This patch adds support for unprivileged user namespaces found in kernel
versions 3.8.0 and later. In case of Nix, this is especially useful to prevent
having to set up setuid wrappers.
The implementation details about this patch can be found at the top of the file
"sandbox_userns.patch". My first attempt of creating this patch was by modifying
the SUID sandbox. Unfortunately this didn't work out well, because in the event
of a sandbox failure, the host zygote process waits for an answer of the inner
zygote with no timeout. Even if I'd have set a timeout, this would have been
very ugly, giving users which don't have unprivileged user namespaces a delay on
startup.
An alternative approach to the mentioned problem would be to use select() on the
host zygote, watching for changes stdout or stderr and the synchronization
socket. But even that approach isn't feasible because it requires a whole bunch
of even more patching.
Patch was tested with older kernels (3.2.x, 3.7.x) and kernels without user
namespace support enabled, where in case the feature is unavailable it reverts
back to the previous behaviour (no zygote sandbox, only seccomp BPF).
In order to support all Chromium channels, I manually changed the first hunk of
the patch to not include the starting context of the diff, because there is a
whitespace change in more recent versions of the Chromium source tree.
See SVN revision 199882 for the change (revert in this case) in detail:
http://src.chromium.org/viewvc/chrome?view=revision&revision=199882
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
This is no feature change and only makes the installPhase look nicer and it now
doesn't exceed 80 characters in width anymore.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
This updates the following channels to the latest upstream versions:
beta: 27.0.1453.65 -> 27.0.1453.81 (builds fine, tested)
dev: 28.0.1485.0 -> 28.0.1500.5 (builds fine, tested)
For version 28, the reference to /usr/bin/gcc is now located in
third_party/WebKit/Source/core/core.gypi instead of the previous
third_party/WebKit/Source/core/core.gyp/core.gyp.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
See #490 discussion.
This reverts commit 1278859d31, reversing
changes made to 0c020c98f9.
Conflicts:
pkgs/desktops/xfce/core/xfce4-session.nix (take master)
pkgs/lib/misc.nix (auto)
This updates the channels to the following new versions:
beta: 27.0.1453.47 -> 27.0.1453.65 (builds fine, tested)
dev: 27.0.1453.47 -> 28.0.1485.0 (builds fine, tested)
As we now don't have any version below 26, this update drops all references to
all older versions as well.
In addition to that, the /usr/bin/gcc reference from:
third_party/WebKit/Source/core/core.gyp/core.gyp
Can now - starting at version 28 - be found in:
third_party/WebKit/Source/WebCore/WebCore.gyp/WebCore.gyp
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
gets rid of the dependency on the old gnupg1. and enables decryption
even if the gpg binary is not in the users environment.
warning: i don't know whether the switch from gnupg1 to gnupg
introduces any incompatibilities. this is a works for me patch.
stable: 26.0.1410.43 -> 26.0.1410.63 (builds fine, tested)
beta/dev: 27.0.1453.15/27.0.1453.12 -> 27.0.1453.47 (builds fine, tested)
This should bring beta and dev in par, as dev was older than the beta version.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
