nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-02-07 12:44:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #133622 from erikarvstedt/fix-recursive-doas

Browse Source 
nixos/doas: fix recursive calls to doas
This commit is contained in:
Artturi 2021-08-12 22:39:24 +03:00 committed by GitHub
commit 17265bc319
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
nixos/tests/doas.nix
View File

@ -78,6 +78,13 @@ import ./make-test-python.nix (
'su - test7 -c "SSH_AUTH_SOCK=HOLEY doas env"' 'su - test7 -c "SSH_AUTH_SOCK=HOLEY doas env"'
): ):
raise Exception("failed to exclude SSH_AUTH_SOCK") raise Exception("failed to exclude SSH_AUTH_SOCK")
# Test that the doas setuid wrapper precedes the unwrapped version in PATH after
# calling doas.
# The PATH set by doas is defined in
# ../../pkgs/tools/security/doas/0001-add-NixOS-specific-dirs-to-safe-PATH.patch
with subtest("recursive calls to doas from subprocesses should succeed"):
machine.succeed('doas -u test0 sh -c "doas -u test0 true"')
''; '';
} }
) )

2
pkgs/tools/security/doas/0001-add-NixOS-specific-dirs-to-safe-PATH.patch
View File

@ -15,7 +15,7 @@ index e253905..2fdb20f 100644
main(int argc, char **argv) main(int argc, char **argv)
{ {
const char *safepath = "/bin:/sbin:/usr/bin:/usr/sbin:" const char *safepath = "/bin:/sbin:/usr/bin:/usr/sbin:"
+ "/run/current-system/sw/bin:/run/current-system/sw/sbin:/run/wrappers/bin:" + "/run/wrappers/bin:/run/current-system/sw/bin:/run/current-system/sw/sbin:"
"/usr/local/bin:/usr/local/sbin"; "/usr/local/bin:/usr/local/sbin";
const char *confpath = NULL; const char *confpath = NULL;
char *shargv[] = { NULL, NULL }; char *shargv[] = { NULL, NULL };