From 1a4cb134118416bcac29df3f630018316d0fe8ab Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Wed, 26 Mar 2025 01:04:59 +0100 Subject: [PATCH] libstore: open build directory as a dirfd as well We now keep around a proper AutoCloseFD around the temporary directory which we plan to use for openat operations and avoiding the build directory being swapped out while we are doing something else. Change-Id: I18d387b0f123ebf2d20c6405cd47ebadc5505f2a Signed-off-by: Raito Bezarius --- lix/libstore/build/local-derivation-goal.cc | 5 +++++ lix/libstore/build/local-derivation-goal.hh | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/lix/libstore/build/local-derivation-goal.cc b/lix/libstore/build/local-derivation-goal.cc index 1f41f9726..967f3c4b8 100644 --- a/lix/libstore/build/local-derivation-goal.cc +++ b/lix/libstore/build/local-derivation-goal.cc @@ -489,6 +489,11 @@ try { false, 0700 ); + /* The TOCTOU between the previous mkdir call and this open call is unavoidable due to + * POSIX semantics.*/ + tmpDirFd = AutoCloseFD{open(tmpDir.c_str(), O_RDONLY | O_NOFOLLOW | O_DIRECTORY)}; + if (!tmpDirFd) + throw SysError("failed to open the build temporary directory descriptor '%1%'", tmpDir); chownToBuilder(tmpDir); diff --git a/lix/libstore/build/local-derivation-goal.hh b/lix/libstore/build/local-derivation-goal.hh index 239574673..b4be21721 100644 --- a/lix/libstore/build/local-derivation-goal.hh +++ b/lix/libstore/build/local-derivation-goal.hh @@ -31,6 +31,11 @@ struct LocalDerivationGoal : public DerivationGoal */ Path tmpDir; + /** + * The temporary directory file descriptor + */ + AutoCloseFD tmpDirFd; + /** * The path of the temporary directory in the sandbox. */