1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-07-07 18:31:49 +02:00

Merge pull request #7878 from NixOS/backport-7856-to-2.13-maintenance

[Backport 2.13-maintenance] Wait with making /etc unwritable until after build env setup
This commit is contained in:
Théophane Hufschmitt 2023-02-22 06:52:14 +01:00 committed by GitHub
commit 4acc684ef7
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -1024,10 +1024,6 @@ void LocalDerivationGoal::startBuilder()
"nobody:x:65534:65534:Nobody:/:/noshell\n",
sandboxUid(), sandboxGid(), settings.sandboxBuildDir));
/* Make /etc unwritable */
if (!parsedDrv->useUidRange())
chmod_(chrootRootDir + "/etc", 0555);
/* Save the mount- and user namespace of the child. We have to do this
*before* the child does a chroot. */
sandboxMountNamespace = open(fmt("/proc/%d/ns/mnt", (pid_t) pid).c_str(), O_RDONLY);
@ -1912,6 +1908,10 @@ void LocalDerivationGoal::runChild()
}
}
/* Make /etc unwritable */
if (!parsedDrv->useUidRange())
chmod_(chrootRootDir + "/etc", 0555);
/* Unshare this mount namespace. This is necessary because
pivot_root() below changes the root of the mount
namespace. This means that the call to setns() in