artemist/lix
0
0
Fork 0
forked from lix-project/lix
Code Pull requests Activity

Fix #2162: use getaddrinfo instead of curl to preload NSS

Browse source
This commit is contained in:
Yorick 2018-06-12 13:05:14 +02:00
parent 27d1c052ae
commit 72a78beb34
No known key found for this signature in database
GPG key ID: D8D3CC6D951384DE
1 changed files with 8 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
src/libstore/build.cc
View file

@ -29,7 +29,9 @@
#include <sys/utsname.h>
#include <sys/select.h>
#include <sys/resource.h>
#include <sys/socket.h>
#include <fcntl.h>
#include <netdb.h>
#include <unistd.h>
#include <errno.h>
#include <cstring>
@ -1777,12 +1779,14 @@ static std::once_flag dns_resolve_flag;
static void preloadNSS() {
/* builtin:fetchurl can trigger a DNS lookup, which with glibc can trigger a dynamic library load of
one of the glibc NSS libraries in a sandboxed child, which will fail unless the library's already
been loaded in the parent. So we force a download of an invalid URL to force the NSS machinery to
been loaded in the parent. So we force a lookup of an invalid domain to force the NSS machinery to
load its lookup libraries in the parent before any child gets a chance to. */
std::call_once(dns_resolve_flag, []() {
DownloadRequest request("http://this.pre-initializes.the.dns.resolvers.invalid");
request.tries = 1; // We only need to do it once, and this also suppresses an annoying warning
try { getDownloader()->download(request); } catch (...) {}
struct addrinfo *res = NULL;
if (getaddrinfo("this.pre-initializes.the.dns.resolvers.invalid.", "http", NULL, &res) != 0) {
if (res) freeaddrinfo(res);
}
});
}