43 lines
1.7 KiB
Nix
43 lines
1.7 KiB
Nix
# Trusted host construction only. Authored Workers cannot choose the caller,
|
|
# reserved identities, engine directory or sandbox executable.
|
|
{
|
|
pkgs,
|
|
sandbox,
|
|
authorityUser ? "quixos-graph",
|
|
engineDirectory ? "/run/quixos-restricted-engines",
|
|
firstUid ? 610000,
|
|
identityCount ? 64,
|
|
}:
|
|
assert builtins.match "[a-z][a-z0-9_-]{0,63}" authorityUser != null;
|
|
assert builtins.match "/run/[a-zA-Z0-9_/-]+" engineDirectory != null;
|
|
assert !(pkgs.lib.hasInfix ".." engineDirectory);
|
|
assert !(pkgs.lib.hasSuffix "/" engineDirectory);
|
|
assert builtins.isInt firstUid && builtins.isInt identityCount;
|
|
assert firstUid >= 610000 && firstUid + identityCount <= 2147483647;
|
|
assert identityCount >= 1 && identityCount <= 64;
|
|
pkgs.runCommand "quixos-restricted-identity-launcher"
|
|
{
|
|
nativeBuildInputs = [
|
|
pkgs.stdenv.cc
|
|
pkgs.nodejs_24
|
|
];
|
|
QUIXOS_RESTRICTED_ENGINE_DIRECTORY = engineDirectory;
|
|
}
|
|
''
|
|
# Validate the complete generated filename with the shared UTF-8 policy,
|
|
# before compiling or installing a launcher for this configured /run root.
|
|
node --input-type=module <<'JS'
|
|
import { checkedSocketPath } from '${../socket-address.mjs}';
|
|
for (const filename of ["broker.sock", "engine.sock"])
|
|
checkedSocketPath(process.env.QUIXOS_RESTRICTED_ENGINE_DIRECTORY + "/qx-engine-XXXXXX/" + filename);
|
|
JS
|
|
mkdir -p "$out/bin"
|
|
$CC -O2 -Wall -Wextra -Werror ${./identity-launcher.c} \
|
|
-DSANDBOX_EXECUTABLE='"${sandbox}/bin/quixos-restricted-sandbox"' \
|
|
-DAUTHORITY_USER='"${authorityUser}"' \
|
|
-DENGINE_DIRECTORY='"${engineDirectory}"' \
|
|
-DENGINE_FIRST_UID=${toString firstUid} \
|
|
-DENGINE_IDENTITY_COUNT=${toString identityCount} \
|
|
-o "$out/bin/quixos-restricted-engine"
|
|
''
|