Simplify the PID namespace check: just try to mount /proc

Fixes #7783.
This commit is contained in:
Eelco Dolstra 2023-02-10 14:38:14 +01:00
parent 5597d68e2d
commit f094ba7386
5 changed files with 69 additions and 48 deletions

View file

@ -209,7 +209,7 @@ void LocalDerivationGoal::tryLocalBuild()
#if __linux__
if (useChroot) {
if (!mountNamespacesSupported() || !pidNamespacesSupported()) {
if (!mountAndPidNamespacesSupported()) {
if (!settings.sandboxFallback)
throw Error("this system does not support the kernel namespaces that are required for sandboxing; use '--no-sandbox' to disable sandboxing");
debug("auto-disabling sandboxing because the prerequisite namespaces are not available");

View file

@ -4,7 +4,7 @@
#include "util.hh"
#include "finally.hh"
#include <mntent.h>
#include <sys/mount.h>
namespace nix {
@ -33,60 +33,57 @@ bool userNamespacesSupported()
return false;
}
try {
Pid pid = startProcess([&]()
{
auto res = unshare(CLONE_NEWUSER);
_exit(res ? 1 : 0);
_exit(0);
}, {
.cloneFlags = CLONE_NEWUSER
});
bool supported = pid.wait() == 0;
auto r = pid.wait();
assert(!r);
} catch (SysError & e) {
debug("user namespaces do not work on this system: %s", e.msg());
return false;
}
if (!supported)
debug("user namespaces do not work on this system");
return supported;
return true;
}();
return res;
}
bool mountNamespacesSupported()
bool mountAndPidNamespacesSupported()
{
static auto res = [&]() -> bool
{
bool useUserNamespace = userNamespacesSupported();
try {
Pid pid = startProcess([&]()
{
auto res = unshare(CLONE_NEWNS | (useUserNamespace ? CLONE_NEWUSER : 0));
_exit(res ? 1 : 0);
/* Make sure we don't remount the parent's /proc. */
if (mount(0, "/", 0, MS_PRIVATE | MS_REC, 0) == -1)
_exit(1);
/* Test whether we can remount /proc. The kernel disallows
this if /proc is not fully visible, i.e. if there are
filesystems mounted on top of files inside /proc. See
https://lore.kernel.org/lkml/87tvsrjai0.fsf@xmission.com/T/. */
if (mount("none", "/proc", "proc", 0, 0) == -1)
_exit(2);
_exit(0);
}, {
.cloneFlags = CLONE_NEWNS | CLONE_NEWPID | (userNamespacesSupported() ? CLONE_NEWUSER : 0)
});
bool supported = pid.wait() == 0;
if (pid.wait()) {
debug("PID namespaces do not work on this system: cannot remount /proc");
return false;
}
if (!supported)
debug("mount namespaces do not work on this system");
return supported;
}();
return res;
}
bool pidNamespacesSupported()
{
static auto res = [&]() -> bool
{
/* Check whether /proc is fully visible, i.e. there are no
filesystems mounted on top of files inside /proc. If this
is not the case, then we cannot mount a new /proc inside
the sandbox that matches the sandbox's PID namespace.
See https://lore.kernel.org/lkml/87tvsrjai0.fsf@xmission.com/T/. */
auto fp = fopen("/proc/mounts", "r");
if (!fp) return false;
Finally delFP = [&]() { fclose(fp); };
while (auto ent = getmntent(fp))
if (hasPrefix(std::string_view(ent->mnt_dir), "/proc/")) {
debug("PID namespaces do not work because /proc is not fully visible; disabling sandboxing");
} catch (SysError & e) {
debug("mount namespaces do not work on this system: %s", e.msg());
return false;
}

View file

@ -6,9 +6,7 @@ namespace nix {
bool userNamespacesSupported();
bool mountNamespacesSupported();
bool pidNamespacesSupported();
bool mountAndPidNamespacesSupported();
#endif

View file

@ -36,6 +36,7 @@
#ifdef __linux__
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/mman.h>
#include <cmath>
#endif
@ -1051,9 +1052,17 @@ static pid_t doFork(bool allowVfork, std::function<void()> fun)
}
static int childEntry(void * arg)
{
auto main = (std::function<void()> *) arg;
(*main)();
return 1;
}
pid_t startProcess(std::function<void()> fun, const ProcessOptions & options)
{
auto wrapper = [&]() {
std::function<void()> wrapper = [&]() {
if (!options.allowVfork)
logger = makeSimpleLogger();
try {
@ -1073,7 +1082,23 @@ pid_t startProcess(std::function<void()> fun, const ProcessOptions & options)
_exit(1);
};
pid_t pid = doFork(options.allowVfork, wrapper);
pid_t pid = -1;
if (options.cloneFlags) {
// Not supported, since then we don't know when to free the stack.
assert(!(options.cloneFlags & CLONE_VM));
size_t stackSize = 1 * 1024 * 1024;
auto stack = (char *) mmap(0, stackSize,
PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, -1, 0);
if (stack == MAP_FAILED) throw SysError("allocating stack");
Finally freeStack([&]() { munmap(stack, stackSize); });
pid = clone(childEntry, stack + stackSize, options.cloneFlags | SIGCHLD, &wrapper);
} else
pid = doFork(options.allowVfork, wrapper);
if (pid == -1) throw SysError("unable to fork");
return pid;

View file

@ -301,6 +301,7 @@ struct ProcessOptions
bool dieWithParent = true;
bool runExitHandlers = false;
bool allowVfork = false;
int cloneFlags = 0; // use clone() with the specified flags (Linux only)
};
pid_t startProcess(std::function<void()> fun, const ProcessOptions & options = ProcessOptions());