From 628066901e473c185da6f0aaf26ee826d2b4bd31 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9=20Lopez?= Date: Tue, 14 Oct 2025 22:20:42 +0200 Subject: [PATCH] glycin/sandbox: Adapt bwrap invocation to Guix MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Firstly, we use @bwrap@ so that we can substitute it with an absolute path to the bwrap binary. Next, we change the /usr bind to be optional since there can be no /usr in a Guix system (especially in the build daemon). Lastly, we add /gnu/store. I don’t think this is needed, but it is the upstream author’s wish with adding /nix/store. See also . Upstream-status: Not applicable. --- glycin/src/sandbox.rs | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/glycin/src/sandbox.rs b/glycin/src/sandbox.rs index 916a8f0..350ece3 100644 --- a/glycin/src/sandbox.rs +++ b/glycin/src/sandbox.rs @@ -271,7 +271,7 @@ impl Sandbox { } async fn bwrap_command(&self, seccomp_memfd: &Memfd) -> Result { - let mut command = Command::new("bwrap"); + let mut command = Command::new("@bwrap@"); command.args([ "--unshare-all", @@ -280,7 +280,7 @@ impl Sandbox { "--chdir", "/", // Make /usr available as read only - "--ro-bind", + "--ro-bind-try", "/usr", "/usr", // Make tmpfs dev available @@ -294,6 +294,10 @@ impl Sandbox { "--ro-bind-try", "/nix/store", "/nix/store", + // Add /gnu/store on systems with Guix + "--ro-bind-try", + "@storedir@", + "@storedir@", // Create a fake HOME for glib to not throw warnings "--tmpfs", "/tmp-home", -- 2.51.0