From dec0b7f277556965c48b683d134505be2a7633b8 Mon Sep 17 00:00:00 2001 From: Kate Date: Tue, 15 Aug 2023 14:51:50 +0100 Subject: [PATCH 1/2] Sandboxes: Make /tmp writeable to restore POSIX compliancy --- master_changes.md | 1 + src/state/shellscripts/bwrap.sh | 3 ++- src/state/shellscripts/sandbox_exec.sh | 1 + 3 files changed, 4 insertions(+), 1 deletion(-) diff --git a/master_changes.md b/master_changes.md index 70ad89b8a0a..0aedf7b469b 100644 --- a/master_changes.md +++ b/master_changes.md @@ -60,6 +60,7 @@ users) ## Format upgrade ## Sandbox + * Make /tmp writable again to restore POSIX compliancy [#5634 @kit-ty-kate - fixes #5462] ## VCS diff --git a/src/state/shellscripts/bwrap.sh b/src/state/shellscripts/bwrap.sh index c7d06e73cbd..78994a339c6 100644 --- a/src/state/shellscripts/bwrap.sh +++ b/src/state/shellscripts/bwrap.sh @@ -19,6 +19,7 @@ fi ARGS=(--unshare-net --new-session --die-with-parent) ARGS=("${ARGS[@]}" --proc /proc --dev /dev) ARGS=("${ARGS[@]}" --setenv TMPDIR /opam-tmp --setenv TMP /opam-tmp --setenv TEMPDIR /opam-tmp --setenv TEMP /opam-tmp) +ARGS=("${ARGS[@]}" --bind /tmp /tmp) ARGS=("${ARGS[@]}" --tmpfs /opam-tmp) ARGS=("${ARGS[@]}" --tmpfs /run) # NOTE: When adding a new mount-point please sync with the loop below to avoid overriding the mount point @@ -62,7 +63,7 @@ add_sys_mounts() { # See https://github.com/containers/bubblewrap/issues/413 for dir in /*; do case "$dir" in - "/proc" | "/dev" | "/run" | "/opam-tmp") ;; + "/proc" | "/dev" | "/run" | "/tmp" | "/opam-tmp") ;; "/sys") ;; # Disabled without a corresponding bind, due to security concerns *) add_sys_mounts "$dir";; esac diff --git a/src/state/shellscripts/sandbox_exec.sh b/src/state/shellscripts/sandbox_exec.sh index 7d639474b9c..44f1f42f995 100644 --- a/src/state/shellscripts/sandbox_exec.sh +++ b/src/state/shellscripts/sandbox_exec.sh @@ -7,6 +7,7 @@ set -ue POL='(version 1)(allow default)(deny network*)(deny file-write*)' POL="$POL"'(allow network* (remote unix))' POL="$POL"'(allow file-write* (literal "/dev/null") (literal "/dev/dtracehelper"))' +POL="$POL"'(allow file-write* (regex #"^(/private)?(/var)?/tmp/"))' add_mounts() { if [ -d "$2" ]; then From f69b92af09f127d469043bf29a04ce81409f5b28 Mon Sep 17 00:00:00 2001 From: Kate Date: Thu, 7 Sep 2023 13:16:43 +0100 Subject: [PATCH 2/2] sandbox: Make sure OPAMROOT is always read-only --- src/state/shellscripts/bwrap.sh | 6 ++++++ src/state/shellscripts/sandbox_exec.sh | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/src/state/shellscripts/bwrap.sh b/src/state/shellscripts/bwrap.sh index 78994a339c6..51587a8d7f7 100644 --- a/src/state/shellscripts/bwrap.sh +++ b/src/state/shellscripts/bwrap.sh @@ -99,6 +99,12 @@ add_dune_cache_mount() { mount_linked_cache "$dune_cache" } +# In case OPAMROOT happens to be in one of the writeable directories we +# need to make sure it is read-only +if [ -n ${OPAMROOT+x} ]; then + add_mounts ro "$OPAMROOT" +fi + # When using opam variable that must be defined at action time, add them also # at init check in OpamAuxCommands.check_and_revert_sandboxing (like # OPAM_SWITCH_PREFIX). diff --git a/src/state/shellscripts/sandbox_exec.sh b/src/state/shellscripts/sandbox_exec.sh index 44f1f42f995..d72dfcdf3e8 100644 --- a/src/state/shellscripts/sandbox_exec.sh +++ b/src/state/shellscripts/sandbox_exec.sh @@ -56,6 +56,12 @@ add_dune_cache_mount() { add_mounts rw "$dune_cache" } +# In case OPAMROOT happens to be in one of the writeable directories we +# need to make sure it is read-only +if [ -n ${OPAMROOT+x} ]; then + add_mounts ro "$OPAMROOT" +fi + # When using opam variable that must be defined at action time, add them also # at init check in OpamAuxCommands.check_and_revert_sandboxing (like # OPAM_SWITCH_PREFIX).