Chmod build root to make it read-only #11448
Open
+16
−0
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 2 commits
August 30, 2024 13:35
github-actions
bot
added
the
with-tests
edolstra
reviewed
Sep 9, 2024
| @@ -1970,6 +1970,9 @@ void LocalDerivationGoal::runChild() | |||
| if (rmdir("real-root") == -1) | |||
| throw SysError("cannot remove real-root directory"); | |||
|
|
|||
| // Make build root read-only, so `mkdir /homeless-shelter` would fail. | |||
| chmod_("/", 0555); | |||
There was a problem hiding this comment.
Could this break uid-range builds (e.g. tests/nixos/containers/systemd-nspawn.nix)? Those do expect the root to be writable.
There was a problem hiding this comment.
Hmm, I guess it could.
I had another idea. If we actually mkdir /homeless-shelter and then make it read-only, and adjust the "home directory exists" error to be only triggered if the directory exists and is non-empty, I think it may solve the issue. Would you object to always having an empty /homeless-shelter directory in the sandbox?
There was a problem hiding this comment.
Perhaps this should then be controlled by a derivation-provided setting like an "advanced attribute"?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation
Currently, building Nix itself fails in single-user installation - see #11295. This is because some build steps run something like
mkdir -p $HOME/.cache, and since $HOME is/homeless-shelterand/is writable, the directory/homeless-shelteris created, which may cause the builder to fail.This PR just runs a
chmodon the build root directory prior tochroot, to make it read-only. This seems to solve the issue.Context
ubuntu-latest --no-daemon#11397/proc/homeless-shelterinstead of/homeless-shelter, which was reverted since it causedmkdir $HOMEto fail with ENOENT instead of EPERM, which caused builds to fail: Make $HOME=/proc/homeless-shelter instead of /homeless-shelter #11300Priorities and Process
Add 👍 to pull requests you find important.
The Nix maintainer team uses a GitHub project board to schedule and track reviews.