forked from clan/clan-core
Merge pull request 'fix secret generation on macos' (#1669) from fix-macos-deploy into main
This commit is contained in:
commit
0f95bfd279
@ -121,7 +121,8 @@
|
||||
|
||||
export PATH="${lib.makeBinPath config.path}:${pkgs.coreutils}/bin"
|
||||
|
||||
# prepare sandbox user
|
||||
${lib.optionalString (pkgs.stdenv.hostPlatform.isLinux) ''
|
||||
# prepare sandbox user on platforms where this is supported
|
||||
mkdir -p /etc
|
||||
|
||||
cat > /etc/group <<EOF
|
||||
@ -140,7 +141,7 @@
|
||||
127.0.0.1 localhost
|
||||
::1 localhost
|
||||
EOF
|
||||
|
||||
''}
|
||||
${config.script}
|
||||
'';
|
||||
};
|
||||
|
@ -182,10 +182,28 @@ in
|
||||
secret.zerotier-identity-secret = { };
|
||||
generator.path = [
|
||||
config.services.zerotierone.package
|
||||
pkgs.fakeroot
|
||||
pkgs.python3
|
||||
];
|
||||
generator.script = ''
|
||||
generator.script =
|
||||
let
|
||||
library = "libfakeroot${pkgs.stdenv.hostPlatform.extensions.sharedLibrary}";
|
||||
minifakeroot = pkgs.stdenv.mkDerivation {
|
||||
name = "minifakeroot";
|
||||
dontUnpack = true;
|
||||
installPhase = ''
|
||||
mkdir -p $out/lib
|
||||
${
|
||||
if pkgs.stdenv.isDarwin then
|
||||
"$CC -dynamiclib -o $out/lib/libfakeroot.dylib ${./fake_root.c}"
|
||||
else
|
||||
"$CC -shared -o $out/lib/libfakeroot.so ${./fake_root.c}"
|
||||
}
|
||||
'';
|
||||
};
|
||||
varName = if pkgs.stdenv.isDarwin then "DYLD_INSERT_LIBRARIES" else "LD_PRELOAD";
|
||||
in
|
||||
''
|
||||
export ${varName}=${minifakeroot}/lib/${library}
|
||||
python3 ${./generate.py} --mode network \
|
||||
--ip "$facts/zerotier-ip" \
|
||||
--identity-secret "$secrets/zerotier-identity-secret" \
|
||||
|
28
nixosModules/clanCore/zerotier/fake_root.c
Normal file
28
nixosModules/clanCore/zerotier/fake_root.c
Normal file
@ -0,0 +1,28 @@
|
||||
#include <stdint.h>
|
||||
typedef uint32_t uid_t;
|
||||
|
||||
#ifdef __APPLE__
|
||||
struct dyld_interpose {
|
||||
const void * replacement;
|
||||
const void * replacee;
|
||||
};
|
||||
#define WRAPPER(ret, name) static ret _fakeroot_wrapper_##name
|
||||
#define WRAPPER_DEF(name) \
|
||||
__attribute__((used)) static struct dyld_interpose _fakeroot_interpose_##name \
|
||||
__attribute__((section("__DATA,__interpose"))) = { &_fakeroot_wrapper_##name, &name };
|
||||
#else
|
||||
#define WRAPPER(ret, name) ret name
|
||||
#define WRAPPER_DEF(name)
|
||||
#endif
|
||||
|
||||
WRAPPER(uid_t, geteuid)(const char * path, int flags, ...)
|
||||
{
|
||||
return 0; // Fake root
|
||||
}
|
||||
WRAPPER_DEF(geteuid)
|
||||
|
||||
WRAPPER(uid_t, getuid)(const char * path, int flags, ...)
|
||||
{
|
||||
return 0; // Fake root
|
||||
}
|
||||
WRAPPER_DEF(getuid)
|
@ -111,12 +111,11 @@ def zerotier_controller() -> Iterator[ZerotierController]:
|
||||
home = tempdir / "zerotier-one"
|
||||
home.mkdir()
|
||||
cmd = [
|
||||
"fakeroot",
|
||||
"--",
|
||||
"zerotier-one",
|
||||
f"-p{controller_port}",
|
||||
str(home),
|
||||
]
|
||||
|
||||
with subprocess.Popen(
|
||||
cmd,
|
||||
preexec_fn=os.setsid,
|
||||
|
@ -3,6 +3,7 @@ import importlib
|
||||
import logging
|
||||
import os
|
||||
import subprocess
|
||||
import sys
|
||||
from collections.abc import Callable
|
||||
from pathlib import Path
|
||||
from tempfile import TemporaryDirectory
|
||||
@ -36,6 +37,30 @@ def read_multiline_input(prompt: str = "Finish with Ctrl-D") -> str:
|
||||
return proc.stdout
|
||||
|
||||
|
||||
def bubblewrap_cmd(generator: str, facts_dir: Path, secrets_dir: Path) -> list[str]:
|
||||
# fmt: off
|
||||
return nix_shell(
|
||||
[
|
||||
"nixpkgs#bash",
|
||||
"nixpkgs#bubblewrap",
|
||||
],
|
||||
[
|
||||
"bwrap",
|
||||
"--ro-bind", "/nix/store", "/nix/store",
|
||||
"--tmpfs", "/usr/lib/systemd",
|
||||
"--dev", "/dev",
|
||||
"--bind", str(facts_dir), str(facts_dir),
|
||||
"--bind", str(secrets_dir), str(secrets_dir),
|
||||
"--unshare-all",
|
||||
"--unshare-user",
|
||||
"--uid", "1000",
|
||||
"--",
|
||||
"bash", "-c", generator
|
||||
],
|
||||
)
|
||||
# fmt: on
|
||||
|
||||
|
||||
def generate_service_facts(
|
||||
machine: Machine,
|
||||
service: str,
|
||||
@ -70,27 +95,10 @@ def generate_service_facts(
|
||||
if machine.facts_data[service]["generator"]["prompt"]:
|
||||
prompt_value = prompt(machine.facts_data[service]["generator"]["prompt"])
|
||||
env["prompt_value"] = prompt_value
|
||||
# fmt: off
|
||||
cmd = nix_shell(
|
||||
[
|
||||
"nixpkgs#bash",
|
||||
"nixpkgs#bubblewrap",
|
||||
],
|
||||
[
|
||||
"bwrap",
|
||||
"--ro-bind", "/nix/store", "/nix/store",
|
||||
"--tmpfs", "/usr/lib/systemd",
|
||||
"--dev", "/dev",
|
||||
"--bind", str(facts_dir), str(facts_dir),
|
||||
"--bind", str(secrets_dir), str(secrets_dir),
|
||||
"--unshare-all",
|
||||
"--unshare-user",
|
||||
"--uid", "1000",
|
||||
"--",
|
||||
"bash", "-c", generator
|
||||
],
|
||||
)
|
||||
# fmt: on
|
||||
if sys.platform == "linux":
|
||||
cmd = bubblewrap_cmd(generator, facts_dir, secrets_dir)
|
||||
else:
|
||||
cmd = ["bash", "-c", generator]
|
||||
run(
|
||||
cmd,
|
||||
env=env,
|
||||
|
@ -15,7 +15,6 @@
|
||||
setuptools,
|
||||
sops,
|
||||
stdenv,
|
||||
fakeroot,
|
||||
rsync,
|
||||
bash,
|
||||
sshpass,
|
||||
@ -38,7 +37,6 @@ let
|
||||
runtimeDependencies = [
|
||||
bash
|
||||
nix
|
||||
fakeroot
|
||||
openssh
|
||||
sshpass
|
||||
zbar
|
||||
|
Loading…
Reference in New Issue
Block a user