openssh: Use the default privilege separation dir (/var/empty) #17004
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
(This is a rewritten version of the reverted commit a927709, that disables the creation of /var/empty during build so that sandboxed builds also works. For more context, see NixOS#16966) If running NixOS inside a container where the host's root-owned files and directories have been mapped to some other uid (like nobody), the ssh daemon fails to start, producing this error message: fatal: /nix/store/...-openssh-7.2p2/empty must be owned by root and not group or world-writable. The reason for this is that when openssh is built, we explicitly set `--with-privsep-path=$out/empty`. This commit removes that flag which causes the default directory /var/empty to be used instead. Since NixOS' activation script correctly sets up that directory, the ssh daemon now also works within containers that have a non-root-owned nix store.
|
@rickynils, thanks for your PR! By analyzing the annotation information on this pull request, we identified @wkennington, @edolstra and @aneeshusa to be potential reviewers |
rickynils
referenced
this pull request
Jul 16, 2016
If running NixOS inside a container where the host's root-owned files and directories have been mapped to some other uid (like nobody), the ssh daemon fails to start, producing this error message: fatal: /nix/store/...-openssh-7.2p2/empty must be owned by root and not group or world-writable. The reason for this is that when openssh is built, we explicitly set `--with-privsep-path=$out/empty`. This commit removes that flag which causes the default directory /var/empty to be used instead. Since NixOS' activation script correctly sets up that directory, the ssh daemon now also works within containers that have a non-root-owned nix store.
andir
added a commit
to andir/nixpkgs
that referenced
this pull request
Feb 9, 2018
Update to latest stable version from the 5.1 branch. Also fixes compilation of the host driver on 4.15. Changelog: * GUI: mouse events did not reach host windows behind the transparent VM window (Mac OS X hosts only; bug NixOS#16246) * Audio: fixed accidental crashes when using the AC'97 sound emulation (bug NixOS#16959) * Audio: fixed crash when default input or output devices have changed (bugs NixOS#16968, NixOS#16969, NixOS#17004) * Audio: fixed recording when using the ALSA backend * Audio: fixed handle leak when using the OSS backend * E1000: fixed a crash related to VLAN traffic over internal network (5.1.26 regression; bug NixOS#16960) * NAT: apply --natbindip1 to TCP connections (bug NixOS#16478) * OVF: when importing an appliance with XHCI controller, don't add an OHCI controller. * Mac OS X hosts: fixed a GUI crash if Spotlight is used from file dialogs (5.1.20 regression; bugs NixOS#16935, NixOS#16953) * Linux hosts: fixed creating fixed sized VDI images (bug NixOS#17010) * Linux hosts / guests: fixes for Linux 4.4 of openSUSE Leap 42.3 (bug NixOS#16966) * Bridged networking: align outgoing packet at word boundary, preventing Windows host crash in MsLbfoProvider. * Linux Additions: kernel drm driver support for custom EL7 Linux 3.10 kernel * Solaris Additions: hide an informational message on the bootup console * GUI: translation updates * GUI: Fixed double mouse cursor when using mouse integration without Guest Additions, actually a Qt 5.6 bug fixed with QT 5.6.3 (Mac OS X hosts only; bug NixOS#15610) * Solaris hosts: allow increasing MTU size for host-only adapter to 9706 bytes to support jumbo frames * Linux hosts: glibc 2.26 compile fix * Windows Additions: 3D related crash fix (bugs NixOS#17082, NixOS#17092) * GUI: fixed occasional screen corruption when host screen resolution is changed * User interface: increase proposed disk size when creating new VMs for Windows 7 and newer * Serial: fixed broken communication with certain devices on Linux hosts * VMM: Fixed problems using 256MB VRAM in raw-mode VMs * Audio: added HDA support for more exotic guests (e.g. Haiku) * Audio: fixed playback with ALSA backend (5.1.28 regression) * USB/OHCI: fixed a problem where OHCI emulation might sporadically drop data transfers * Windows hosts: VirtualBoxManager in the Python API no longer calls CoUninitialize when destroyed * Linux hosts: fixed VBoxNetFlt kernel module compilation failure with Linux kernel 4.14 * Linux guests: fixed kernel module compilation and other problems with Linux kernel 4.14
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation for this change
(This is a rewritten version of the reverted commit
a927709, that disables the creation of
/var/empty during build so that sandboxed builds also works. For more
context, see #16966)
If running NixOS inside a container where the host's root-owned files
and directories have been mapped to some other uid (like nobody), the
ssh daemon fails to start, producing this error message:
fatal: /nix/store/...-openssh-7.2p2/empty must be owned by root and not group or world-writable.
The reason for this is that when openssh is built, we explicitly set
--with-privsep-path=$out/empty. This commit removes that flag whichcauses the default directory /var/empty to be used instead. Since NixOS'
activation script correctly sets up that directory, the ssh daemon now
also works within containers that have a non-root-owned nix store.
Things done
(nix.useChroot on NixOS,
or option
build-use-chrootinnix.confon non-NixOS)
nix-shell -p nox --run "nox-review wip"./result/bin/)