From 7ffa523fd15fcd9ab1a0ad85db860f467869946a Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Sat, 23 Jun 2012 00:51:40 -0400 Subject: In chroot builds, use a private SysV IPC namespace This improves isolation a bit further, and it's just one extra flag in the unshare() call. P.S. It would be very cool to use CLONE_NEWPID (to put the builder in a private PID namespace) as well, but that's slightly more risky since having a builder start as PID 1 may cause problems. --- src/libstore/build.cc | 31 +++++++++++++++++++------------ 1 file changed, 19 insertions(+), 12 deletions(-) (limited to 'src') diff --git a/src/libstore/build.cc b/src/libstore/build.cc index 0fb5eb0a86a0..cb697df5012a 100644 --- a/src/libstore/build.cc +++ b/src/libstore/build.cc @@ -1776,20 +1776,27 @@ void DerivationGoal::startBuilder() #if CHROOT_ENABLED if (useChroot) { - /* Create our own mount and network namespace. This - means that all the bind mounts we do will only show - up in this process and its children, and will - disappear automatically when we're done. - Similarly, this process will not have any network - interface except "lo" created below. */ - if (unshare(CLONE_NEWNS | CLONE_NEWNET) == -1) + /* Set up private namespaces for the build: + + - The private mount namespace ensures that all the + bind mounts we do will only show up in this + process and its children, and will disappear + automatically when we're done. + + - The private network namespace ensures that the + builder cannot talk to the outside world (or vice + versa). It only has a private loopback + interface. + + - The IPC namespace prevents the builder from + communicating with outside processes using SysV + IPC mechanisms (shared memory, message queues, + semaphores). It also ensures that all IPC + objects are destroyed when the builder exits. */ + if (unshare(CLONE_NEWNS | CLONE_NEWNET | CLONE_NEWIPC) == -1) throw SysError("cannot set up a private mount namespace"); - /* Initialise the loopback interface. Note that this - loopback device is unique to this process and its - children. Thus they won't be able to open - connections to the rest of the system, or vice - versa. */ + /* Initialise the loopback interface. */ AutoCloseFD fd(socket(PF_INET, SOCK_DGRAM, IPPROTO_IP)); if (fd == -1) throw SysError("cannot open IP socket"); -- cgit 1.4.1