b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

nixos: deactivate immutablity for /var/empty in container

Browse source
This commit is contained in:
Christian Kögler 2019-09-01 21:34:37 +02:00 committed by Franz Pletz
parent ba37b3c622
commit db9b5f5525
No known key found for this signature in database
GPG key ID: 846FDED7792617B4
2 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
nixos/modules/system/activation/activation-script.nix
View file

@ -184,7 +184,14 @@ in
find /var/empty -mindepth 1 -delete
chmod 0555 /var/empty
chown root:root /var/empty
${ # reasons for not setting immutable flag:
# 1. flag is not changeable inside a container
# 2. systemd-nspawn can not perform chown in case of --private-users-chown
# then the owner is nobody and ssh will not start
optionalString (!config.boot.isContainer) ''
${pkgs.e2fsprogs}/bin/chattr -f +i /var/empty || true
''}
'';
system.activationScripts.usrbinenv = if config.environment.usrbinenv != null

2
nixos/tests/systemd-machinectl.nix
View file

@ -45,6 +45,8 @@ in {
$machine->succeed("machinectl start ${containerName}");
$machine->waitUntilSucceeds("systemctl -M ${containerName} is-active default.target");
$machine->succeed("ping -n -c 1 ${containerName}");
$machine->succeed("test `stat ${containerRoot}/var/empty -c %u%g` != 00");
$machine->succeed("machinectl stop ${containerName}");
'';
})