31 lines
860 B
Nix
31 lines
860 B
Nix
|
{
|
||
|
|
pkgs,
|
||
|
|
runtime,
|
||
|
|
executable,
|
||
|
|
}:
|
||
|
|
let
|
||
|
|
closure = pkgs.closureInfo { rootPaths = [ runtime ]; };
|
||
|
|
filter =
|
||
|
|
pkgs.runCommand "quixos-restricted-seccomp"
|
||
|
|
{
|
||
|
|
nativeBuildInputs = [
|
||
|
|
pkgs.stdenv.cc
|
||
|
|
pkgs.pkg-config
|
||
|
|
];
|
||
|
|
buildInputs = [ pkgs.libseccomp ];
|
||
|
|
}
|
||
|
|
''
|
||
|
|
$CC -O2 -Wall -Wextra -Werror ${./seccomp.c} $(pkg-config --cflags --libs libseccomp) -o filter
|
||
|
|
./filter > "$out"
|
||
|
|
'';
|
||
|
|
in
|
||
|
|
pkgs.runCommand "quixos-restricted-sandbox" { nativeBuildInputs = [ pkgs.stdenv.cc ]; } ''
|
||
|
|
mkdir -p "$out/bin"
|
||
|
|
$CC -O2 -Wall -Wextra -Werror ${./sandbox.c} \
|
||
|
|
-DSANDBOX_BWRAP='"${pkgs.bubblewrap}/bin/bwrap"' \
|
||
|
|
-DSANDBOX_EXECUTABLE='"${executable}"' \
|
||
|
|
-DSANDBOX_FILTER='"${filter}"' \
|
||
|
|
-DSANDBOX_CLOSURE='"${closure}/store-paths"' \
|
||
|
|
-o "$out/bin/quixos-restricted-sandbox"
|
||
|
|
''
|