with:
+  # bash: src/fsec-optimize/fsec-optimize: No such file or directory
+  enableParallelBuilding = false;
+
+  passthru.tests = nixosTests.firejail;
+
+  meta = {
+    description = "Namespace-based sandboxing tool for Linux";
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ lib.maintainers.raskin ];
+    platforms = lib.platforms.linux;
+    homepage = "https://firejail.wordpress.com/";
+    longDescription = ''
+      Firejail is a SUID sandbox program that reduces the risk of security
+      breaches by restricting the running environment of untrusted
+      applications using Linux namespaces, seccomp-bpf and Linux capabilities.
+      The software includes sandbox profiles for a number of common Linux
+      programs.  Firejail should be added to the list of setuid programs in
+      the system configuration to work properly.
+    ''
+    + extraLongDescription;
+  };
+}
diff --git a/pkgs/by-name/fi/firejail/package.nix b/pkgs/by-name/fi/firejail/package.nix
index dcf9348383c4..f9d0d0f31e26 100644
--- a/pkgs/by-name/fi/firejail/package.nix
+++ b/pkgs/by-name/fi/firejail/package.nix
@@ -1,103 +1 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  pkg-config,
-  libapparmor,
-  which,
-  xdg-dbus-proxy,
-  nixosTests,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "firejail";
-  version = "0.9.74";
-
-  src = fetchFromGitHub {
-    owner = "netblue30";
-    repo = "firejail";
-    rev = version;
-    sha256 = "sha256-BKEW2IWatzePGREAA479eaP6bJb1i2fRs/GZcyLinrM=";
-  };
-
-  nativeBuildInputs = [
-    pkg-config
-  ];
-
-  buildInputs = [
-    libapparmor
-    which
-  ];
-
-  configureFlags = [
-    "--enable-apparmor"
-  ];
-
-  patches = [
-    # Adds the /nix directory when using an overlay.
-    # Required to run any programs under this mode.
-    ./mount-nix-dir-on-overlay.patch
-
-    # By default fbuilder hardcodes the firejail binary to the install path.
-    # On NixOS the firejail binary is a setuid wrapper available in $PATH.
-    ./fbuilder-call-firejail-on-path.patch
-  ];
-
-  prePatch = ''
-    # Fix the path to 'xdg-dbus-proxy' hardcoded in the 'common.h' file
-    substituteInPlace src/include/common.h \
-      --replace '/usr/bin/xdg-dbus-proxy' '${xdg-dbus-proxy}/bin/xdg-dbus-proxy'
-
-    # Workaround for regression introduced in 0.9.72 preventing usage of
-    # end-of-options indicator "--"
-    # See https://github.com/netblue30/firejail/issues/5659
-    substituteInPlace src/firejail/sandbox.c \
-      --replace " && !arg_doubledash" ""
-  '';
-
-  preConfigure = ''
-    sed -e 's@/bin/bash@${stdenv.shell}@g' -i $( grep -lr /bin/bash .)
-    sed -e "s@/bin/cp@$(which cp)@g" -i $( grep -lr /bin/cp .)
-  '';
-
-  preBuild = ''
-    sed -e "s@/etc/@$out/etc/@g" -e "/chmod u+s/d" -i Makefile
-  '';
-
-  # The profile files provided with the firejail distribution include `.local`
-  # profile files using relative paths. The way firejail works when it comes to
-  # handling includes is by looking target files up in `~/.config/firejail`
-  # first, and then trying `SYSCONFDIR`. The latter normally points to
-  # `/etc/filejail`, but in the case of nixos points to the nix store. This
-  # makes it effectively impossible to place any profile files in
-  # `/etc/firejail`.
-  #
-  # The workaround applied below is by creating a set of `.local` files which
-  # only contain respective includes to `/etc/firejail`. This way
-  # `~/.config/firejail` still takes precedence, but `/etc/firejail` will also
-  # be searched in second order. This replicates the behaviour from
-  # non-nixos platforms.
-  #
-  # See https://github.com/netblue30/firejail/blob/e4cb6b42743ad18bd11d07fd32b51e8576239318/src/firejail/profile.c#L68-L83
-  # for the profile file lookup implementation.
-  postInstall = ''
-    for local in $(grep -Eh '^include.*local$' $out/etc/firejail/*{.inc,.profile} | awk '{print $2}' | sort | uniq)
-    do
-      echo "include /etc/firejail/$local" >$out/etc/firejail/$local
-    done
-  '';
-
-  # At high parallelism, the build sometimes fails with:
-  # bash: src/fsec-optimize/fsec-optimize: No such file or directory
-  enableParallelBuilding = false;
-
-  passthru.tests = nixosTests.firejail;
-
-  meta = {
-    description = "Namespace-based sandboxing tool for Linux";
-    license = lib.licenses.gpl2Plus;
-    maintainers = [ lib.maintainers.raskin ];
-    platforms = lib.platforms.linux;
-    homepage = "https://firejail.wordpress.com/";
-  };
-}
+import ./generic.nix { pname = "firejail"; }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6c0ce59e7cf5..37b30cb3e6ea 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10117,6 +10117,8 @@ with pkgs;
   etcd_3_4 = callPackage ../servers/etcd/3.4.nix { };
   etcd_3_5 = callPackage ../servers/etcd/3.5 { };
 
+  firejail-disable-sandbox-check = callPackage ../by-name/fi/firejail/disable-sandbox-check.nix { };
+
   prosody = callPackage ../servers/xmpp/prosody {
     withExtraLibs = [ ];
     withExtraLuaPackages = _: [ ];