vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

harness: prepend /run/wrappers/bin to service path so sudo wrapper resolves (#658 fixup)

Browse source
This commit is contained in:
damocles 2026-05-30 23:27:11 +02:00 • committed by Mara
commit c73c8389ec
2 changed files with 20 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nix/templates/agent-base.nix
View file

@ -15,7 +15,18 @@ in
# access to everything declared in `systemPackages` — including
# anything an agent adds to its own `agent.nix` — without having to
# touch the service definition.
path = [ "/run/current-system/sw" ];
#
# `/run/wrappers/bin` is prepended so the `security.wrappers`
# setuid shims (notably `sudo`) resolve before the bare nix-store
# binaries in `/run/current-system/sw/bin`. Post-#658 the harness
# runs as the per-agent user — without the wrapper dir on PATH,
# `sudo` resolves to the un-setuid nix-store binary and refuses
# with "must be owned by uid 0 and have the setuid bit set" even
# when `hyperhive.user.passwordlessSudo = true` is configured.
path = [
"/run/wrappers/bin"
"/run/current-system/sw"
];
environment = {
SHELL = "${pkgs.bashInteractive}/bin/bash";
# `HOME` defaults to `/` for systemd services without a User=