Add --with-sandbox-shell configure flag

And add a 116 KiB ash shell from busybox to the release build. This
helps to make sandbox builds work out of the box on non-NixOS systems
and with diverted stores.

Makefile.config.in

@@ -28,6 +28,7 @@ localstatedir = @localstatedir@
mandir = @mandir@
pkglibdir = $(libdir)/$(PACKAGE_NAME)
prefix = @prefix@
sandbox_shell = @sandbox_shell@
storedir = @storedir@
sysconfdir = @sysconfdir@
doc_generate = @doc_generate@

configure.ac

@@ -240,6 +240,12 @@ fi
AC_SUBST(tarFlags)


AC_ARG_WITH(sandbox-shell, AC_HELP_STRING([--with-sandbox-shell=PATH],
  [path of a statically-linked shell to use as /bin/sh in sandboxes]),
  sandbox_shell=$withval)
AC_SUBST(sandbox_shell)


# Expand all variables in config.status.
test "$prefix" = NONE && prefix=$ac_default_prefix
test "$exec_prefix" = NONE && exec_prefix='${prefix}'

release-common.nix

@@ -0,0 +1,21 @@
{ pkgs }:

rec {
  sh = pkgs.busybox.override {
    useMusl = true;
    enableStatic = true;
    enableMinimal = true;
    extraConfig = ''
      CONFIG_ASH y
      CONFIG_ASH_BUILTIN_ECHO y
      CONFIG_ASH_BUILTIN_TEST y
      CONFIG_ASH_OPTIMIZE_FOR_SIZE y
    '';
  };

  configureFlags =
    [ "--disable-init-state"
      "--enable-gc"
      "--with-sandbox-shell=${sh}/bin/busybox"
    ];
}

release.nix

@@ -66,6 +66,8 @@ let

      with import <nixpkgs> { inherit system; };

      with import ./release-common.nix { inherit pkgs; };

      releaseTools.nixBuild {
        name = "nix";
        src = tarball;
@@ -83,11 +85,8 @@ let
              customMemoryManagement = false;
            });

        configureFlags = ''
          --disable-init-state
          --enable-gc
          --sysconfdir=/etc
        '';
        configureFlags = configureFlags ++
          [ "--sysconfdir=/etc" ];

        enableParallelBuilding = true;

shell.nix

@@ -2,6 +2,8 @@

with import <nixpkgs> {};

with import ./release-common.nix { inherit pkgs; };

(if useClang then clangStdenv else stdenv).mkDerivation {
  name = "nix";

@@ -22,10 +24,7 @@ with import <nixpkgs> {};
      perlPackages.DBDSQLite
    ];

  configureFlags =
    [ "--disable-init-state"
      "--enable-gc"
    ];
  inherit configureFlags;

  enableParallelBuilding = true;

src/libstore/globals.cc

@@ -47,8 +47,8 @@ Settings::Settings()
    auto s = getEnv("NIX_REMOTE_SYSTEMS");
    if (s != "") builderFiles = tokenizeString<Strings>(s, ":");

#if __linux__
    sandboxPaths = tokenizeString<StringSet>("/bin/sh=" BASH_PATH);
#if defined(__linux__) && defined(SANDBOX_SHELL)
    sandboxPaths = tokenizeString<StringSet>("/bin/sh=" SANDBOX_SHELL);
#endif

    allowedImpureHostPrefixes = tokenizeString<StringSet>(DEFAULT_ALLOWED_IMPURE_PREFIXES);

src/libstore/local.mk

@@ -27,7 +27,7 @@ libstore_CXXFLAGS = \
 -DNIX_CONF_DIR=\"$(sysconfdir)/nix\" \
 -DNIX_LIBEXEC_DIR=\"$(libexecdir)\" \
 -DNIX_BIN_DIR=\"$(bindir)\" \
 -DBASH_PATH="\"$(bash)\"" \
 -DSANDBOX_SHELL="\"$(sandbox_shell)\"" \
 -DLSOF=\"$(lsof)\"

$(d)/local-store.cc: $(d)/schema.sql.hh