1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
|
{
lib,
fetchFromGitHub,
installShellFiles,
nix-update-script,
nixosTests,
versionCheckHook,
pam,
rustPlatform,
tzdata,
}:
rustPlatform.buildRustPackage (finalAttrs: {
pname = "sudo-rs";
version = "0.2.15";
src = fetchFromGitHub {
owner = "trifectatechfoundation";
repo = "sudo-rs";
tag = "v${finalAttrs.version}";
hash = "sha256-3uuBoFfhnwUCpoxkvv4chd4+i7bD81QSbAQE7iqgucE=";
};
cargoHash = "sha256-9dnMiCrMkV+5oy6MdLjuR26dp1vPj8aSETWJk9+b5sk=";
nativeBuildInputs = [ installShellFiles ];
buildInputs = [ pam ];
postPatch = ''
substituteInPlace src/system/audit.rs \
--replace-fail '/usr/share/zoneinfo' '/etc/zoneinfo' \
--replace-fail '/usr/share/lib/zoneinfo' '${tzdata}/share/zoneinfo'
'';
postInstall = ''
for man_fn in docs/man/*.man; do
man_fn_fixed="$(echo "$man_fn" | sed -e 's,\.man$,,')"
ln -vs $(basename "$man_fn") "$man_fn_fixed"
installManPage "$man_fn_fixed"
done
ln -s $out/share/man/man8/{sudo,sudoedit}.8.gz
ln -s $out/bin/{sudo,sudoedit}
'';
checkFlags = map (t: "--skip=${t}") [
# Those tests make path assumptions
"common::command::test::test_build_command_and_args"
"common::context::tests::test_build_run_context"
"common::resolve::test::canonicalization"
"common::resolve::tests::test_resolve_path"
"system::audit::test::test_traverse_secure_open_negative"
"system::audit::test::test_traverse_secure_open_positive"
"system::tests::kill_test"
# Assumes $SHELL is an actual shell
"su::context::tests::su_to_root"
# Attempts to access /etc files from the build sandbox
"system::audit::test::secure_open_is_predictable"
# Assume there is a `daemon` user and group
"system::interface::test::test_unix_group"
"system::interface::test::test_unix_user"
"system::tests::test_get_user_and_group_by_id"
# Store paths are not owned by root in the build sandbox, so the zoneinfo path
# doesn't pass the validations done by sudo-rs.
# This is not an issue at runtime, since there the zoneinfo path is owned by root.
"sudo::env::environment::tests::test_tzinfo"
# Unsure why those are failing
"env::tests::test_environment_variable_filtering"
"su::context::tests::invalid_shell"
];
nativeInstallCheckInputs = [ versionCheckHook ];
doInstallCheck = true;
# sudo binary fails because it checks if it is suid 0
versionCheckProgram = "${placeholder "out"}/bin/su";
postInstallCheck = ''
[ -e ${placeholder "out"}/share/man/man8/sudo.8.gz ] || \
( echo "Error: Some manpages might be missing!"; exit 1 )
'';
passthru = {
updateScript = nix-update-script { };
tests = nixosTests.sudo-rs;
};
meta = {
description = "Memory safe implementation of sudo and su";
homepage = "https://github.com/trifectatechfoundation/sudo-rs";
changelog = "${finalAttrs.meta.homepage}/blob/v${finalAttrs.version}/CHANGELOG.md";
license = with lib.licenses; [
asl20
mit
];
maintainers = with lib.maintainers; [
adamcstephens
nicoo
rvdp
];
mainProgram = "sudo";
platforms = lib.platforms.linux;
};
})
|
