no, i don’t have real usecase of this apps. But let’s say i am writing an overlay for a propietary apps where it asks for sudo, and would write configs in somewhere in roots let’s say on /etc, of course, we don’t want that to happen, but how can i make this apps have specialized space for writing? had anyone solved this problem?
Even on nixos, /etc is writable. So preventing that isn’t actually totally necessary.
Generally speaking, it’s something you take on a case-by-case basis.
For some things, it’s just a matter of the expected location for the writable space being in an inappropriate place, such as in the output prefix. In that case, it’s generally a matter of patching the code to whatever degree is necessary to move the directory somewhere more appropriate.
For other things, it’s a matter of the program automatically “fixing” or “caching” something at runtime, and the best solution to that is often to just make sure it’s already “fixed”/“cached” during the derivation build itself.
Overlay filesystem - ArchWiki is one option I’ve used before. There’s also bind mounts, which I’ve also used, if you don’t need any program to have even read access to the corresponding directory in the “lower” filesystem - I wouldn’t recommend this for /etc of course, but a subdir of /etc may work.
1 Like
oof, that sounds hacky, but quite smart. I’d say nixpkgs needs to develop an overlayfs hooks or special functions. i guess i’d give it a try for overlayfs route
Overlay FS is often an overkill. I have /etc itself as a symlink into store; writeable parts of /etc/ are symlinks to specific directories inside /var/.
3 Likes
i actually understand that, was bit my mistake in explanation, but i am actually trying to solve a problem where an app wants to write at where it launcher was in the location
FIrst, try to find a way to induce the app to write elsewhere. If that fails, maybe try symlinking the binary into a writable location before execution using a wrapper shell script?
In some particularly unfortunate cases, you’ll need to copy or hardlink the binary and symlink whatever is around the binary (because it might look relative to /proc/self/exe)
3 Likes
it seems so yea.. i could think of some sort of rsync all required nessary file as well. Might as well just straight up copy because who knows it may also write itselfs up