diff options
| author | Christian Kögler <ck3d@gmx.de> | 2019-09-01 21:34:37 +0200 |
|---|---|---|
| committer | Franz Pletz <fpletz@fnordicwalking.de> | 2019-09-13 17:33:38 +0200 |
| commit | db9b5f5525225acf20f0f030e95532d192b3baac (patch) | |
| tree | 813ca632583174b5e1148cbcf667adaf304f4da9 | |
| parent | ba37b3c622da535a5b06ae5d05e37146b6f4143f (diff) | |
| download | nixlib-db9b5f5525225acf20f0f030e95532d192b3baac.tar nixlib-db9b5f5525225acf20f0f030e95532d192b3baac.tar.gz nixlib-db9b5f5525225acf20f0f030e95532d192b3baac.tar.bz2 nixlib-db9b5f5525225acf20f0f030e95532d192b3baac.tar.lz nixlib-db9b5f5525225acf20f0f030e95532d192b3baac.tar.xz nixlib-db9b5f5525225acf20f0f030e95532d192b3baac.tar.zst nixlib-db9b5f5525225acf20f0f030e95532d192b3baac.zip | |
nixos: deactivate immutablity for /var/empty in container
| -rw-r--r-- | nixos/modules/system/activation/activation-script.nix | 7 | ||||
| -rw-r--r-- | nixos/tests/systemd-machinectl.nix | 2 |
2 files changed, 9 insertions, 0 deletions
diff --git a/nixos/modules/system/activation/activation-script.nix b/nixos/modules/system/activation/activation-script.nix index 74c150a848d1..fe77094c52b7 100644 --- a/nixos/modules/system/activation/activation-script.nix +++ b/nixos/modules/system/activation/activation-script.nix @@ -184,7 +184,14 @@ in find /var/empty -mindepth 1 -delete chmod 0555 /var/empty chown root:root /var/empty + + ${ # reasons for not setting immutable flag: + # 1. flag is not changeable inside a container + # 2. systemd-nspawn can not perform chown in case of --private-users-chown + # then the owner is nobody and ssh will not start + optionalString (!config.boot.isContainer) '' ${pkgs.e2fsprogs}/bin/chattr -f +i /var/empty || true + ''} ''; system.activationScripts.usrbinenv = if config.environment.usrbinenv != null diff --git a/nixos/tests/systemd-machinectl.nix b/nixos/tests/systemd-machinectl.nix index 3438722e3218..091f855d043b 100644 --- a/nixos/tests/systemd-machinectl.nix +++ b/nixos/tests/systemd-machinectl.nix @@ -45,6 +45,8 @@ in { $machine->succeed("machinectl start ${containerName}"); $machine->waitUntilSucceeds("systemctl -M ${containerName} is-active default.target"); $machine->succeed("ping -n -c 1 ${containerName}"); + $machine->succeed("test `stat ${containerRoot}/var/empty -c %u%g` != 00"); + $machine->succeed("machinectl stop ${containerName}"); ''; }) |