insync: fix bwrap namespaces

- share bwrap namespaces as possible with the user
This commit is contained in:
Miao, ZhiCheng 2023-08-13 15:20:13 +03:00
parent 63ad638743
commit e96a0b3c8b
No known key found for this signature in database
GPG key ID: 1080B4863AD0F5D1

View file

@ -1,6 +1,6 @@
{ lib { lib
, writeShellScript , writeShellScript
, buildFHSEnv , buildFHSEnvBubblewrap
, stdenvNoCC , stdenvNoCC
, fetchurl , fetchurl
, autoPatchelfHook , autoPatchelfHook
@ -40,11 +40,12 @@ let
}; };
insync-pkg = stdenvNoCC.mkDerivation { insync-pkg = stdenvNoCC.mkDerivation {
inherit pname version meta; name = "${pname}-pkg-${version}";
inherit version meta;
src = fetchurl { src = fetchurl {
# Find a binary from https://www.insynchq.com/downloads/linux#ubuntu. # Find a binary from https://www.insynchq.com/downloads/linux#ubuntu.
url = "https://cdn.insynchq.com/builds/linux/${pname}_${version}-lunar_amd64.deb"; url = "https://cdn.insynchq.com/builds/linux/insync_${version}-lunar_amd64.deb";
sha256 = "sha256-BxTFtQ1rAsOuhKnH5vsl3zkM7WOd+vjA4LKZGxl4jk0="; sha256 = "sha256-BxTFtQ1rAsOuhKnH5vsl3zkM7WOd+vjA4LKZGxl4jk0=";
}; };
@ -66,7 +67,7 @@ let
installPhase = '' installPhase = ''
runHook preInstall runHook preInstall
mkdir -p $out/bin $out/lib $out/share mkdir -p $out
cp -R usr/* $out/ cp -R usr/* $out/
# use system glibc # use system glibc
@ -75,6 +76,9 @@ let
# remove badly packaged plugins # remove badly packaged plugins
rm $out/lib/insync/PySide2/plugins/platforminputcontexts/libqtvirtualkeyboardplugin.so rm $out/lib/insync/PySide2/plugins/platforminputcontexts/libqtvirtualkeyboardplugin.so
# remove the unused vendor wrapper
rm $out/bin/insync
runHook postInstall runHook postInstall
''; '';
@ -82,37 +86,40 @@ let
dontStrip = true; dontStrip = true;
}; };
insync-fhsenv = buildFHSEnv { in buildFHSEnvBubblewrap {
name = "${pname}-${version}"; name = pname;
inherit meta; inherit meta;
# for including insync's xdg data dirs targetPkgs = pkgs: with pkgs; [
extraOutputsToInstall = [ "share" ]; insync-pkg
libudev0-shim
];
targetPkgs = pkgs: with pkgs; [ runScript = writeShellScript "insync-wrapper.sh" ''
insync-pkg
libudev0-shim
];
runScript = writeShellScript "insync-wrapper.sh" ''
# QT_STYLE_OVERRIDE was used to suppress a QT warning, it should have no actual effect for this binary. # QT_STYLE_OVERRIDE was used to suppress a QT warning, it should have no actual effect for this binary.
export QT_STYLE_OVERRIDE=Fusion echo Unsetting QT_STYLE_OVERRIDE=$QT_STYLE_OVERRIDE
echo Unsetting QT_QPA_PLATFORMTHEME=$QT_QPA_PLATFORMTHEME
unset QT_STYLE_OVERRIDE
unset QPA_PLATFORMTHEME
# xkb configuration needed: https://github.com/NixOS/nixpkgs/issues/236365 # xkb configuration needed: https://github.com/NixOS/nixpkgs/issues/236365
export XKB_CONFIG_ROOT=${xkeyboard_config}/share/X11/xkb/ export XKB_CONFIG_ROOT=${xkeyboard_config}/share/X11/xkb/
exec "${insync-pkg.outPath}/lib/insync/insync" "$@" echo XKB_CONFIG_ROOT=$XKB_CONFIG_ROOT
# For debuging:
# export QT_DEBUG_PLUGINS=1
# find -L /usr/share -name "*insync*"
exec /usr/lib/insync/insync "$@"
''; '';
# "insync start" command starts a daemon. # As intended by this bubble wrap, share as much namespaces as possible with user.
dieWithParent = false; unshareUser = false;
}; unshareIpc = false;
unsharePid = false;
in stdenvNoCC.mkDerivation { unshareNet = false;
inherit pname version meta; unshareUts = false;
unshareCgroup = false;
dontUnpack = true; # Since "insync start" command starts a daemon, this daemon should die with it.
installPhase = '' dieWithParent = false;
mkdir -p $out/bin
ln -s ${insync-fhsenv}/bin/${insync-fhsenv.name} $out/bin/insync
ln -s ${insync-pkg}/share $out/share
'';
} }