From 2b58a6ab0d89d1883773d2bf6ec627a42dae1973 Mon Sep 17 00:00:00 2001 From: aszlig Date: Mon, 1 Dec 2014 03:13:51 +0100 Subject: [PATCH] virtualbox: Fix extension pack installation. With hardening, we need to go a bit further rather than just allowing /nix/store being world-writable. We now use fakeroot to make sure the VBoxExtPackHelperApp won't moan that the files are not owned by root. They are, but only outside of the chrooted build process. Another issue with using fakeroot is that it doesn't seem to cope well with arguments that contain spaces. That's why I've piped the call into ${stdenv.shell}. Now, the really gory and confusing part is the introduction of VBOX_PATH_APP_PRIVATE_ARCH_TOP and the change of VBOX_PATH_APP_PRIVATE. The VBOX_PATH_APP_PRIVATE_ARCH is *only* for modules and is checked by the hardened implementation against whether things like VMMR0.r0 or VBoxVMM.so reside in that directory. As a side note: I admit that the whole libexec directory is quite polluted with stuff that shouldn't be there, but for now we've broken enough things and will tear apart the whole structure at some day in the future[TM]. For the confusing part we have VBOX_PATH_APP_PRIVATE_ARCH_TOP, which _should_ be the same as VBOX_PATH_APP_PRIVATE_ARCH but unfortunately, the hardened implementation is checking against this directory (in IsValidBaseDir) for the extension pack(why!?). Of course, we could put even that into the libexec directory, somewhat similar as the official package, but after all, let's at least *try* to separate things. Signed-off-by: aszlig --- .../virtualization/virtualbox/default.nix | 35 +++++++++++-------- 1 file changed, 20 insertions(+), 15 deletions(-) diff --git a/pkgs/applications/virtualization/virtualbox/default.nix b/pkgs/applications/virtualization/virtualbox/default.nix index 960d8a0851d..cbdf13b2158 100644 --- a/pkgs/applications/virtualization/virtualbox/default.nix +++ b/pkgs/applications/virtualization/virtualbox/default.nix @@ -4,7 +4,7 @@ , xorriso, makeself, perl, pkgconfig , javaBindings ? false, jdk ? null , pythonBindings ? false, python ? null -, enableExtensionPack ? false, requireFile ? null, patchelf ? null +, enableExtensionPack ? false, requireFile ? null, patchelf ? null, fakeroot ? null , pulseSupport ? false, pulseaudio ? null , enableHardening ? true }: @@ -89,20 +89,21 @@ in stdenv.mkDerivation { configurePhase = '' sourcedir="$(pwd)" cat >> LocalConfig.kmk <