diff options
| author | Rickard Nilsson <rickynils@gmail.com> | 2016-07-14 20:54:06 +0200 |
|---|---|---|
| committer | Rickard Nilsson <rickynils@gmail.com> | 2016-07-14 20:54:06 +0200 |
| commit | a927709a35cee56f878f0f57a932e1a6e2ebe23b (patch) | |
| tree | a6f3fa20b48b96d74a8836eda008ead1ef62beda /pkgs/tools/networking/openssh | |
| parent | c1a600e8dfd5b114ec19a7b5699985f87691651b (diff) | |
| download | nixlib-a927709a35cee56f878f0f57a932e1a6e2ebe23b.tar nixlib-a927709a35cee56f878f0f57a932e1a6e2ebe23b.tar.gz nixlib-a927709a35cee56f878f0f57a932e1a6e2ebe23b.tar.bz2 nixlib-a927709a35cee56f878f0f57a932e1a6e2ebe23b.tar.lz nixlib-a927709a35cee56f878f0f57a932e1a6e2ebe23b.tar.xz nixlib-a927709a35cee56f878f0f57a932e1a6e2ebe23b.tar.zst nixlib-a927709a35cee56f878f0f57a932e1a6e2ebe23b.zip | |
openssh: Use the default privilege separation dir (/var/empty)
If running NixOS inside a container where the host's root-owned files and directories have been mapped to some other uid (like nobody), the ssh daemon fails to start, producing this error message: fatal: /nix/store/...-openssh-7.2p2/empty must be owned by root and not group or world-writable. The reason for this is that when openssh is built, we explicitly set `--with-privsep-path=$out/empty`. This commit removes that flag which causes the default directory /var/empty to be used instead. Since NixOS' activation script correctly sets up that directory, the ssh daemon now also works within containers that have a non-root-owned nix store.
Diffstat (limited to 'pkgs/tools/networking/openssh')
| -rw-r--r-- | pkgs/tools/networking/openssh/default.nix | 5 |
1 files changed, 0 insertions, 5 deletions
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix index 64b9fe98278b..8d893c6a57fa 100644 --- a/pkgs/tools/networking/openssh/default.nix +++ b/pkgs/tools/networking/openssh/default.nix @@ -66,11 +66,6 @@ stdenv.mkDerivation rec { ++ optional stdenv.isDarwin "--disable-libutil" ++ optional (!linkOpenssl) "--without-openssl"; - preConfigure = '' - configureFlagsArray+=("--with-privsep-path=$out/empty") - mkdir -p $out/empty - ''; - enableParallelBuilding = true; postInstall = '' |