Raito Bezarius
2d0109898a
Historically, Nix would support copying certificate authorities inside the sandbox so you could use them. In addition to that, the primitives consisting of leaking environment variables via `impureEnvVars` and `extra-sandbox-paths` to render paths external to the sandbox visible to the builder would also constitute a mechanism to expose special inodes which should have no influence on the output result, e.g. interception CAs. Unfortunately, in nixpkgs, `lib.fetchers.proxyImpureEnvVars` set `NIX_SSL_CERT_FILE` as an impure environment variable. A confused user may set `ssl-cert-file` via `NIX_SSL_CERT_FILE` outside the builder believing that this will set magically the right `NIX_SSL_CERT_FILE` inside the sandbox, but this is not true. The combination of impure environment variables and setting `caFile` creates a weird interaction where `NIX_SSL_CERT_FILE` points to an "outside the builder's world" inode *AND* `ssl-cert-file` creates this very same certificate file in /etc/ssl/certs/ca-certificates.crt without rewriting the environment variable. This footgun is closed by making these two features mutually incompatible with a warning and forcibly rewriting the SSL family of environment variables even if it was set via impure environment variables. Users who truly meant to use `impureEnvVars` can obtain the right behavior by setting `ssl-cert-file` to an empty string and will have to use `extra-sandbox-paths`. Users who meant to use `ssl-cert-file` will have everything work automatically with a warning hinting at nixpkgs *fixing its own bug*, i.e. passing `NIX_SSL_CERT_FILE` as an impure environment variable and expecting the Nix interpreter to magically reconcile the diverging values or expecting the user to actually do the work to render the path visible available via `extra-sandbox-paths`. Fixes #885. Change-Id: I32f8b5ce20fe9b6a911768114c92f95fc886cc07 Signed-off-by: Raito Bezarius <raito@lix.systems>
73 lines
3.2 KiB
Bash
73 lines
3.2 KiB
Bash
# This tests checks that CA works in builder's environments, *with* a sandbox.
|
|
source common.sh
|
|
|
|
requireSandboxSupport
|
|
needLocalStore "the sandbox only runs on the builder side, so it makes no sense to test it with the daemon"
|
|
|
|
clearStore
|
|
|
|
# Note: we need to bind-mount $SHELL into the chroot. Currently we
|
|
# only support the case where $SHELL is in the Nix store, because
|
|
# otherwise things get complicated (e.g. if it's in /bin, do we need
|
|
# /lib as well?).
|
|
if [[ ! $SHELL =~ /nix/store ]]; then skipTest "Shell is not from Nix store"; fi
|
|
# An alias to automatically bind-mount the $SHELL on nix-build invocations
|
|
nix-sandbox-build () { nix-build --no-out-link --sandbox-paths /nix/store "$@"; }
|
|
|
|
chmod -R u+w $TEST_ROOT/store0 || true
|
|
rm -rf $TEST_ROOT/store0
|
|
|
|
export NIX_STORE_DIR=/my/store
|
|
export NIX_REMOTE=$TEST_ROOT/store0
|
|
|
|
## Test mounting of SSL certificates into the sandbox
|
|
testCert () {
|
|
expectation=$1 # "missing" | "present"
|
|
mode=$2 # "normal" | "fixed-output" | "clobbering-impurities"
|
|
certFile=$3 # a string that can be the path to a cert file
|
|
# `100` means build failure without extra info, see doc/manual/src/command-ref/status-build-failure.md
|
|
([ "$mode" == fixed-output ] || [ "$mode" == clobbering-impurities ]) && ret=1 || ret=100
|
|
expectStderr $ret nix-sandbox-build cert-test.nix --argstr mode "$mode" --option ssl-cert-file "$certFile" |
|
|
grepQuiet "CERT_${expectation}_IN_SANDBOX"
|
|
}
|
|
testCertWithoutOption () {
|
|
expectation=$1 # "missing" | "present"
|
|
mode=$2 # "normal" | "fixed-output" | "clobbering-impurities"
|
|
# `100` means build failure without extra info, see doc/manual/src/command-ref/status-build-failure.md
|
|
([ "$mode" == fixed-output ] || [ "$mode" == clobbering-impurities ]) && ret=1 || ret=100
|
|
expectStderr $ret nix-sandbox-build cert-test.nix --argstr mode "$mode" |
|
|
grepQuiet "CERT_${expectation}_IN_SANDBOX"
|
|
}
|
|
|
|
nocert=$TEST_ROOT/no-cert-file.pem
|
|
cert=$TEST_ROOT/some-cert-file.pem
|
|
certsymlink=$TEST_ROOT/cert-symlink.pem
|
|
echo -n "CERT_CONTENT" > $cert
|
|
ln -s $cert $certsymlink
|
|
|
|
# No cert in sandbox when not a fixed-output derivation
|
|
testCert missing normal "$cert"
|
|
|
|
# No cert in sandbox when ssl-cert-file is empty
|
|
testCert missing fixed-output ""
|
|
|
|
# No cert in sandbox when ssl-cert-file is a nonexistent file
|
|
testCert missing fixed-output "$nocert"
|
|
|
|
# Cert in sandbox when ssl-cert-file is set to an existing file
|
|
testCert present fixed-output "$cert"
|
|
testCert present-env-var fixed-output "$cert"
|
|
NIX_SSL_CERT_FILE="$cert" testCertWithoutOption present-env-var fixed-output
|
|
|
|
# Cert in sandbox when ssl-cert-file is set to a symlink
|
|
testCert present fixed-output "$certsymlink"
|
|
testCert present-env-var fixed-output "$certsymlink"
|
|
NIX_SSL_CERT_FILE="$certsymlink" testCertWithoutOption present-env-var fixed-output
|
|
|
|
# Cert in sandbox when ssl-cert-file is set to a file and impurities clobbers the environment variables.
|
|
testCert present clobbering-impurities "$cert"
|
|
testCert present-env-var clobbering-impurities "$cert"
|
|
# Set the environment variable to clobber it.
|
|
NIX_SSL_CERT_FILE=/nowhere testCert present-env-var clobbering-impurities "$cert"
|
|
NIX_SSL_CERT_FILE="$cert" testCertWithoutOption present-env-var clobbering-impurities
|