4f8f1c30cb
(This is a rewritten version of the reverted commit a927709a35cee56f878f0f57a932e1a6e2ebe23b, that disables the creation of /var/empty during build so that sandboxed builds also works. For more context, see https://github.com/NixOS/nixpkgs/pull/16966) If running NixOS inside a container where the host's root-owned files and directories have been mapped to some other uid (like nobody), the ssh daemon fails to start, producing this error message: fatal: /nix/store/...-openssh-7.2p2/empty must be owned by root and not group or world-writable. The reason for this is that when openssh is built, we explicitly set `--with-privsep-path=$out/empty`. This commit removes that flag which causes the default directory /var/empty to be used instead. Since NixOS' activation script correctly sets up that directory, the ssh daemon now also works within containers that have a non-root-owned nix store.
12 lines
707 B
Diff
12 lines
707 B
Diff
diff -ur openssh-7.2p2_orig/Makefile.in openssh-7.2p2/Makefile.in
|
|
--- openssh-7.2p2_orig/Makefile.in 2016-03-09 19:04:48.000000000 +0100
|
|
+++ openssh-7.2p2/Makefile.in 2016-07-16 09:56:05.643903293 +0200
|
|
@@ -301,7 +301,6 @@
|
|
$(srcdir)/mkinstalldirs $(DESTDIR)$(mandir)/$(mansubdir)5
|
|
$(srcdir)/mkinstalldirs $(DESTDIR)$(mandir)/$(mansubdir)8
|
|
$(srcdir)/mkinstalldirs $(DESTDIR)$(libexecdir)
|
|
- (umask 022 ; $(srcdir)/mkinstalldirs $(DESTDIR)$(PRIVSEP_PATH))
|
|
$(INSTALL) -m 0755 $(STRIP_OPT) ssh$(EXEEXT) $(DESTDIR)$(bindir)/ssh$(EXEEXT)
|
|
$(INSTALL) -m 0755 $(STRIP_OPT) scp$(EXEEXT) $(DESTDIR)$(bindir)/scp$(EXEEXT)
|
|
$(INSTALL) -m 0755 $(STRIP_OPT) ssh-add$(EXEEXT) $(DESTDIR)$(bindir)/ssh-add$(EXEEXT)
|