From bc1d9fd8b5a14334af1d0455e6b4d595cae959d5 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 27 Jan 2023 15:25:56 +0100
Subject: [PATCH] Check whether we can use PID namespaces

In unprivileged podman containers, /proc is not fully visible (there
are other filesystems mounted on subdirectories of /proc). Therefore
we can't mount a new /proc in the sandbox that matches the PID
namespace of the sandbox. So this commit automatically disables
sandboxing if /proc is not fully visible.
---
 src/libstore/build/local-derivation-goal.cc |  6 ++--
 src/libutil/namespaces.cc                   | 37 ++++++++++++++++++---
 src/libutil/namespaces.hh                   |  2 ++
 3 files changed, 37 insertions(+), 8 deletions(-)

diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index 16955e326..a99da0b5f 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -209,10 +209,10 @@ void LocalDerivationGoal::tryLocalBuild()
 
     #if __linux__
     if (useChroot) {
-        if (!mountNamespacesSupported()) {
+        if (!mountNamespacesSupported() || !pidNamespacesSupported()) {
             if (!settings.sandboxFallback)
-                throw Error("this system does not support mount namespaces, which are required for sandboxing");
-            debug("auto-disabling sandboxing because mount namespaces are not available");
+                throw Error("this system does not support the kernel namespaces that are required for sandboxing");
+            debug("auto-disabling sandboxing because the prerequisite namespaces are not available");
             useChroot = false;
         }
     }
diff --git a/src/libutil/namespaces.cc b/src/libutil/namespaces.cc
index 0c3c3cbdd..222f0d11b 100644
--- a/src/libutil/namespaces.cc
+++ b/src/libutil/namespaces.cc
@@ -1,5 +1,8 @@
 #include "namespaces.hh"
 #include "util.hh"
+#include "finally.hh"
+
+#include <mntent.h>
 
 #if __linux__
 
@@ -7,10 +10,10 @@ namespace nix {
 
 bool userNamespacesSupported()
 {
-    static bool res = [&]() -> bool
+    static auto res = [&]() -> bool
     {
         if (!pathExists("/proc/self/ns/user")) {
-            notice("'/proc/self/ns/user' does not exist; your kernel was likely built without CONFIG_USER_NS=y, which is required for sandboxing");
+            debug("'/proc/self/ns/user' does not exist; your kernel was likely built without CONFIG_USER_NS=y");
             return false;
         }
 
@@ -18,7 +21,7 @@ bool userNamespacesSupported()
         if (!pathExists(maxUserNamespaces) ||
             trim(readFile(maxUserNamespaces)) == "0")
         {
-            notice("user namespaces appear to be disabled; they are required for sandboxing; check '/proc/sys/user/max_user_namespaces'");
+            debug("user namespaces appear to be disabled; check '/proc/sys/user/max_user_namespaces'");
             return false;
         }
 
@@ -26,7 +29,7 @@ bool userNamespacesSupported()
         if (pathExists(procSysKernelUnprivilegedUsernsClone)
             && trim(readFile(procSysKernelUnprivilegedUsernsClone)) == "0")
         {
-            notice("user namespaces appear to be disabled; they are required for sandboxing; check '/proc/sys/kernel/unprivileged_userns_clone'");
+            debug("user namespaces appear to be disabled; check '/proc/sys/kernel/unprivileged_userns_clone'");
             return false;
         }
 
@@ -43,7 +46,7 @@ bool userNamespacesSupported()
 
 bool mountNamespacesSupported()
 {
-    static bool res = [&]() -> bool
+    static auto res = [&]() -> bool
     {
         bool useUserNamespace = userNamespacesSupported();
 
@@ -58,6 +61,30 @@ bool mountNamespacesSupported()
     return res;
 }
 
+bool pidNamespacesSupported()
+{
+    static auto res = [&]() -> bool
+    {
+        /* Check whether /proc is fully visible, i.e. there are no
+           filesystems mounted on top of files inside /proc. If this
+           is not the case, then we cannot mount a new /proc inside
+           the sandbox that matches the sandbox's PID namespace.
+           See https://lore.kernel.org/lkml/87tvsrjai0.fsf@xmission.com/T/. */
+        auto fp = fopen("/proc/mounts", "r");
+        if (!fp) return false;
+        Finally delFP = [&]() { fclose(fp); };
+
+        while (auto ent = getmntent(fp))
+            if (hasPrefix(std::string_view(ent->mnt_dir), "/proc/")) {
+                debug("PID namespaces do not work because /proc is not fully visible; disabling sandboxing");
+                return false;
+            }
+
+        return true;
+    }();
+    return res;
+}
+
 }
 
 #endif
diff --git a/src/libutil/namespaces.hh b/src/libutil/namespaces.hh
index 4ed6cb683..ad7bb559e 100644
--- a/src/libutil/namespaces.hh
+++ b/src/libutil/namespaces.hh
@@ -6,4 +6,6 @@ bool userNamespacesSupported();
 
 bool mountNamespacesSupported();
 
+bool pidNamespacesSupported();
+
 }