Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Option to make sandbox work in Docker with its default seccomp filter #2719

Closed
wants to merge 1 commit into from
Closed

Option to make sandbox work in Docker with its default seccomp filter #2719

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions doc/manual/command-ref/conf-file.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -700,6 +700,20 @@ password <replaceable>my-password</replaceable>
</varlistentry>


<varlistentry xml:id="conf-sandbox-use-pivot_root">
<term><literal>sandbox-use-pivot_root</literal></term>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't like this kind of option. Is there any way we can detect whether pivot_root works / we're in a container?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can detect specific, but it depends on how the container is implemented. See this answer + comment for example. Also it seems that we'd be checking the wrong thing. The failure seems more likely caused by mount namespaces rather than cgroups, or it can be caused by a security module.

What we can do instead is make the pivot_root feature degrade gracefully, but then it may go unnoticed when it needs fixing.


<listitem><para>Whether to use the <literal>pivot_root</literal>
system call, which is safer than plain <literal>chroot</literal> when
establishing the sandbox.</para>
<para>This option has the safe default <literal>true</literal>,
but needs to be set to <literal>false</literal> when running the
sandbox inside a container.</para>
</listitem>

</varlistentry>


<varlistentry xml:id="conf-secret-key-files"><term><literal>secret-key-files</literal></term>

<listitem><para>A whitespace-separated list of files containing
Expand Down
20 changes: 12 additions & 8 deletions src/libstore/build.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2720,20 +2720,24 @@ void DerivationGoal::runChild()
if (chdir(chrootRootDir.c_str()) == -1)
throw SysError(format("cannot change directory to '%1%'") % chrootRootDir);

if (mkdir("real-root", 0) == -1)
throw SysError("cannot create real-root directory");
if (settings.sandboxUsePivotRoot) {
if (mkdir("real-root", 0) == -1)
throw SysError("cannot create real-root directory");

if (pivot_root(".", "real-root") == -1)
throw SysError(format("cannot pivot old root directory onto '%1%'") % (chrootRootDir + "/real-root"));
if (pivot_root(".", "real-root") == -1)
throw SysError(format("cannot pivot old root directory onto '%1%'") % (chrootRootDir + "/real-root"));
}

if (chroot(".") == -1)
throw SysError(format("cannot change root directory to '%1%'") % chrootRootDir);

if (umount2("real-root", MNT_DETACH) == -1)
throw SysError("cannot unmount real root filesystem");
if (settings.sandboxUsePivotRoot) {
if (umount2("real-root", MNT_DETACH) == -1)
throw SysError("cannot unmount real root filesystem");

if (rmdir("real-root") == -1)
throw SysError("cannot remove real-root directory");
if (rmdir("real-root") == -1)
throw SysError("cannot remove real-root directory");
}

/* Switch to the sandbox uid/gid in the user namespace,
which corresponds to the build user or calling user in
Expand Down
3 changes: 3 additions & 0 deletions src/libstore/globals.hh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,6 +205,9 @@ public:
"Whether to enable sandboxed builds. Can be \"true\", \"false\" or \"relaxed\".",
{"build-use-chroot", "build-use-sandbox"}};

Setting<bool> sandboxUsePivotRoot{this, true, "sandbox-use-pivot_root",
"Whether to use pivot_root when sandboxing is enabled. This is safer than plain chroot, but not supported when running the sandbox in a container."};

Setting<PathSet> sandboxPaths{this, {}, "sandbox-paths",
"The paths to make available inside the build sandbox.",
{"build-chroot-dirs", "build-sandbox-paths"}};
Expand Down