libstore: open build directory as a dirfd as well

We now keep around a proper AutoCloseFD around the temporary directory
which we plan to use for openat operations and avoiding the build
directory being swapped out while we are doing something else.

Change-Id: I18d387b0f123ebf2d20c6405cd47ebadc5505f2a
Signed-off-by: Raito Bezarius <raito@lix.systems>

src/libstore/build/local-derivation-goal.cc

@@ -476,7 +476,18 @@ void LocalDerivationGoal::startBuilder()
 
     /* Create a temporary directory where the build will take
        place. */
-    tmpDir = createTempDir(settings.buildDir.get().value_or(""), "nix-build-" + std::string(drvPath.name()), false, false, 0700);
+    tmpDir = createTempDir(
+        settings.buildDir.get().value_or(""),
+        "nix-build-" + std::string(drvPath.name()),
+        false,
+        false,
+        0700
+    );
+    /* The TOCTOU between the previous mkdir call and this open call is unavoidable due to
+     * POSIX semantics.*/
+    tmpDirFd = AutoCloseFD{open(tmpDir.c_str(), O_RDONLY | O_NOFOLLOW | O_DIRECTORY)};
+    if (!tmpDirFd)
+        throw SysError("failed to open the build temporary directory descriptor '%1%'", tmpDir);
 
     chownToBuilder(tmpDir);
 

src/libstore/build/local-derivation-goal.hh

@@ -31,6 +31,11 @@ struct LocalDerivationGoal : public DerivationGoal
      */
     Path tmpDir;
 
+    /**
+     * The temporary directory file descriptor
+     */
+    AutoCloseFD tmpDirFd;
+
     /**
      * The path of the temporary directory in the sandbox.
      */