feat(archroot): add support for optional systemd-nspawn arguments
Warning: this has security implications.
Allow passing of optional command line args to systemd-nspawn for makechrootpkg builds. The use case is to allow various test suites to benefit from greater coverage by selectively allowing syscalls and/or capabilities that would otherwise be blocked by the standard systemd-nspawn container.
Check the PKGBUILD for a special array variable _nspawn_opts=(). If present, use the contents as additional args to systemd-nspawn. For example:
_nspawn_opts=(--keep-unit --bind-ro=/dev/kvm --system-call-filter="munlockall @keyring")
would grant QEMU access to KVM acceleration inside the container and
allow some syscalls required for make check
to pass.
Note: Use of --keep-unit
causes a harmless warning after 5f4fd52e:
"Machine and scope registration turned off, --slice= and --property= settings will have no effect."
Merge request reports
Activity
added scopeenhancement statuson-hold labels
No worries
Figured the env var approach wasn't going to be well received. The appeal was being able to encode the required info directly into the PKGBUILD. If accepted, it would have allowed getting rid of this kind of thing. Not to worry. I'll try out the CLI approach...