Skip to content

Commit

Permalink
Only mount /sys in uid-range builds
Browse files Browse the repository at this point in the history
Maybe this should be a separate system feature... /sys exposes a lot
of impure info about the host system.
  • Loading branch information
edolstra committed Jun 18, 2020
1 parent 40a9f33 commit e263fd4
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 6 deletions.
11 changes: 6 additions & 5 deletions src/libstore/build.cc
Original file line number Diff line number Diff line change
Expand Up @@ -3170,11 +3170,12 @@ void DerivationGoal::runChild()
if (mount("none", (chrootRootDir + "/proc").c_str(), "proc", 0, 0) == -1)
throw SysError("mounting /proc");

/* Mount sysfs on /sys. FIXME: only in user namespace
builds. */
createDirs(chrootRootDir + "/sys");
if (mount("none", (chrootRootDir + "/sys").c_str(), "sysfs", 0, 0) == -1)
throw SysError("mounting /sys");
/* Mount sysfs on /sys. */
if (useUidRange) {
createDirs(chrootRootDir + "/sys");
if (mount("none", (chrootRootDir + "/sys").c_str(), "sysfs", 0, 0) == -1)
throw SysError("mounting /sys");
}

/* Mount a new tmpfs on /dev/shm to ensure that whatever
the builder puts in /dev/shm is cleaned up automatically. */
Expand Down
2 changes: 1 addition & 1 deletion src/libstore/user-lock.cc
Original file line number Diff line number Diff line change
Expand Up @@ -122,7 +122,7 @@ struct CgroupUserLock : UserLock
return uid;
}

std::vector<gid_t> getSupplementaryGIDs() override { return {}; } // FIXME
std::vector<gid_t> getSupplementaryGIDs() override { return {}; }

static std::unique_ptr<UserLock> acquire()
{
Expand Down

0 comments on commit e263fd4

Please sign in to comment.