nix: fix /etc/ld-nix.so.preload sharing

diff --git a/flake.nix b/flake.nix
index 86d0ee5ea1d48efe9b22b286a61490422798b253..741f00e7cd47fedb4c7346ef69f3f3f9eba9be41 100644 (file)
--- a/flake.nix
+++ b/flake.nix
@@ -50,6 +50,8 @@ outputs = flakes: let
   localNixpkgsPatches = [
     #nixpkgs/patches/security.apparmor.diff
     #nixpkgs/patches/security.gnupg.diff
+    nixpkgs/patches/fix-ld-nix.diff
+    nixpkgs/patches/fix-ld-nix-apparmor.diff
   ];
   originPkgs = flakes.nixpkgs.legacyPackages."x86_64-linux";
   nixpkgsPath = originPkgs.applyPatches {

diff --git a/nixpkgs/patches/fix-ld-nix-apparmor.diff b/nixpkgs/patches/fix-ld-nix-apparmor.diff
new file mode 100644 (file)
index 0000000..7b756a1
--- /dev/null
+++ b/nixpkgs/patches/fix-ld-nix-apparmor.diff
@@ -0,0 +1,13 @@
+diff --git a/nixos/modules/config/malloc.nix b/nixos/modules/config/malloc.nix
+index 5c5752ef515..54ba3048fdb 100644
+--- a/nixos/modules/config/malloc.nix
++++ b/nixos/modules/config/malloc.nix
+@@ -90,7 +90,7 @@ in
+     security.apparmor.includes = {
+       "abstractions/base" = ''
+         r /etc/ld-nix.so.preload,
+-        r ${config.environment.etc."ld-nix.so.preload".source},
++        r ${config.environment.etc."ld-nix.${pkgs.glibc.src.outputHash}.so.preload".source},
+         mr ${providerLibPath},
+       '';
+     };

diff --git a/nixpkgs/patches/fix-ld-nix.diff b/nixpkgs/patches/fix-ld-nix.diff
new file mode 100644 (file)
index 0000000..0743c37
--- /dev/null
+++ b/nixpkgs/patches/fix-ld-nix.diff
@@ -0,0 +1,66 @@
+diff --git a/nixos/modules/config/malloc.nix b/nixos/modules/config/malloc.nix
+index 31a659ee83f..93089c220a2 100644
+--- a/nixos/modules/config/malloc.nix
++++ b/nixos/modules/config/malloc.nix
+@@ -84,7 +84,9 @@ in
+   };
+ 
+   config = mkIf (cfg.provider != "libc") {
+-    environment.etc."ld-nix.so.preload".text = ''
++    # See comment in pkgs/development/libraries/glibc/common.nix
++    # for an explanation about the name of this file.
++    environment.etc."ld-nix.${pkgs.glibc.src.outputHash}.so.preload".text = ''
+       ${providerLibPath}
+     '';
+   };
+diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
+index 0b2f34c7b76..e1349c0076b 100644
+--- a/pkgs/development/libraries/glibc/common.nix
++++ b/pkgs/development/libraries/glibc/common.nix
+@@ -68,9 +68,6 @@ stdenv.mkDerivation ({
+       /* Don't use /etc/ld.so.cache, for non-NixOS systems.  */
+       ./dont-use-system-ld-so-cache.patch
+ 
+-      /* Don't use /etc/ld.so.preload, but /etc/ld-nix.so.preload.  */
+-      ./dont-use-system-ld-so-preload.patch
+-
+       /* The command "getconf CS_PATH" returns the default search path
+          "/bin:/usr/bin", which is inappropriate on NixOS machines. This
+          patch extends the search path by "/run/current-system/sw/bin". */
+@@ -128,6 +125,18 @@ stdenv.mkDerivation ({
+       # nscd needs libgcc, and we don't want it dynamically linked
+       # because we don't want it to depend on bootstrap-tools libs.
+       echo "LDFLAGS-nscd += -static-libgcc" >> nscd/Makefile
++
++      # Don't use /etc/ld.so.preload, but /etc/ld-nix.${sha256}.so.preload.
++      # ${sha256} is included in the name
++      # in order to only share a same .so.preload between the programs
++      # built with that version of glibc,
++      # otherwise it could break programs
++      # requiring symbols from a more recent glibc
++      # than the one loaded by shared libraries in that file.
++      # This file may later be generated by a NixOS module,
++      # using pkgs.glibc.src.outputHash instead of sha256
++      substituteInPlace elf/rtld.c \
++       --replace /etc/ld.so.preload /etc/ld-nix.${sha256}.so.preload
+     ''
+     # FIXME: find a solution for infinite recursion in cross builds.
+     # For now it's hopefully acceptable that IDN from libc doesn't reliably work.
+diff --git a/pkgs/development/libraries/glibc/dont-use-system-ld-so-preload.patch b/pkgs/development/libraries/glibc/dont-use-system-ld-so-preload.patch
+deleted file mode 100644
+index 894e2a11cf8..00000000000
+--- a/pkgs/development/libraries/glibc/dont-use-system-ld-so-preload.patch
++++ /dev/null
+@@ -1,12 +0,0 @@
+-diff -ru glibc-2.20-orig/elf/rtld.c glibc-2.20/elf/rtld.c
+---- glibc-2.20-orig/elf/rtld.c        2014-09-07 10:09:09.000000000 +0200
+-+++ glibc-2.20/elf/rtld.c     2014-10-27 11:32:25.203043157 +0100
+-@@ -1513,7 +1513,7 @@
+-      open().  So we do this first.  If it succeeds we do almost twice
+-      the work but this does not matter, since it is not for production
+-      use.  */
+--  static const char preload_file[] = "/etc/ld.so.preload";
+-+  static const char preload_file[] = "/etc/ld-nix.so.preload";
+-   if (__glibc_unlikely (__access (preload_file, R_OK) == 0))
+-     {
+-       /* Read the contents of the file.  */