mirror of
https://github.com/NixOS/nixpkgs.git
synced 2026-08-26 18:24:53 +00:00
8f68c76d48
escapeSystemdPath relied on lib.strings.normalizePath, which only
collapses duplicate slashes and does not drop "." path components the
way systemd's path_simplify() does. A path like /mnt/./foo was thus
escaped to mnt-.-foo instead of mnt-foo, and systemd refused the
generated unit ("Where= setting doesn't match unit name").
Reimplement the simplification to match `systemd-escape --path` exactly:
drop "." and empty components, collapse a leading ".." run in an
absolute path to the root, and throw on any input systemd-escape
rejects (a non-leading "..", or a relative path that reduces to
nothing). Parity is checked against the systemd-escape binary over a
battery of edge cases and fuzzed inputs. While here, hoist the constant
escape table and partial applications out of the per-call lambda so
they are built once rather than on every call, making the function
~2.5x faster.
Resolves: https://github.com/NixOS/nixpkgs/issues/515270
Assisted-by: Claude:claude-opus-4-8
75 lines
2.6 KiB
Nix
75 lines
2.6 KiB
Nix
{ pkgs, ... }:
|
|
|
|
let
|
|
echoAll = pkgs.writeScript "echo-all" ''
|
|
#! ${pkgs.runtimeShell}
|
|
for s in "$@"; do
|
|
printf '%s\n' "$s"
|
|
done
|
|
'';
|
|
# deliberately using a local empty file instead of pkgs.emptyFile to have
|
|
# a non-store path in the test
|
|
args = [
|
|
"a%Nything"
|
|
"lang=\${LANG}"
|
|
";"
|
|
"/bin/sh -c date"
|
|
./empty-file
|
|
4.2
|
|
23
|
|
];
|
|
in
|
|
{
|
|
name = "systemd-escaping";
|
|
|
|
nodes.machine =
|
|
{
|
|
pkgs,
|
|
lib,
|
|
utils,
|
|
...
|
|
}:
|
|
{
|
|
systemd.services.echo =
|
|
assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ [ ] ])).success;
|
|
assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ { } ])).success;
|
|
assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ null ])).success;
|
|
assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ false ])).success;
|
|
assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ (_: _) ])).success;
|
|
# escapeSystemdPath simplifies the path like systemd-escape --path does:
|
|
# "." components are dropped and duplicate/leading/trailing slashes removed.
|
|
assert utils.escapeSystemdPath "/mnt/./foo" == "mnt-foo";
|
|
assert utils.escapeSystemdPath "/foo//bar/baz/" == "foo-bar-baz";
|
|
assert utils.escapeSystemdPath "/" == "-";
|
|
assert utils.escapeSystemdPath "" == "-";
|
|
assert utils.escapeSystemdPath "/.hidden/x" == "\\x2ehidden-x";
|
|
assert utils.escapeSystemdPath "/foo?bar" == "foo\\x3fbar";
|
|
# A leading ".." in an absolute path is the root's parent, i.e. the root.
|
|
assert utils.escapeSystemdPath "/../foo" == "foo";
|
|
# Non-normalized paths can't be escaped, matching systemd-escape.
|
|
assert !(builtins.tryEval (utils.escapeSystemdPath "/mnt/../foo")).success;
|
|
assert !(builtins.tryEval (utils.escapeSystemdPath ".")).success;
|
|
{
|
|
description = "Echo to the journal";
|
|
serviceConfig.Type = "oneshot";
|
|
serviceConfig.ExecStart = ''
|
|
${echoAll} ${utils.escapeSystemdExecArgs args}
|
|
'';
|
|
};
|
|
};
|
|
|
|
testScript = ''
|
|
machine.wait_for_unit("multi-user.target")
|
|
machine.succeed("systemctl start echo.service")
|
|
# skip the first 'Starting <service> ...' line
|
|
logs = machine.succeed("journalctl -u echo.service -o cat").splitlines()[1:]
|
|
assert "a%Nything" == logs[0]
|
|
assert "lang=''${LANG}" == logs[1]
|
|
assert ";" == logs[2]
|
|
assert "/bin/sh -c date" == logs[3]
|
|
assert "/nix/store/ij3gw72f4n5z4dz6nnzl1731p9kmjbwr-empty-file" == logs[4]
|
|
assert "4.2" in logs[5] # toString produces extra fractional digits!
|
|
assert "23" == logs[6]
|
|
'';
|
|
}
|