consistent ownership/permissions for /run/service-state/**
This commit is contained in:
parent
4bd99df0f1
commit
59ce03630a
7 changed files with 57 additions and 38 deletions
|
@ -121,6 +121,9 @@ in {
|
||||||
root = {
|
root = {
|
||||||
gid = 0; usernames = ["root"];
|
gid = 0; usernames = ["root"];
|
||||||
};
|
};
|
||||||
|
system = {
|
||||||
|
gid = 1; usernames = ["root"];
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
filesystem = dir {
|
filesystem = dir {
|
||||||
|
|
|
@ -18,6 +18,9 @@ shift
|
||||||
mount -t proc none /proc
|
mount -t proc none /proc
|
||||||
mount -t sysfs none /sys
|
mount -t sysfs none /sys
|
||||||
|
|
||||||
|
mkdir -m 0750 /run/service-state
|
||||||
|
chgrp system /run/service-state
|
||||||
|
|
||||||
### If your services are managed by s6-rc:
|
### If your services are managed by s6-rc:
|
||||||
### (replace /run/service with your scandir)
|
### (replace /run/service with your scandir)
|
||||||
s6-rc-init /run/service -d -c /etc/s6-rc/compiled
|
s6-rc-init /run/service -d -c /etc/s6-rc/compiled
|
||||||
|
|
10
overlay.nix
10
overlay.nix
|
@ -89,6 +89,16 @@ final: prev: {
|
||||||
netlink-lua = final.callPackage ./pkgs/netlink-lua {};
|
netlink-lua = final.callPackage ./pkgs/netlink-lua {};
|
||||||
waitup = final.callPackage ./pkgs/waitup {};
|
waitup = final.callPackage ./pkgs/waitup {};
|
||||||
|
|
||||||
|
serviceFns = final.writeText "service-fns.sh" ''
|
||||||
|
output() { cat $1/.outputs/$2; }
|
||||||
|
output_path() { echo $(realpath $1/.outputs)/$2; }
|
||||||
|
mkoutputs() {
|
||||||
|
d=/run/service-state/$1
|
||||||
|
mkdir -m 2750 -p $d && chown root:system $d
|
||||||
|
echo $d
|
||||||
|
}
|
||||||
|
'';
|
||||||
|
|
||||||
# these are packages for the build system not the host/target
|
# these are packages for the build system not the host/target
|
||||||
|
|
||||||
tufted = final.callPackage ./pkgs/tufted {};
|
tufted = final.callPackage ./pkgs/tufted {};
|
||||||
|
|
|
@ -1,11 +1,12 @@
|
||||||
{
|
{
|
||||||
liminix
|
liminix
|
||||||
, dnsmasq
|
, dnsmasq
|
||||||
|
, serviceFns
|
||||||
, lib
|
, lib
|
||||||
}:
|
}:
|
||||||
{
|
{
|
||||||
user ? "dnsmasq"
|
user ? "dnsmasq"
|
||||||
, group ? "dnsmasq"
|
, group ? "system"
|
||||||
, interface
|
, interface
|
||||||
, upstreams ? []
|
, upstreams ? []
|
||||||
, ranges
|
, ranges
|
||||||
|
@ -19,6 +20,7 @@ in longrun {
|
||||||
inherit name;
|
inherit name;
|
||||||
dependencies = [ interface ];
|
dependencies = [ interface ];
|
||||||
run = ''
|
run = ''
|
||||||
|
. ${serviceFns}
|
||||||
${dnsmasq}/bin/dnsmasq \
|
${dnsmasq}/bin/dnsmasq \
|
||||||
--user=${user} \
|
--user=${user} \
|
||||||
--domain=${domain} \
|
--domain=${domain} \
|
||||||
|
|
|
@ -5,6 +5,7 @@
|
||||||
, ppp
|
, ppp
|
||||||
, pppoe
|
, pppoe
|
||||||
, writeAshScript
|
, writeAshScript
|
||||||
|
, serviceFns
|
||||||
} :
|
} :
|
||||||
let
|
let
|
||||||
inherit (liminix.services) longrun;
|
inherit (liminix.services) longrun;
|
||||||
|
@ -17,16 +18,15 @@ interface: {
|
||||||
let
|
let
|
||||||
name = "${interface.device}.pppoe";
|
name = "${interface.device}.pppoe";
|
||||||
ip-up = writeAshScript "ip-up" {} ''
|
ip-up = writeAshScript "ip-up" {} ''
|
||||||
outputs=/run/service-state/${name}/
|
. ${serviceFns}
|
||||||
mkdir -p $outputs
|
(cd $(mkoutputs ${name}); umask 0027
|
||||||
(cd $outputs
|
echo $1 > ifname
|
||||||
echo $1 > ifname
|
echo $2 > tty
|
||||||
echo $2 > tty
|
echo $3 > speed
|
||||||
echo $3 > speed
|
echo $4 > address
|
||||||
echo $4 > address
|
echo $5 > peer-address
|
||||||
echo $5 > peer-address
|
echo $DNS1 > ns1
|
||||||
echo $DNS1 > ns1
|
echo $DNS2 > ns2
|
||||||
echo $DNS1 > ns2
|
|
||||||
)
|
)
|
||||||
echo >/proc/self/fd/10
|
echo >/proc/self/fd/10
|
||||||
'';
|
'';
|
||||||
|
|
|
@ -10,33 +10,33 @@ interface: { ... } @ args:
|
||||||
let
|
let
|
||||||
name = "${interface.device}.udhcp";
|
name = "${interface.device}.udhcp";
|
||||||
script = writeShellScript "udhcp-notify" ''
|
script = writeShellScript "udhcp-notify" ''
|
||||||
action=$1
|
. ${serviceFns}
|
||||||
|
action=$1
|
||||||
|
|
||||||
set_address() {
|
set_address() {
|
||||||
ip address replace $ip/$mask dev $interface
|
ip address replace $ip/$mask dev $interface
|
||||||
dir=/run/service-state/${name}/
|
(cd $(mkoutputs ${name}); umask 0027
|
||||||
mkdir -p $dir
|
for i in lease mask ip router siaddr dns serverid subnet opt53 interface ; do
|
||||||
for i in lease mask ip router siaddr dns serverid subnet opt53 interface ; do
|
echo ''${!i} > $i
|
||||||
echo ''${!i} > $dir/$i
|
done)
|
||||||
done
|
}
|
||||||
}
|
case $action in
|
||||||
case $action in
|
deconfig)
|
||||||
deconfig)
|
ip address flush $interface
|
||||||
ip address flush $interface
|
ip link set up dev $interface
|
||||||
ip link set up dev $interface
|
;;
|
||||||
;;
|
bound)
|
||||||
bound)
|
# this doesn't actually replace, it adds a new address.
|
||||||
# this doesn't actually replace, it adds a new address.
|
set_address
|
||||||
set_address
|
;;
|
||||||
;;
|
renew)
|
||||||
renew)
|
set_address
|
||||||
set_address
|
;;
|
||||||
;;
|
nak)
|
||||||
nak)
|
echo "received NAK on $interface"
|
||||||
echo "received NAK on $interface"
|
;;
|
||||||
;;
|
esac
|
||||||
esac
|
'';
|
||||||
'';
|
|
||||||
in longrun {
|
in longrun {
|
||||||
inherit name;
|
inherit name;
|
||||||
run = "${busybox}/bin/udhcpc -f -i ${interface.device} -s ${script}";
|
run = "${busybox}/bin/udhcpc -f -i ${interface.device} -s ${script}";
|
||||||
|
|
|
@ -5,13 +5,14 @@
|
||||||
, busybox
|
, busybox
|
||||||
, callPackage
|
, callPackage
|
||||||
, writeScript
|
, writeScript
|
||||||
|
, serviceFns
|
||||||
}:
|
}:
|
||||||
let
|
let
|
||||||
inherit (builtins) concatStringsSep;
|
inherit (builtins) concatStringsSep;
|
||||||
output = service: name: "/run/service-state/${service.name}/${name}";
|
output = service: name: "/run/service-state/${service.name}/${name}";
|
||||||
serviceScript = commands : ''
|
serviceScript = commands : ''
|
||||||
#!${busybox}/bin/sh
|
#!${busybox}/bin/sh
|
||||||
output() { cat $1/.outputs/$2; }
|
. ${serviceFns}
|
||||||
${commands}
|
${commands}
|
||||||
'';
|
'';
|
||||||
service = {
|
service = {
|
||||||
|
|
Loading…
Reference in a new issue