forked from lix-project/lix
Always use the Darwin sandbox
Even with "build-use-sandbox = false", we now use sandboxing with a permissive profile that allows everything except the creation of setuid/setgid binaries.
This commit is contained in:
parent
d3f780996c
commit
85e93d7b87
4
.gitignore
vendored
4
.gitignore
vendored
|
@ -48,9 +48,7 @@ perl/Makefile.config
|
|||
/src/libexpr/nix.tbl
|
||||
|
||||
# /src/libstore/
|
||||
/src/libstore/schema.sql.gen.hh
|
||||
/src/libstore/sandbox-defaults.sb.gen.hh
|
||||
/src/libstore/sandbox-network.sb.gen.hh
|
||||
/src/libstore/*.gen.hh
|
||||
|
||||
/src/nix/nix
|
||||
|
||||
|
|
|
@ -2611,12 +2611,16 @@ void DerivationGoal::runChild()
|
|||
|
||||
const char *builder = "invalid";
|
||||
|
||||
string sandboxProfile;
|
||||
if (drv->isBuiltin()) {
|
||||
;
|
||||
}
|
||||
#if __APPLE__
|
||||
else if (useChroot) {
|
||||
else {
|
||||
/* This has to appear before import statements. */
|
||||
std::string sandboxProfile = "(version 1)\n";
|
||||
|
||||
if (useChroot) {
|
||||
|
||||
/* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */
|
||||
PathSet ancestry;
|
||||
|
||||
|
@ -2643,9 +2647,6 @@ void DerivationGoal::runChild()
|
|||
for (auto & i : inputPaths)
|
||||
dirsInChroot[i] = i;
|
||||
|
||||
/* This has to appear before import statements */
|
||||
sandboxProfile += "(version 1)\n";
|
||||
|
||||
/* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */
|
||||
if (settings.darwinLogSandboxViolations) {
|
||||
sandboxProfile += "(deny default)\n";
|
||||
|
@ -2662,13 +2663,6 @@ void DerivationGoal::runChild()
|
|||
#include "sandbox-network.sb.gen.hh"
|
||||
;
|
||||
|
||||
/* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms
|
||||
to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */
|
||||
Path globalTmpDir = canonPath(getEnv("TMPDIR", "/tmp"), true);
|
||||
|
||||
/* They don't like trailing slashes on subpath directives */
|
||||
if (globalTmpDir.back() == '/') globalTmpDir.pop_back();
|
||||
|
||||
/* Our rwx outputs */
|
||||
sandboxProfile += "(allow file-read* file-write* process-exec\n";
|
||||
for (auto & i : missingPaths) {
|
||||
|
@ -2709,6 +2703,10 @@ void DerivationGoal::runChild()
|
|||
sandboxProfile += ")\n";
|
||||
|
||||
sandboxProfile += additionalSandboxProfile;
|
||||
} else
|
||||
sandboxProfile +=
|
||||
#include "sandbox-minimal.sb.gen.hh"
|
||||
;
|
||||
|
||||
debug("Generated sandbox profile:");
|
||||
debug(sandboxProfile);
|
||||
|
@ -2717,6 +2715,13 @@ void DerivationGoal::runChild()
|
|||
|
||||
writeFile(sandboxFile, sandboxProfile);
|
||||
|
||||
/* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms
|
||||
to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */
|
||||
Path globalTmpDir = canonPath(getEnv("TMPDIR", "/tmp"), true);
|
||||
|
||||
/* They don't like trailing slashes on subpath directives */
|
||||
if (globalTmpDir.back() == '/') globalTmpDir.pop_back();
|
||||
|
||||
builder = "/usr/bin/sandbox-exec";
|
||||
args.push_back("sandbox-exec");
|
||||
args.push_back("-f");
|
||||
|
@ -2725,12 +2730,13 @@ void DerivationGoal::runChild()
|
|||
args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir);
|
||||
args.push_back(drv->builder);
|
||||
}
|
||||
#endif
|
||||
#else
|
||||
else {
|
||||
builder = drv->builder.c_str();
|
||||
string builderBasename = baseNameOf(drv->builder);
|
||||
args.push_back(builderBasename);
|
||||
}
|
||||
#endif
|
||||
|
||||
for (auto & i : drv->args)
|
||||
args.push_back(rewriteStrings(i, inputRewrites));
|
||||
|
|
|
@ -36,7 +36,9 @@ libstore_CXXFLAGS = \
|
|||
|
||||
$(d)/local-store.cc: $(d)/schema.sql.gen.hh
|
||||
|
||||
$(d)/build.cc: $(d)/sandbox-defaults.sb.gen.hh $(d)/sandbox-network.sb.gen.hh
|
||||
sandbox-headers = $(d)/sandbox-defaults.sb.gen.hh $(d)/sandbox-network.sb.gen.hh $(d)/sandbox-minimal.sb.gen.hh
|
||||
|
||||
$(d)/build.cc: $(sandbox-headers)
|
||||
|
||||
%.gen.hh: %
|
||||
@echo 'R"foo(' >> $@.tmp
|
||||
|
@ -44,6 +46,6 @@ $(d)/build.cc: $(d)/sandbox-defaults.sb.gen.hh $(d)/sandbox-network.sb.gen.hh
|
|||
@echo ')foo"' >> $@.tmp
|
||||
@mv $@.tmp $@
|
||||
|
||||
clean-files += $(d)/schema.sql.gen.hh $(d)/sandbox-defaults.sb.gen.hh $(d)/sandbox-network.sb.gen.hh
|
||||
clean-files += $(d)/schema.sql.gen.hh $(sandbox-headers)
|
||||
|
||||
$(eval $(call install-file-in, $(d)/nix-store.pc, $(prefix)/lib/pkgconfig, 0644))
|
||||
|
|
|
@ -1,5 +1,7 @@
|
|||
(define TMPDIR (param "_GLOBAL_TMP_DIR"))
|
||||
|
||||
(deny default)
|
||||
|
||||
; Disallow creating setuid/setgid binaries, since that
|
||||
; would allow breaking build user isolation.
|
||||
(deny file-write-setugid)
|
||||
|
|
5
src/libstore/sandbox-minimal.sb
Normal file
5
src/libstore/sandbox-minimal.sb
Normal file
|
@ -0,0 +1,5 @@
|
|||
(allow default)
|
||||
|
||||
; Disallow creating setuid/setgid binaries, since that
|
||||
; would allow breaking build user isolation.
|
||||
(deny file-write-setugid)
|
Loading…
Reference in a new issue