Fix obscure corner case in name resolution for builtin:fetchurl in sandboxed environments
This commit is contained in:
		
							parent
							
								
									c382866cd2
								
							
						
					
					
						commit
						d43a8b25f0
					
				
					 1 changed files with 17 additions and 0 deletions
				
			
		|  | @ -6,6 +6,7 @@ | |||
| #include "archive.hh" | ||||
| #include "affinity.hh" | ||||
| #include "builtins.hh" | ||||
| #include "download.hh" | ||||
| #include "finally.hh" | ||||
| #include "compression.hh" | ||||
| #include "json.hh" | ||||
|  | @ -1777,6 +1778,19 @@ PathSet exportReferences(Store & store, PathSet storePaths) | |||
|     return paths; | ||||
| } | ||||
| 
 | ||||
| static std::once_flag dns_resolve_flag; | ||||
| 
 | ||||
| static void preloadNSS() { | ||||
|     /* builtin:fetchurl can trigger a DNS lookup, which with glibc can trigger a dynamic library load of
 | ||||
|        one of the glibc NSS libraries in a sandboxed child, which will fail unless the library's already | ||||
|        been loaded in the parent. So we force a download of an invalid URL to force the NSS machinery to | ||||
|        load its lookup libraries in the parent before any child gets a chance to. */ | ||||
|     std::call_once(dns_resolve_flag, []() { | ||||
|         DownloadRequest request("http://this.pre-initializes.the.dns.resolvers.invalid"); | ||||
|         request.tries = 1; // We only need to do it once, and this also suppresses an annoying warning
 | ||||
|         try { getDownloader()->download(request); } catch (...) {} | ||||
|     }); | ||||
| } | ||||
| 
 | ||||
| void DerivationGoal::startBuilder() | ||||
| { | ||||
|  | @ -1787,6 +1801,9 @@ void DerivationGoal::startBuilder() | |||
|             % drv->platform % settings.thisSystem % drvPath); | ||||
|     } | ||||
| 
 | ||||
|     if (drv->isBuiltin()) | ||||
|         preloadNSS(); | ||||
| 
 | ||||
| #if __APPLE__ | ||||
|     additionalSandboxProfile = get(drv->env, "__sandboxProfile"); | ||||
| #endif | ||||
|  |  | |||
		Loading…
	
	Add table
		Add a link
		
	
		Reference in a new issue