yadunut/clan-core
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request 'fix secret generation on macos' (#1669) from fix-macos-deploy into main

Browse Source
This commit is contained in:
clan-bot
2024-06-30 06:25:39 +00:00
parent b5a04debf5 2e2358d850
commit 0f95bfd279
6 changed files with 101 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
nixosModules/clanCore/facts/default.nix
View File

@@ -121,26 +121,27 @@
export PATH="${lib.makeBinPath config.path}:${pkgs.coreutils}/bin"
# prepare sandbox user
mkdir -p /etc
${lib.optionalString (pkgs.stdenv.hostPlatform.isLinux) ''
# prepare sandbox user on platforms where this is supported
mkdir -p /etc
cat > /etc/group <<EOF
root:x:0:
nixbld:!:$(id -g):
nogroup:x:65534:
EOF
cat > /etc/group <<EOF
root:x:0:
nixbld:!:$(id -g):
nogroup:x:65534:
EOF
cat > /etc/passwd <<EOF
root:x:0:0:Nix build user:/build:/noshell
nixbld:x:$(id -u):$(id -g):Nix build user:/build:/noshell
nobody:x:65534:65534:Nobody:/:/noshell
EOF
cat > /etc/hosts <<EOF
127.0.0.1 localhost
::1 localhost
EOF
cat > /etc/passwd <<EOF
root:x:0:0:Nix build user:/build:/noshell
nixbld:x:$(id -u):$(id -g):Nix build user:/build:/noshell
nobody:x:65534:65534:Nobody:/:/noshell
EOF
cat > /etc/hosts <<EOF
127.0.0.1 localhost
::1 localhost
EOF
''}
${config.script}
'';
};

32
nixosModules/clanCore/zerotier/default.nix
View File

@@ -182,15 +182,33 @@ in
secret.zerotier-identity-secret = { };
generator.path = [
config.services.zerotierone.package
pkgs.fakeroot
pkgs.python3
];
generator.script = ''
python3 ${./generate.py} --mode network \
--ip "$facts/zerotier-ip" \
--identity-secret "$secrets/zerotier-identity-secret" \
--network-id "$facts/zerotier-network-id"
'';
generator.script =
let
library = "libfakeroot${pkgs.stdenv.hostPlatform.extensions.sharedLibrary}";
minifakeroot = pkgs.stdenv.mkDerivation {
name = "minifakeroot";
dontUnpack = true;
installPhase = ''
mkdir -p $out/lib
${
if pkgs.stdenv.isDarwin then
"$CC -dynamiclib -o $out/lib/libfakeroot.dylib ${./fake_root.c}"
else
"$CC -shared -o $out/lib/libfakeroot.so ${./fake_root.c}"
}
'';
};
varName = if pkgs.stdenv.isDarwin then "DYLD_INSERT_LIBRARIES" else "LD_PRELOAD";
in
''
export ${varName}=${minifakeroot}/lib/${library}
python3 ${./generate.py} --mode network \
--ip "$facts/zerotier-ip" \
--identity-secret "$secrets/zerotier-identity-secret" \
--network-id "$facts/zerotier-network-id"
'';
};
clan.core.state.zerotier.folders = [ "/var/lib/zerotier-one" ];

28
nixosModules/clanCore/zerotier/fake_root.c Normal file
View File

@@ -0,0 +1,28 @@
#include <stdint.h>
typedef uint32_t uid_t;
#ifdef __APPLE__
struct dyld_interpose {
const void * replacement;
const void * replacee;
};
#define WRAPPER(ret, name) static ret _fakeroot_wrapper_##name
#define WRAPPER_DEF(name) \
__attribute__((used)) static struct dyld_interpose _fakeroot_interpose_##name \
__attribute__((section("__DATA,__interpose"))) = { &_fakeroot_wrapper_##name, &name };
#else
#define WRAPPER(ret, name) ret name
#define WRAPPER_DEF(name)
#endif
WRAPPER(uid_t, geteuid)(const char * path, int flags, ...)
{
return 0; // Fake root
}
WRAPPER_DEF(geteuid)
WRAPPER(uid_t, getuid)(const char * path, int flags, ...)
{
return 0; // Fake root
}
WRAPPER_DEF(getuid)

3
nixosModules/clanCore/zerotier/generate.py
View File

@@ -111,12 +111,11 @@ def zerotier_controller() -> Iterator[ZerotierController]:
home = tempdir / "zerotier-one"
home.mkdir()
cmd = [
"fakeroot",
"--",
"zerotier-one",
f"-p{controller_port}",
str(home),
]
with subprocess.Popen(
cmd,
preexec_fn=os.setsid,