nrabulinski/lix
0
0
Fork 0
forked from lix-project/lix
Code Pull requests Activity

local-derivation-goal.cc: warn if failing due to max_user_namespaces==0

Browse source 
This commit uses `warn()` to notify the user if sandbox setup fails
with errno==EPERM and /proc/sys/user/max_user_namespaces is missing or
zero, since that is at least part of the reason why sandbox setup
failed.

Note that `echo -n 0 > /proc/sys/user/max_user_namespaces` or
equivalent at boot time has been the recommended mitigation for
several Linux LPE vulnerabilities over the past few years.  Many users
have applied this mitigation and then forgotten that they have done
so.
This commit is contained in:
Adam Joseph 2022-07-16 19:28:13 -07:00
parent 8ea3a911aa
commit 90830b1074
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/libstore/build/local-derivation-goal.cc
View file

@ -859,6 +859,8 @@ void LocalDerivationGoal::startBuilder()
to true (the default). */
if (settings.sandboxFallback)
_exit(1);
if (!userNamespacesEnabled && errno==EPERM)
warn("user namespaces appear to be disabled; they are required for sandboxing; check /proc/sys/user/max_user_namespaces");
/* Mention sandbox-fallback in the error message so the user
knows that having it disabled contributed to the
unrecoverability of this failure */