picnoir/nix-gh
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Always use the Darwin sandbox

Browse source 
Even with "build-use-sandbox = false", we now use sandboxing with a
permissive profile that allows everything except the creation of
setuid/setgid binaries.

Based on 85e93d7b87.
This commit is contained in:
Eelco Dolstra 2017-06-06 20:35:55 +02:00
parent f534627929
commit 8e298e8ad9
No known key found for this signature in database
GPG key ID: 8170B4726D7198DE
1 changed files with 86 additions and 78 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
src/libstore/build.cc
View file

@ -2538,11 +2538,16 @@ void DerivationGoal::runChild()
const char *builder = "invalid";
string sandboxProfile;
if (isBuiltin(*drv)) {
;
}
#if __APPLE__
} else if (useChroot) {
else {
/* This has to appear before import statements. */
std::string sandboxProfile = "(version 1)\n";
if (useChroot) {
/* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */
PathSet ancestry;
@ -2569,9 +2574,6 @@ void DerivationGoal::runChild()
for (auto & i : inputPaths)
dirsInChroot[i] = i;
/* This has to appear before import statements */
sandboxProfile += "(version 1)\n";
/* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */
if (settings.get("darwin-log-sandbox-violations", false)) {
sandboxProfile += "(deny default)\n";
@ -2579,13 +2581,6 @@ void DerivationGoal::runChild()
sandboxProfile += "(deny default (with no-log))\n";
}
/* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms
to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */
Path globalTmpDir = canonPath(getEnv("TMPDIR", "/tmp"), true);
/* They don't like trailing slashes on subpath directives */
if (globalTmpDir.back() == '/') globalTmpDir.pop_back();
/* Our rwx outputs */
sandboxProfile += "(allow file-read* file-write* process-exec\n";
for (auto & i : missingPaths) {
@ -2626,6 +2621,10 @@ void DerivationGoal::runChild()
sandboxProfile += ")\n";
sandboxProfile += additionalSandboxProfile;
} else
sandboxProfile += "(allow default)\n";
sandboxProfile += "(deny file-write-setugid)\n";
debug("Generated sandbox profile:");
debug(sandboxProfile);
@ -2636,6 +2635,13 @@ void DerivationGoal::runChild()
writeFile(sandboxFile, sandboxProfile);
/* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms
to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */
Path globalTmpDir = canonPath(getEnv("TMPDIR", "/tmp"), true);
/* They don't like trailing slashes on subpath directives */
if (globalTmpDir.back() == '/') globalTmpDir.pop_back();
builder = "/usr/bin/sandbox-exec";
args.push_back("sandbox-exec");
args.push_back("-f");
@ -2643,12 +2649,14 @@ void DerivationGoal::runChild()
args.push_back("-D");
args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir);
args.push_back(drv->builder);
#endif
} else {
}
#else
else {
builder = drv->builder.c_str();
string builderBasename = baseNameOf(drv->builder);
args.push_back(builderBasename);
}
#endif
for (auto & i : drv->args)
args.push_back(rewriteHashes(i, rewritesToTmp));