From bcf1f27fec3b18c33e7b76384cebd95b105f9357 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Wed, 26 Mar 2025 01:04:59 +0100 Subject: [PATCH] libstore: open build directory as a dirfd as well We now keep around a proper AutoCloseFD around the temporary directory which we plan to use for openat operations and avoiding the build directory being swapped out while we are doing something else. Change-Id: I18d387b0f123ebf2d20c6405cd47ebadc5505f2a Signed-off-by: Raito Bezarius --- lix/libstore/build/local-derivation-goal.cc | 5 +++++ lix/libstore/build/local-derivation-goal.hh | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/lix/libstore/build/local-derivation-goal.cc b/lix/libstore/build/local-derivation-goal.cc index 5de4fdec5..fc6e925f3 100644 --- a/lix/libstore/build/local-derivation-goal.cc +++ b/lix/libstore/build/local-derivation-goal.cc @@ -441,6 +441,11 @@ try { false, 0700 ); + /* The TOCTOU between the previous mkdir call and this open call is unavoidable due to + * POSIX semantics.*/ + tmpDirFd = AutoCloseFD{open(tmpDir.c_str(), O_RDONLY | O_NOFOLLOW | O_DIRECTORY)}; + if (!tmpDirFd) + throw SysError("failed to open the build temporary directory descriptor '%1%'", tmpDir); chownToBuilder(tmpDir); diff --git a/lix/libstore/build/local-derivation-goal.hh b/lix/libstore/build/local-derivation-goal.hh index ec874ecea..5b9051ede 100644 --- a/lix/libstore/build/local-derivation-goal.hh +++ b/lix/libstore/build/local-derivation-goal.hh @@ -42,6 +42,11 @@ struct LocalDerivationGoal : public DerivationGoal */ Path tmpDir; + /** + * The temporary directory file descriptor + */ + AutoCloseFD tmpDirFd; + /** * The path of the temporary directory in the sandbox. */