Merge pull request #6333 from kit-ty-kate/nixos-sandbox

Fix sandboxing support in NixOS
ocaml · Dec 12, 2024 · 8f48372 · 8f48372
2 parents a61bc92 + 07a3689
commit 8f48372
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/master_changes.md b/master_changes.md
@@ -86,6 +86,7 @@ users)
 
 ## Sandbox
   * Respect the `DUNE_CACHE_ROOT` environment variable if it exists [#6326 @smorimoto]
+  * Fix sandboxing support in NixOS [#6333 @kit-ty-kate]
 
 ## VCS
 

diff --git a/src/state/shellscripts/bwrap.sh b/src/state/shellscripts/bwrap.sh
@@ -68,6 +68,10 @@ for dir in /*; do
     *) add_sys_mounts "$dir";;
     esac
 done
+# NOTE: This is required for NixOS (see https://github.com/NixOS/nixpkgs/pull/363770)
+if [ -d /run/current-system/sw ]; then
+  add_sys_mounts /run/current-system/sw
+fi
 
 mount_linked_cache() {
   local l_cache=$1
-Original file line number
+Diff line change
@@ Expand Up / @@ -86,6 +86,7 @@ users) @@
     ## Sandbox
       * Respect the `DUNE_CACHE_ROOT` environment variable if it exists [#6326 @smorimoto]
+      * Fix sandboxing support in NixOS [#6333 @kit-ty-kate]
     ## VCS
@@ Expand Down @@