From 7a8bdf766d97f0a72a35506d4111332dc11a8eac Mon Sep 17 00:00:00 2001 From: Yueh-Shun Li Date: Thu, 25 Apr 2024 08:46:28 +0800 Subject: [PATCH 1/3] apptainer, singularity: add mount to defaultPathInputs --- pkgs/applications/virtualization/singularity/generic.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/applications/virtualization/singularity/generic.nix b/pkgs/applications/virtualization/singularity/generic.nix index da7c8accf873..0a1c7f7a7bd1 100644 --- a/pkgs/applications/virtualization/singularity/generic.nix +++ b/pkgs/applications/virtualization/singularity/generic.nix @@ -44,6 +44,7 @@ in gpgme, libseccomp, libuuid, + mount, # This is for nvidia-container-cli nvidia-docker, openssl, @@ -185,6 +186,7 @@ in fakeroot fuse2fs # Mount ext3 filesystems go + mount # mount privileged-un-utils squashfsTools # mksquashfs unsquashfs # Make / unpack squashfs image squashfuse # squashfuse_ll squashfuse # Mount (without unpacking) a squashfs image without privileges From 2ab024029523a6239330b48b47878896dde5d201 Mon Sep 17 00:00:00 2001 From: Yueh-Shun Li Date: Wed, 13 Mar 2024 05:56:29 +0800 Subject: [PATCH 2/3] apptainer, singularity: refactor defaultPath substitution Add argument sourceFilesWithDefaultPaths to specify the "defaultPath"s to substitute. Passthru "sourceFilesWithDefaultPaths" for easier overriding. Use "--replace-fail" during defalutPath substitution. --- .../virtualization/singularity/generic.nix | 40 +++++++++++++++++-- .../virtualization/singularity/packages.nix | 14 +++++++ 2 files changed, 50 insertions(+), 4 deletions(-) diff --git a/pkgs/applications/virtualization/singularity/generic.nix b/pkgs/applications/virtualization/singularity/generic.nix index 0a1c7f7a7bd1..f27f58fda487 100644 --- a/pkgs/applications/virtualization/singularity/generic.nix +++ b/pkgs/applications/virtualization/singularity/generic.nix @@ -80,6 +80,20 @@ in externalLocalStateDir ? null, # Remove the symlinks to `singularity*` when projectName != "singularity" removeCompat ? false, + # The defaultPath values to substitute in each source files. + # + # `defaultPath` are PATH variables hard-coded inside Apptainer/Singularity + # binaries to search for third-party utilities, as a hardening for + # `$out/bin/starter-suid`. + # + # The upstream provided values are suitable for FHS-conformant environment. + # We substitute them and insert Nixpkgs-specific values. + # + # Example: + # { + # "path/to/source/file1" = [ "" "" ... ]; + # } + sourceFilesWithDefaultPaths ? { }, # Workaround #86349 # should be removed when the issue is resolved vendorHash ? _defaultGoVendorArgs.vendorHash, @@ -88,7 +102,6 @@ in }: let - defaultPathOriginal = "/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin:/usr/local/sbin"; privileged-un-utils = if ((newuidmapPath == null) && (newgidmapPath == null)) then null @@ -98,6 +111,12 @@ let ln -s ${lib.escapeShellArg newuidmapPath} "$out/bin/newuidmap" ln -s ${lib.escapeShellArg newgidmapPath} "$out/bin/newgidmap" ''); + + concatMapStringAttrsSep = + sep: f: attrs: + lib.concatMapStringsSep sep (name: f name attrs.${name}) (lib.attrNames attrs); + + addShellDoubleQuotes = s: lib.escapeShellArg ''"'' + s + lib.escapeShellArg ''"''; in (buildGoModule { inherit pname version src; @@ -201,8 +220,19 @@ in patchShebangs --build "$configureScript" makeit e2e scripts mlocal/scripts # Patching the hard-coded defaultPath by prefixing the packages in defaultPathInputs - substituteInPlace cmd/internal/cli/actions.go \ - --replace "defaultPath = \"${defaultPathOriginal}\"" "defaultPath = \"''${defaultPathInputs// /\/bin:}''${defaultPathInputs:+/bin:}${defaultPathOriginal}\"" + ${concatMapStringAttrsSep "\n" (fileName: originalDefaultPaths: '' + substituteInPlace ${lib.escapeShellArg fileName} \ + ${ + lib.concatMapStringsSep " \\\n " ( + originalDefaultPath: + lib.concatStringsSep " " [ + "--replace-fail" + (addShellDoubleQuotes (lib.escapeShellArg originalDefaultPath)) + (addShellDoubleQuotes ''$inputsDefaultPath''${inputsDefaultPath:+:}${lib.escapeShellArg originalDefaultPath}'') + ] + ) originalDefaultPaths + } + '') sourceFilesWithDefaultPaths} substituteInPlace internal/pkg/util/gpu/nvidia.go \ --replace \ @@ -238,7 +268,7 @@ in substituteInPlace "$out/bin/run-singularity" \ --replace "/usr/bin/env ${projectName}" "$out/bin/${projectName}" wrapProgram "$out/bin/${projectName}" \ - --prefix PATH : "''${defaultPathInputs// /\/bin:}''${defaultPathInputs:+/bin:}" + --prefix PATH : "$inputsDefaultPath" # Make changes in the config file ${lib.optionalString forceNvcCli '' substituteInPlace "$out/etc/${projectName}/${projectName}.conf" \ @@ -296,7 +326,9 @@ in }).overrideAttrs ( finalAttrs: prevAttrs: { + inputsDefaultPath = lib.makeBinPath finalAttrs.defaultPathInputs; passthru = prevAttrs.passthru or { } // { + inherit sourceFilesWithDefaultPaths; tests = { image-hello-cowsay = singularity-tools.buildImage { name = "hello-cowsay"; diff --git a/pkgs/applications/virtualization/singularity/packages.nix b/pkgs/applications/virtualization/singularity/packages.nix index bd7deb298d47..ee780b085c83 100644 --- a/pkgs/applications/virtualization/singularity/packages.nix +++ b/pkgs/applications/virtualization/singularity/packages.nix @@ -35,6 +35,12 @@ let # when building on a system with disabled unprivileged namespace. # See https://github.com/NixOS/nixpkgs/pull/215690#issuecomment-1426954601 defaultToSuid = null; + + sourceFilesWithDefaultPaths = { + "cmd/internal/cli/actions.go" = [ "/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin:/usr/local/sbin" ]; + "e2e/env/env.go" = [ "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ]; + "internal/pkg/util/env/env.go" = [ "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ]; + }; }; singularity = @@ -71,6 +77,14 @@ let # on UNIX-like platforms, # and only have --without-suid but not --with-suid. defaultToSuid = true; + + sourceFilesWithDefaultPaths = { + "cmd/internal/cli/actions.go" = [ "/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin:/usr/local/sbin" ]; + "e2e/env/env.go" = [ "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ]; + "internal/pkg/util/env/clean.go" = [ + "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + ]; + }; }; genOverridenNixos = From d09aedb1a06530d3a62650f14f78d21674fe1ce7 Mon Sep 17 00:00:00 2001 From: Yueh-Shun Li Date: Fri, 26 Apr 2024 14:55:31 +0800 Subject: [PATCH 3/3] singularity-tools.buildImage: increase default memSize Increase the default RAM size for image-building QEMU VM. Make singularity.tests.image-hello-cowsay build on aarch64-linux. --- pkgs/build-support/singularity-tools/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/build-support/singularity-tools/default.nix b/pkgs/build-support/singularity-tools/default.nix index c9e53a4cb706..cd10a9960421 100644 --- a/pkgs/build-support/singularity-tools/default.nix +++ b/pkgs/build-support/singularity-tools/default.nix @@ -45,7 +45,7 @@ rec { , diskSize ? 1024 , runScript ? "#!${stdenv.shell}\nexec /bin/sh" , runAsRoot ? null - , memSize ? 512 + , memSize ? 1024 , singularity ? defaultSingularity }: let