From da18b9bc79a0c5a82c11fe303f35db4b38013e6e Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Sun, 8 Dec 2024 10:04:51 -0500
Subject: [PATCH] nixos/lib/make-squashfs: set root mode to 0755

default is 0777 which is likely undesirable in all situations
---
 nixos/lib/make-squashfs.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/lib/make-squashfs.nix b/nixos/lib/make-squashfs.nix
index 3f26f72c6267..87de2d60e341 100644
--- a/nixos/lib/make-squashfs.nix
+++ b/nixos/lib/make-squashfs.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation {
       # Generate the squashfs image.
       mksquashfs nix-path-registration $(cat $closureInfo/store-paths) $imgPath ${pseudoFilesArgs} \
         -no-hardlinks ${lib.optionalString noStrip "-no-strip"} -keep-as-directory -all-root -b 1048576 ${compFlag} \
-        -processors $NIX_BUILD_CORES
+        -processors $NIX_BUILD_CORES -root-mode 0755
     '' + lib.optionalString hydraBuildProduct ''
 
       mkdir -p $out/nix-support