vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

harness: prepend /run/wrappers/bin to service path so sudo wrapper resolves (#658 fixup)

Browse source
This commit is contained in:
damocles 2026-05-30 23:27:11 +02:00 • committed by Mara
commit c73c8389ec
2 changed files with 20 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nix/templates/agent-base.nix
View file

@ -15,7 +15,18 @@ in
# access to everything declared in `systemPackages` — including # access to everything declared in `systemPackages` — including
# anything an agent adds to its own `agent.nix` — without having to # anything an agent adds to its own `agent.nix` — without having to
# touch the service definition. # touch the service definition.
path = [ "/run/current-system/sw" ]; #
# `/run/wrappers/bin` is prepended so the `security.wrappers`
# setuid shims (notably `sudo`) resolve before the bare nix-store
# binaries in `/run/current-system/sw/bin`. Post-#658 the harness
# runs as the per-agent user — without the wrapper dir on PATH,
# `sudo` resolves to the un-setuid nix-store binary and refuses
# with "must be owned by uid 0 and have the setuid bit set" even
# when `hyperhive.user.passwordlessSudo = true` is configured.
path = [
"/run/wrappers/bin"
"/run/current-system/sw"
];
environment = { environment = {
SHELL = "${pkgs.bashInteractive}/bin/bash"; SHELL = "${pkgs.bashInteractive}/bin/bash";
# `HOME` defaults to `/` for systemd services without a User= # `HOME` defaults to `/` for systemd services without a User=

13
nix/templates/manager.nix
View file

@ -39,11 +39,14 @@ in
# populates /etc/profile, which systemd services don't inherit. # populates /etc/profile, which systemd services don't inherit.
HIVE_ASSETS_DIR = "${pkgs.hyperhive-assets}/share/hyperhive"; HIVE_ASSETS_DIR = "${pkgs.hyperhive-assets}/share/hyperhive";
}; };
# See note in agent-base.nix — `/run/current-system/sw` makes the # See note in agent-base.nix for the rationale on both entries —
# harness service PATH track `environment.systemPackages` so anything # `/run/wrappers/bin` so the setuid sudo shim resolves before the
# an agent adds to its own `agent.nix` is visible without editing the # bare nix-store binary (#658 fixup), `/run/current-system/sw`
# service definition. # so the harness PATH tracks `environment.systemPackages`.
path = [ "/run/current-system/sw" ]; path = [
"/run/wrappers/bin"
"/run/current-system/sw"
];
serviceConfig = { serviceConfig = {
ExecStart = "${pkgs.hyperhive}/bin/hive-m1nd serve"; ExecStart = "${pkgs.hyperhive}/bin/hive-m1nd serve";
Restart = "on-failure"; Restart = "on-failure";