Check whether we can use PID namespaces

In unprivileged podman containers, /proc is not fully visible (there
are other filesystems mounted on subdirectories of /proc). Therefore
we can't mount a new /proc in the sandbox that matches the PID
namespace of the sandbox. So this commit automatically disables
sandboxing if /proc is not fully visible.
This commit is contained in:
Eelco Dolstra 2023-01-27 15:25:56 +01:00
parent fb2f7f5dcc
commit bc1d9fd8b5
3 changed files with 37 additions and 8 deletions

View file

@ -209,10 +209,10 @@ void LocalDerivationGoal::tryLocalBuild()
#if __linux__
if (useChroot) {
if (!mountNamespacesSupported()) {
if (!mountNamespacesSupported() || !pidNamespacesSupported()) {
if (!settings.sandboxFallback)
throw Error("this system does not support mount namespaces, which are required for sandboxing");
debug("auto-disabling sandboxing because mount namespaces are not available");
throw Error("this system does not support the kernel namespaces that are required for sandboxing");
debug("auto-disabling sandboxing because the prerequisite namespaces are not available");
useChroot = false;
}
}

View file

@ -1,5 +1,8 @@
#include "namespaces.hh"
#include "util.hh"
#include "finally.hh"
#include <mntent.h>
#if __linux__
@ -7,10 +10,10 @@ namespace nix {
bool userNamespacesSupported()
{
static bool res = [&]() -> bool
static auto res = [&]() -> bool
{
if (!pathExists("/proc/self/ns/user")) {
notice("'/proc/self/ns/user' does not exist; your kernel was likely built without CONFIG_USER_NS=y, which is required for sandboxing");
debug("'/proc/self/ns/user' does not exist; your kernel was likely built without CONFIG_USER_NS=y");
return false;
}
@ -18,7 +21,7 @@ bool userNamespacesSupported()
if (!pathExists(maxUserNamespaces) ||
trim(readFile(maxUserNamespaces)) == "0")
{
notice("user namespaces appear to be disabled; they are required for sandboxing; check '/proc/sys/user/max_user_namespaces'");
debug("user namespaces appear to be disabled; check '/proc/sys/user/max_user_namespaces'");
return false;
}
@ -26,7 +29,7 @@ bool userNamespacesSupported()
if (pathExists(procSysKernelUnprivilegedUsernsClone)
&& trim(readFile(procSysKernelUnprivilegedUsernsClone)) == "0")
{
notice("user namespaces appear to be disabled; they are required for sandboxing; check '/proc/sys/kernel/unprivileged_userns_clone'");
debug("user namespaces appear to be disabled; check '/proc/sys/kernel/unprivileged_userns_clone'");
return false;
}
@ -43,7 +46,7 @@ bool userNamespacesSupported()
bool mountNamespacesSupported()
{
static bool res = [&]() -> bool
static auto res = [&]() -> bool
{
bool useUserNamespace = userNamespacesSupported();
@ -58,6 +61,30 @@ bool mountNamespacesSupported()
return res;
}
bool pidNamespacesSupported()
{
static auto res = [&]() -> bool
{
/* Check whether /proc is fully visible, i.e. there are no
filesystems mounted on top of files inside /proc. If this
is not the case, then we cannot mount a new /proc inside
the sandbox that matches the sandbox's PID namespace.
See https://lore.kernel.org/lkml/87tvsrjai0.fsf@xmission.com/T/. */
auto fp = fopen("/proc/mounts", "r");
if (!fp) return false;
Finally delFP = [&]() { fclose(fp); };
while (auto ent = getmntent(fp))
if (hasPrefix(std::string_view(ent->mnt_dir), "/proc/")) {
debug("PID namespaces do not work because /proc is not fully visible; disabling sandboxing");
return false;
}
return true;
}();
return res;
}
}
#endif

View file

@ -6,4 +6,6 @@ bool userNamespacesSupported();
bool mountNamespacesSupported();
bool pidNamespacesSupported();
}