My "local" pkgsrc category.
- tor-proxies - socat wrapper script to connect to smtp.yandex.ru over tor and ssh wrapper
- icc11 - historical Intel compiler
- *-chroot - launchers for chrooted packages
Clone this repository to your root pkgsrc directory.
This quick guide explains how to install www/firefox
on NetBSD into
chroot directory /home/webuser-chroot
and run it under webuser
user.
The guide assumes that www/firefox
is built with the following options:
PKG_OPTIONS.firefox= -dbus -alsa -pulseaudio oss
Your X(7)
must be reconfigured to listen tcp:
# .xserverrc
X -listen tcp
Don't forget to disable non-local hosts with xhost
or by adding
entries to /etc/X0.hosts
.
export TMPDIR=/tmp
export CHROOT=/home/webuser-chroot
export PACKAGES=/path/to/pkgsrc/packages
Run these commands as root
:
umask 022
for d in dev etc/openssl/certs tmp usr/pkg/etc/fontconfig var/db/pkg var/shm var/tmp webuser
do
mkdir -p "${CHROOT:?}/$d"
done
chown webuser:webuser "${CHROOT:?}/webuser"
Temporary directories and /var/shm
should be accessible to everyone
and they should have sticky flags set:
chmod a+rwxt "${CHROOT:?}/tmp" "${CHROOT:?}/var/tmp" "${CHROOT:?}/var/shm"
The above command also creates /var/shm
for the new shared memory API but
the current version (46.0.1) of www/firefox
still uses the old API. It case
it changes in a future, you should add a new mountpoint to /etc/fstab
:
tmpfs /home/webuser-chroot/var/shm tmpfs rw,noexec,nocoredump,-m1777,-sram%5
The next command is very important because your firefox process must have access to random bits. For some reason, firefox doesn't complain if these special files aren't accessible.
pax -rw /dev/random /dev/urandom /dev/null /dev/sound* /dev/mixer* "${CHROOT:?}"
chmod a+w "${CHROOT:?}/dev/null"
Next, create empty files in /etc
:
touch "${CHROOT:?}/etc/passwd" "${CHROOT:?}/etc/fstab" "${CHROOT:?}/etc/mime.types"
You also need /etc/resolv.conf
. If you run dns (for instance, net/dnsmasq
)
on your local machine, you can add localhost:
echo nameserver 127.0.0.1 > "${CHROOT:?}/etc/resolv.conf"
Some of www/firefox
dependencies are shared libaries from the
base NetBSD system. They can be listed with a special command
but it only works for installed packages. We install www/firefox
and fonts/dejavu-ttf
first and then go back to installing
the barebone base system.
export PKG_PATH="${PACKAGES:?}"
pkg_add -P "${CHROOT:?}" -K var/db/pkg firefox dejavu-ttf gnome-icon-theme gnome-theme
Now list all dependencies with pkg_info -Q REQUIRES
and install
them with pax -rw
:
pkg_info -K "${CHROOT:?}/var/db/pkg" -Q REQUIRES -a | grep -v /usr/pkg/ | pax -rw "${CHROOT:?}"
pkg_info -K "${CHROOT:?}/var/db/pkg" -Q REQUIRES -a | grep -v /usr/pkg/ | xargs readlink -f | pax -rw "${CHROOT:?}"
Install the runtime linker:
pax -rw /libexec/ld.elf_so /usr/libexec/ld.elf_so "${CHROOT:?}"
Install i18n
libraries and other i18n
files:
pax -rw /usr/lib/i18n /usr/share/i18n "${CHROOT:?}"
Install root certificates:
mozilla-rootcerts -d "${CHROOT:?}" install
Configure fonts:
cp "${CHROOT:?}/usr/pkg/share/examples/fontconfig/fonts.conf" "${CHROOT:?}/usr/pkg/etc/fontconfig/fonts.conf"
chroot "${CHROOT:?}" /usr/pkg/bin/fc-cache -f
Firefox complains about missing
/usr/pkg/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache
(version number
may be different). This file can be generated:
chroot "${CHROOT:?}" /usr/pkg/bin/gdk-pixbuf-query-loaders --update-cache
Packages in pkgsrc
are rarely split into subpackages like libxxx
,
xxx-dev
, xxx-doc
etc. This introduces some unnecessary dependencies
like lang/python
or lang/perl
. They can be removed with pkg_delete -f
:
pkg_delete -P "${CHROOT:?}" -K var/db/pkg -f perl python27 mozilla-rootcerts
Next, find suid and guid binaries:
find "${CHROOT:?}" -perm -4000 -o -perm -2000
and identify packages for deletion with pkg_info -F
(there are none for
the current version of www/firefox
):
pkg_info -K "${CHROOT:?}/var/db/pkg" -F /usr/pkg/bin/firefox
/usr/bin/env -i USER=webuser HOME=/webuser DISPLAY=127.0.0.1:0.0 \
/usr/sbin/chroot -u webuser /home/webuser-chroot /usr/pkg/bin/firefox
or install local/firefox-chroot
from this repository and run firefox-chroot
.
To generate a dependency graph of installed packages, run the following command as a regular user:
pkgdepgraph -d "${CHROOT:?}/var/db/pkg" | dot -Tsvg -o "${CHROOT:?}/tmp/pkgdepgraph.svg"