Fixes #18124: atomically replace /var/setuid-wrappers/

[domenkozar]

Fixes #18124: atomically replace /var/setuid-wrappers/

Before this commit updating /var/setuid-wrappers/ folder introduced
a small window where NixOS activation scripts could be terminated
and resulted into empty /var/setuid-wrappers/ folder.

That's very unfortunate because one might lose sudo binary.

Instead we use two atomic operations mv and ln (as described in
https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/)
to achieve atomicity.

Since /var/setuid-wrappers is not a directory anymore, tmpfs mountpoints
were removed in installation scripts and in boot process.

Tested:

- upgrade /var/setuid-wrappers/ from folder to a symlink
- make sure /run/setuid-wrappers-dirs/ legacy symlink is really deleted

@edolstra the good news the following protection works:

    /* Make sure that we are being executed from the right location,
       i.e., `wrapperDir'.  This is to prevent someone from
       creating hard link `X' from some other location, along with a
       false `X.real' file, to allow arbitrary programs from being
       executed setuid.  */
    assert ((strncmp(self, wrapperDir, strlen(wrapperDir)) == 0) &&
            (self[strlen(wrapperDir)] == '/'));

but we have to update it now, should we just hardcode /run/setuid-wrappers-dirs/?

cc @shlevy

[shlevy]

(for @edolstra: That's the "I've reviewed this" 👍 )

[domenkozar]

@edolstra I've hardcoded the new wrappers dir path, let me know if we should take another path.

[teh]

This change breaks for me because mktemp sets permissions of drwx------ - any idea why this works for you?

[domenkozar]

Maybe different defaults? There were some fixes yesterday, is this still an issue for you?