From ad7f06781bdc41b3c4c54526084ea41d81f4733e Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Sat, 16 Jul 2022 14:35:52 +0000
Subject: [PATCH] crosvm: precompile seccomp policy files

This saves crosvm having to compile them at runtime, and allows us to
catch more errors at build time.
---
 .../virtualization/crosvm/default.nix             | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/virtualization/crosvm/default.nix b/pkgs/applications/virtualization/crosvm/default.nix
index 8309b856936c..6b9143c776e3 100644
--- a/pkgs/applications/virtualization/crosvm/default.nix
+++ b/pkgs/applications/virtualization/crosvm/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, rustPlatform, fetchgit
-, pkg-config, wayland-scanner
+, minijail-tools, pkg-config, wayland-scanner
 , libcap, libdrm, libepoxy, minijail, virglrenderer, wayland, wayland-protocols
 , linux
 }:
@@ -29,7 +29,7 @@ in
 
     cargoLock.lockFile = ./Cargo.lock;
 
-    nativeBuildInputs = [ pkg-config wayland-scanner ];
+    nativeBuildInputs = [ minijail-tools pkg-config wayland-scanner ];
 
     buildInputs = [
       libcap libdrm libepoxy minijail virglrenderer wayland wayland-protocols
@@ -37,19 +37,24 @@ in
 
     postPatch = ''
       cp ${./Cargo.lock} Cargo.lock
-      sed -i "s|/usr/share/policy/crosvm/|$out/share/policy/|g" \
-             seccomp/*/*.policy
+      sed -i "s|/usr/share/policy/crosvm/|$PWD/seccomp/${arch}/|g" \
+          seccomp/${arch}/*.policy
     '';
 
     preBuild = ''
       export DEFAULT_SECCOMP_POLICY_DIR=$out/share/policy
+
+      for policy in seccomp/${arch}/*.policy; do
+          compile_seccomp_policy \
+              --default-action trap $policy ''${policy%.policy}.bpf
+      done
     '';
 
     buildFeatures = [ "default" "virgl_renderer" "virgl_renderer_next" ];
 
     postInstall = ''
       mkdir -p $out/share/policy/
-      cp seccomp/${arch}/* $out/share/policy/
+      cp -v seccomp/${arch}/*.bpf $out/share/policy/
     '';
 
     CROSVM_CARGO_TEST_KERNEL_BINARY =