buildFHSUserEnvBubblewrap: use arrays for constructing argument list

Generally a cleaner way of doing it and prevents issues with spaces in paths

Used to fix #97234 but #101967 already didt this with a smaller scope
This commit is contained in:
Atemu 2020-09-20 17:02:08 +02:00
parent a322b32e9d
commit 74c4a55e10

View file

@ -50,7 +50,7 @@ let
"ssl/certs"
"pki"
];
in concatStringsSep " \\\n "
in concatStringsSep "\n "
(map (file: "--ro-bind-try /etc/${file} /etc/${file}") files);
init = run: writeShellScriptBin "${name}-init" ''
@ -59,21 +59,21 @@ let
'';
bwrapCmd = { initArgs ? "" }: ''
blacklist="/nix /dev /proc /etc"
ro_mounts=""
blacklist=(/nix /dev /proc /etc)
ro_mounts=()
for i in ${env}/*; do
path="/''${i##*/}"
if [[ $path == '/etc' ]]; then
continue
fi
ro_mounts="$ro_mounts --ro-bind $i $path"
blacklist="$blacklist $path"
ro_mounts+=(--ro-bind "$i" "$path")
blacklist+=("$path")
done
if [[ -d ${env}/etc ]]; then
for i in ${env}/etc/*; do
path="/''${i##*/}"
ro_mounts="$ro_mounts --ro-bind $i /etc$path"
ro_mounts+=(--ro-bind "$i" "/etc$path")
done
fi
@ -81,24 +81,27 @@ let
# loop through all directories in the root
for dir in /*; do
# if it is a directory and it is not in the blacklist
if [[ -d "$dir" ]] && grep -v "$dir" <<< "$blacklist" >/dev/null; then
if [[ -d "$dir" ]] && [[ ! "''${blacklist[@]}" =~ "$dir" ]]; then
# add it to the mount list
auto_mounts+=(--bind "$dir" "$dir")
fi
done
exec ${bubblewrap}/bin/bwrap \
--dev-bind /dev /dev \
--proc /proc \
--chdir "$(pwd)" \
--unshare-all \
--share-net \
--die-with-parent \
--ro-bind /nix /nix \
${etcBindFlags} \
$ro_mounts \
"''${auto_mounts[@]}" \
cmd=(
${bubblewrap}/bin/bwrap
--dev-bind /dev /dev
--proc /proc
--chdir "$(pwd)"
--unshare-all
--share-net
--die-with-parent
--ro-bind /nix /nix
${etcBindFlags}
"''${ro_mounts[@]}"
"''${auto_mounts[@]}"
${init runScript}/bin/${name}-init ${initArgs}
)
exec "''${cmd[@]}"
'';
bin = writeShellScriptBin name (bwrapCmd { initArgs = ''"$@"''; });