lix-project/lix
20
57
Fork 31
Code Issues 347 Code Review (Gerrit) Projects 3 Releases Wiki Activity

Merge pull request #1813 from copumpkin/download-pre-resolve-url

Browse source 
Fix obscure corner case in name resolution for builtin:fetchurl in sandboxed environments
This commit is contained in:
Eelco Dolstra 2018-01-23 21:05:04 +01:00 committed by GitHub
parent c382866cd2 d43a8b25f0
commit b76e282da8
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 17 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
src/libstore/build.cc
View file

@ -6,6 +6,7 @@
#include "archive.hh"
#include "affinity.hh"
#include "builtins.hh"
#include "download.hh"
#include "finally.hh"
#include "compression.hh"
#include "json.hh"
@ -1777,6 +1778,19 @@ PathSet exportReferences(Store & store, PathSet storePaths)
return paths;
}
static std::once_flag dns_resolve_flag;
static void preloadNSS() {
/* builtin:fetchurl can trigger a DNS lookup, which with glibc can trigger a dynamic library load of
one of the glibc NSS libraries in a sandboxed child, which will fail unless the library's already
been loaded in the parent. So we force a download of an invalid URL to force the NSS machinery to
load its lookup libraries in the parent before any child gets a chance to. */
std::call_once(dns_resolve_flag, []() {
DownloadRequest request("http://this.pre-initializes.the.dns.resolvers.invalid");
request.tries = 1; // We only need to do it once, and this also suppresses an annoying warning
try { getDownloader()->download(request); } catch (...) {}
});
}
void DerivationGoal::startBuilder()
{
@ -1787,6 +1801,9 @@ void DerivationGoal::startBuilder()
% drv->platform % settings.thisSystem % drvPath);
}
if (drv->isBuiltin())
preloadNSS();
#if __APPLE__
additionalSandboxProfile = get(drv->env, "__sandboxProfile");
#endif