From 55cbabd3168ab4f7ac93eb9cc58dad3ccc18654b Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sun, 29 Sep 2024 17:16:01 +0200 Subject: [PATCH] feat(libstore/build): always create a new cgroup namespace There's no reason to make it dependent upon `Xp::Cgroups`, this increases the purity of the builders' views. Change-Id: I3d934428177e6bb78cd700d1cce1ded8a88e9da0 Signed-off-by: Raito Bezarius --- doc/manual/rl-next/fresh-cgroup-namespace.md | 10 ++++++++++ lix/libstore/build/local-derivation-goal.cc | 4 +++- 2 files changed, 13 insertions(+), 1 deletion(-) create mode 100644 doc/manual/rl-next/fresh-cgroup-namespace.md diff --git a/doc/manual/rl-next/fresh-cgroup-namespace.md b/doc/manual/rl-next/fresh-cgroup-namespace.md new file mode 100644 index 000000000..7d2603c13 --- /dev/null +++ b/doc/manual/rl-next/fresh-cgroup-namespace.md @@ -0,0 +1,10 @@ +--- +synopsis: "Builders are always started in a fresh cgroup namespace" +cls: [1996] +category: Breaking Changes +credits: raito +--- + +If you haven't enabled the experimental `cgroups` feature, Nix previously launched builder processes in new namespaces but did not create new cgroup namespaces. As a result, derivations could access and observe the parent cgroup namespace. + +Although this update introduces a breaking change, it ensures that all derivations now start in a fresh cgroup namespace by default. This reduces potential impurities observable within the sandbox, improving the likelihood of reproducible builds across different environments. diff --git a/lix/libstore/build/local-derivation-goal.cc b/lix/libstore/build/local-derivation-goal.cc index 1bf87e6ec..03d38115d 100644 --- a/lix/libstore/build/local-derivation-goal.cc +++ b/lix/libstore/build/local-derivation-goal.cc @@ -1665,10 +1665,12 @@ void LocalDerivationGoal::runChild() if (unshare(CLONE_NEWNS) == -1) throw SysError("unsharing mount namespace"); + /* Creating a new cgroup namespace is independent of whether we enabled the cgroup experimental feature. + * We always create a new cgroup namespace from a sandboxing perspective. */ /* Unshare the cgroup namespace. This means /proc/self/cgroup will show the child's cgroup as '/' rather than whatever it is in the parent. */ - if (cgroup && unshare(CLONE_NEWCGROUP) == -1) + if (unshare(CLONE_NEWCGROUP) == -1) throw SysError("unsharing cgroup namespace"); /* Do the chroot(). */