It is possible to exfiltrate a file descriptor out of the build sandbox of FODs, and use it to modify the store path after it has been registered. To avoid that issue, don't register the output of the build, but a copy of it (that will be free of any leaked file descriptor). Test that we can't leverage abstract unix domain sockets to leak file descriptors out of the sandbox and modify the path after it has been registered. (cherry picked from commit 2dadfeb690e7f4b8f97298e29791d202fdba5ca6) (tests cherry picked from commit c854ae5b3078ac5d99fa75fe148005044809e18c) Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io> Co-authored-by: Theophane Hufschmitt <theophane.hufschmitt@tweag.io> Co-authored-by: Tom Bereknyei <tomberek@gmail.com> Change-Id: I87cd58f1c0a4f7b7a610d354206b33301e47b1a4
169 lines
5.4 KiB
C++
169 lines
5.4 KiB
C++
#include <sys/time.h>
|
||
#include <filesystem>
|
||
#include <atomic>
|
||
|
||
#include "finally.hh"
|
||
#include "util.hh"
|
||
#include "types.hh"
|
||
|
||
namespace fs = std::filesystem;
|
||
|
||
namespace nix {
|
||
|
||
static Path tempName(Path tmpRoot, const Path & prefix, bool includePid,
|
||
std::atomic<unsigned int> & counter)
|
||
{
|
||
tmpRoot = canonPath(tmpRoot.empty() ? getEnv("TMPDIR").value_or("/tmp") : tmpRoot, true);
|
||
if (includePid)
|
||
return fmt("%1%/%2%-%3%-%4%", tmpRoot, prefix, getpid(), counter++);
|
||
else
|
||
return fmt("%1%/%2%-%3%", tmpRoot, prefix, counter++);
|
||
}
|
||
|
||
Path createTempDir(const Path & tmpRoot, const Path & prefix,
|
||
bool includePid, bool useGlobalCounter, mode_t mode)
|
||
{
|
||
static std::atomic<unsigned int> globalCounter = 0;
|
||
std::atomic<unsigned int> localCounter = 0;
|
||
auto & counter(useGlobalCounter ? globalCounter : localCounter);
|
||
|
||
while (1) {
|
||
checkInterrupt();
|
||
Path tmpDir = tempName(tmpRoot, prefix, includePid, counter);
|
||
if (mkdir(tmpDir.c_str(), mode) == 0) {
|
||
#if __FreeBSD__
|
||
/* Explicitly set the group of the directory. This is to
|
||
work around around problems caused by BSD's group
|
||
ownership semantics (directories inherit the group of
|
||
the parent). For instance, the group of /tmp on
|
||
FreeBSD is "wheel", so all directories created in /tmp
|
||
will be owned by "wheel"; but if the user is not in
|
||
"wheel", then "tar" will fail to unpack archives that
|
||
have the setgid bit set on directories. */
|
||
if (chown(tmpDir.c_str(), (uid_t) -1, getegid()) != 0)
|
||
throw SysError("setting group of directory '%1%'", tmpDir);
|
||
#endif
|
||
return tmpDir;
|
||
}
|
||
if (errno != EEXIST)
|
||
throw SysError("creating directory '%1%'", tmpDir);
|
||
}
|
||
}
|
||
|
||
|
||
std::pair<AutoCloseFD, Path> createTempFile(const Path & prefix)
|
||
{
|
||
Path tmpl(getEnv("TMPDIR").value_or("/tmp") + "/" + prefix + ".XXXXXX");
|
||
// Strictly speaking, this is UB, but who cares...
|
||
// FIXME: use O_TMPFILE.
|
||
AutoCloseFD fd(mkstemp((char *) tmpl.c_str()));
|
||
if (!fd)
|
||
throw SysError("creating temporary file '%s'", tmpl);
|
||
closeOnExec(fd.get());
|
||
return {std::move(fd), tmpl};
|
||
}
|
||
|
||
void createSymlink(const Path & target, const Path & link)
|
||
{
|
||
if (symlink(target.c_str(), link.c_str()))
|
||
throw SysError("creating symlink from '%1%' to '%2%'", link, target);
|
||
}
|
||
|
||
void replaceSymlink(const Path & target, const Path & link)
|
||
{
|
||
for (unsigned int n = 0; true; n++) {
|
||
Path tmp = canonPath(fmt("%s/.%d_%s", dirOf(link), n, baseNameOf(link)));
|
||
|
||
try {
|
||
createSymlink(target, tmp);
|
||
} catch (SysError & e) {
|
||
if (e.errNo == EEXIST) continue;
|
||
throw;
|
||
}
|
||
|
||
renameFile(tmp, link);
|
||
|
||
break;
|
||
}
|
||
}
|
||
|
||
void setWriteTime(const fs::path & p, const struct stat & st)
|
||
{
|
||
struct timeval times[2];
|
||
times[0] = {
|
||
.tv_sec = st.st_atime,
|
||
.tv_usec = 0,
|
||
};
|
||
times[1] = {
|
||
.tv_sec = st.st_mtime,
|
||
.tv_usec = 0,
|
||
};
|
||
if (lutimes(p.c_str(), times) != 0)
|
||
throw SysError("changing modification time of '%s'", p);
|
||
}
|
||
|
||
void copy(const fs::directory_entry & from, const fs::path & to, bool andDelete)
|
||
{
|
||
// TODO: Rewrite the `is_*` to use `symlink_status()`
|
||
auto statOfFrom = lstat(from.path().c_str());
|
||
auto fromStatus = from.symlink_status();
|
||
|
||
// Mark the directory as writable so that we can delete its children
|
||
if (andDelete && fs::is_directory(fromStatus)) {
|
||
fs::permissions(from.path(), fs::perms::owner_write, fs::perm_options::add | fs::perm_options::nofollow);
|
||
}
|
||
|
||
|
||
if (fs::is_symlink(fromStatus) || fs::is_regular_file(fromStatus)) {
|
||
fs::copy(from.path(), to, fs::copy_options::copy_symlinks | fs::copy_options::overwrite_existing);
|
||
} else if (fs::is_directory(fromStatus)) {
|
||
fs::create_directory(to);
|
||
for (auto & entry : fs::directory_iterator(from.path())) {
|
||
copy(entry, to / entry.path().filename(), andDelete);
|
||
}
|
||
} else {
|
||
throw Error("file '%s' has an unsupported type", from.path());
|
||
}
|
||
|
||
setWriteTime(to, statOfFrom);
|
||
if (andDelete) {
|
||
if (!fs::is_symlink(fromStatus))
|
||
fs::permissions(from.path(), fs::perms::owner_write, fs::perm_options::add | fs::perm_options::nofollow);
|
||
fs::remove(from.path());
|
||
}
|
||
}
|
||
|
||
|
||
void copyFile(const Path & oldPath, const Path & newPath, bool andDelete)
|
||
{
|
||
return copy(fs::directory_entry(fs::path(oldPath)), fs::path(newPath), andDelete);
|
||
}
|
||
|
||
void renameFile(const Path & oldName, const Path & newName)
|
||
{
|
||
fs::rename(oldName, newName);
|
||
}
|
||
|
||
void moveFile(const Path & oldName, const Path & newName)
|
||
{
|
||
try {
|
||
renameFile(oldName, newName);
|
||
} catch (fs::filesystem_error & e) {
|
||
auto oldPath = fs::path(oldName);
|
||
auto newPath = fs::path(newName);
|
||
// For the move to be as atomic as possible, copy to a temporary
|
||
// directory
|
||
fs::path temp = createTempDir(newPath.parent_path(), "rename-tmp");
|
||
Finally removeTemp = [&]() { fs::remove(temp); };
|
||
auto tempCopyTarget = temp / "copy-target";
|
||
if (e.code().value() == EXDEV) {
|
||
fs::remove(newPath);
|
||
warn("Can’t rename %s as %s, copying instead", oldName, newName);
|
||
copy(fs::directory_entry(oldPath), tempCopyTarget, true);
|
||
renameFile(tempCopyTarget, newPath);
|
||
}
|
||
}
|
||
}
|
||
|
||
}
|