puck/lix
0
0
Fork 0
forked from lix-project/lix
Code Pull requests Activity

use per-derivation sandbox profiles

Browse source
This commit is contained in:
Jude Taylor 2015-11-12 19:00:16 -08:00
parent 9ee15abe30
commit 8a7f0dfd68
1 changed files with 36 additions and 25 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

61
src/libstore/build.cc
View file

@ -778,6 +778,8 @@ private:
DirsInChroot dirsInChroot; DirsInChroot dirsInChroot;
typedef map<string, string> Environment; typedef map<string, string> Environment;
Environment env; Environment env;
typedef string SandboxProfile;
SandboxProfile additionalSandboxProfile;
/* Hash rewriting. */ /* Hash rewriting. */
HashRewrites rewritesToTmp, rewritesFromTmp; HashRewrites rewritesToTmp, rewritesFromTmp;
@ -1919,30 +1921,34 @@ void DerivationGoal::startBuilder()
for (auto & i : closure) for (auto & i : closure)
dirsInChroot[i] = i; dirsInChroot[i] = i;
string allowed = settings.get("allowed-impure-host-deps", string(DEFAULT_ALLOWED_IMPURE_PREFIXES)); if(!SANDBOX_ENABLED) {
PathSet allowedPaths = tokenizeString<StringSet>(allowed); string allowed = settings.get("allowed-impure-host-deps", string(DEFAULT_ALLOWED_IMPURE_PREFIXES));
PathSet allowedPaths = tokenizeString<StringSet>(allowed);
/* This works like the above, except on a per-derivation level */ /* This works like the above, except on a per-derivation level */
Strings impurePaths = tokenizeString<Strings>(get(drv->env, "__impureHostDeps")); Strings impurePaths = tokenizeString<Strings>(get(drv->env, "__impureHostDeps"));
for (auto & i : impurePaths) { for (auto & i : impurePaths) {
bool found = false; bool found = false;
/* Note: we're not resolving symlinks here to prevent /* Note: we're not resolving symlinks here to prevent
giving a non-root user info about inaccessible giving a non-root user info about inaccessible
files. */ files. */
Path canonI = canonPath(i); Path canonI = canonPath(i);
/* If only we had a trie to do this more efficiently :) luckily, these are generally going to be pretty small */ /* If only we had a trie to do this more efficiently :) luckily, these are generally going to be pretty small */
for (auto & a : allowedPaths) { for (auto & a : allowedPaths) {
Path canonA = canonPath(a); Path canonA = canonPath(a);
if (canonI == canonA || isInDir(canonI, canonA)) { if (canonI == canonA || isInDir(canonI, canonA)) {
found = true; found = true;
break; break;
} }
} }
if (!found) if (!found)
throw Error(format("derivation '%1%' requested impure path ‘%2%’, but it was not in allowed-impure-host-deps (‘%3%’)") % drvPath % i % allowed); throw Error(format("derivation '%1%' requested impure path ‘%2%’, but it was not in allowed-impure-host-deps (‘%3%’)") % drvPath % i % allowed);
dirsInChroot[i] = i; dirsInChroot[i] = i;
}
} else {
additionalSandboxProfile = get(drv->env, "__sandboxProfile");
} }
#if CHROOT_ENABLED #if CHROOT_ENABLED
@ -2471,8 +2477,6 @@ void DerivationGoal::runChild()
/* This has to appear before import statements */ /* This has to appear before import statements */
sandboxProfile += "(version 1)\n"; sandboxProfile += "(version 1)\n";
sandboxProfile += (format("(import \"%1%/nix/sandbox-defaults.sb\")\n") % settings.nixDataDir).str();
/* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */ /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */
if (settings.get("darwin-log-sandbox-violations", false)) { if (settings.get("darwin-log-sandbox-violations", false)) {
sandboxProfile += "(deny default)\n"; sandboxProfile += "(deny default)\n";
@ -2528,13 +2532,20 @@ void DerivationGoal::runChild()
} }
sandboxProfile += ")\n"; sandboxProfile += ")\n";
sandboxProfile += additionalSandboxProfile;
debug("Generated sandbox profile:"); debug("Generated sandbox profile:");
debug(sandboxProfile); debug(sandboxProfile);
char *tmpProfile = strdup((format("%1%/nix-sandboxXXXXXX.sb") % globalTmpDir).str().c_str());
int profileFd = mkstemps(tmpProfile, 3);
closeOnExec(profileFd);
writeFull(profileFd, sandboxProfile);
builder = "/usr/bin/sandbox-exec"; builder = "/usr/bin/sandbox-exec";
args.push_back("sandbox-exec"); args.push_back("sandbox-exec");
args.push_back("-p"); args.push_back("-f");
args.push_back(sandboxProfile); args.push_back(tmpProfile);
args.push_back("-D"); args.push_back("-D");
args.push_back((format("_GLOBAL_TMP_DIR=%1%") % globalTmpDir).str()); args.push_back((format("_GLOBAL_TMP_DIR=%1%") % globalTmpDir).str());
args.push_back(drv->builder); args.push_back(drv->builder);