This patch adds support for unprivileged user namespaces found in kernel
versions 3.8.0 and later. In case of Nix, this is especially useful to prevent
having to set up setuid wrappers.
The implementation details about this patch can be found at the top of the file
"sandbox_userns.patch". My first attempt of creating this patch was by modifying
the SUID sandbox. Unfortunately this didn't work out well, because in the event
of a sandbox failure, the host zygote process waits for an answer of the inner
zygote with no timeout. Even if I'd have set a timeout, this would have been
very ugly, giving users which don't have unprivileged user namespaces a delay on
startup.
An alternative approach to the mentioned problem would be to use select() on the
host zygote, watching for changes stdout or stderr and the synchronization
socket. But even that approach isn't feasible because it requires a whole bunch
of even more patching.
Patch was tested with older kernels (3.2.x, 3.7.x) and kernels without user
namespace support enabled, where in case the feature is unavailable it reverts
back to the previous behaviour (no zygote sandbox, only seccomp BPF).
In order to support all Chromium channels, I manually changed the first hunk of
the patch to not include the starting context of the diff, because there is a
whitespace change in more recent versions of the Chromium source tree.
See SVN revision 199882 for the change (revert in this case) in detail:
http://src.chromium.org/viewvc/chrome?view=revision&revision=199882
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
This is optional because you have to have an image of a Star Control II 3DO CD
image. I decided to hack together a small OperaFS (that's the proprietary
filesystem used with 3DO CD-ROMs) file extractor, which should possibly make
it as painless as possible to include those videos.
It may be a good idea to split off the haskell package into another attribute
set (possibly haskellPackages?), but I really don't think there is a need for
that, because it's really just UQM and 3DO specific.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
This is no feature change and only makes the installPhase look nicer and it now
doesn't exceed 80 characters in width anymore.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
This updates the following channels to the latest upstream versions:
beta: 27.0.1453.65 -> 27.0.1453.81 (builds fine, tested)
dev: 28.0.1485.0 -> 28.0.1500.5 (builds fine, tested)
For version 28, the reference to /usr/bin/gcc is now located in
third_party/WebKit/Source/core/core.gypi instead of the previous
third_party/WebKit/Source/core/core.gyp/core.gyp.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
This only ever worked because runInLinuxVM happened to call
overrideDerivation, which itself erroneously passed arbitrarily-added
attributes to the new call to derivation.
Hopefully this time Eelco won't have to revert my change ;)
Signed-off-by: Shea Levy <shea@shealevy.com>
