[Nix-dev] setuidwrapper questions

Jon Parris parrisj at gmail.com
Thu Mar 16 17:41:06 CET 2017


Hi All,

NixOS noob here. I have two questions relating to setuid.

First how do I create a wrapper for program (named buildenv) which is
outside of nixpkgs? Here are the constraits for buildenv.
* This is a internal tool - so I can't add it to the public nixpkgs.
* This tool is written in C, it calls clone and chroot.

Second buildenv is called with the wrong userid.

The buildenv tool stores the uid from getuid, chroots, then restores the userid.

What I see - buildenv is called with uid lroot.
$ whoami
parrisj
$ buildenv 3.3.1
$ whoami
lroot

Expected Behavior
$ buildenv 3.3.1
$ whoami
parrisj

How I kludged setuidwrapper to discover this.
1) Add a entry for buildenv in security.setuidPrograms in
/etc/nixos/configuration.nix
2) nixos-rebuild switch
3) Overwrite /var/setuidwrappers/buildenv.real with the corrrect path.

Thanks, Jon


More information about the nix-dev mailing list