Merge pull request #61740 from abbradar/nested-chrootenv

Support nested user chrootenv environments

pkgs/build-support/build-fhs-userenv/chrootenv/chrootenv.c

@@ -7,32 +7,43 @@
 #include <sched.h>
 #include <unistd.h>
 
+#include <sys/mount.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <sys/syscall.h>
+
 #define fail(s, err) g_error("%s: %s: %s", __func__, s, g_strerror(err))
 #define fail_if(expr)                                                          \
   if (expr)                                                                    \
     fail(#expr, errno);
 
-#include <ftw.h>
+const gchar *bind_blacklist[] = {"bin", "etc", "host", "real-host", "usr", "lib", "lib64", "lib32", "sbin", NULL};
 
-#include <sys/mount.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-
-int min(int a, int b) {
-  return a > b ? b : a;
+int pivot_root(const char *new_root, const char *put_old) {
+  return syscall(SYS_pivot_root, new_root, put_old);
 }
 
-const gchar *bind_blacklist[] = {"bin", "etc", "host", "usr", "lib", "lib64", "lib32", "sbin", NULL};
+void mount_tmpfs(const gchar *target) {
+  fail_if(mount("none", target, "tmpfs", 0, NULL));
+}
 
 void bind_mount(const gchar *source, const gchar *target) {
   fail_if(g_mkdir(target, 0755));
-  fail_if(mount(source, target, "bind", MS_BIND | MS_REC, NULL));
+  fail_if(mount(source, target, NULL, MS_BIND | MS_REC, NULL));
 }
 
-void bind_mount_host(const gchar *host, const gchar *guest) {
+const gchar *create_tmpdir() {
+  gchar *prefix =
+      g_build_filename(g_get_tmp_dir(), "chrootenvXXXXXX", NULL);
+  fail_if(!g_mkdtemp_full(prefix, 0755));
+  return prefix;
+}
+
+void pivot_host(const gchar *guest) {
   g_autofree gchar *point = g_build_filename(guest, "host", NULL);
-  bind_mount(host, point);
+  fail_if(g_mkdir(point, 0755));
+  fail_if(pivot_root(guest, point));
 }
 
 void bind_mount_item(const gchar *host, const gchar *guest, const gchar *name) {
@@ -44,19 +55,22 @@ void bind_mount_item(const gchar *host, const gchar *guest, const gchar *name) {
 }
 
 void bind(const gchar *host, const gchar *guest) {
+  mount_tmpfs(guest);
+  pivot_host(guest);
+
+  g_autofree gchar *host_dir = g_build_filename("/host", host, NULL);
+
   g_autoptr(GError) err = NULL;
-  g_autoptr(GDir) dir = g_dir_open(host, 0, &err);
+  g_autoptr(GDir) dir = g_dir_open(host_dir, 0, &err);
 
   if (err != NULL)
     fail("g_dir_open", errno);
 
   const gchar *item;
 
-  while (item = g_dir_read_name(dir))
+  while ((item = g_dir_read_name(dir)))
     if (!g_strv_contains(bind_blacklist, item))
-      bind_mount_item(host, guest, item);
-
-  bind_mount_host(host, guest);
+      bind_mount_item(host_dir, "/", item);
 }
 
 void spit(const char *path, char *fmt, ...) {
@@ -72,11 +86,6 @@ void spit(const char *path, char *fmt, ...) {
   fclose(f);
 }
 
-int nftw_remove(const char *path, const struct stat *sb, int type,
-                struct FTW *ftw) {
-  return remove(path);
-}
-
 int main(gint argc, gchar **argv) {
   const gchar *self = *argv++;
 
@@ -85,15 +94,7 @@ int main(gint argc, gchar **argv) {
     return 1;
   }
 
-  if (g_getenv("NIX_CHROOTENV"))
-    g_warning("chrootenv doesn't stack!");
-  else
-    g_setenv("NIX_CHROOTENV", "", TRUE);
-
-  g_autofree gchar *prefix =
-      g_build_filename(g_get_tmp_dir(), "chrootenvXXXXXX", NULL);
-
-  fail_if(!g_mkdtemp_full(prefix, 0755));
+  g_autofree const gchar *prefix = create_tmpdir();
 
   pid_t cpid = fork();
 
@@ -119,9 +120,24 @@ int main(gint argc, gchar **argv) {
     spit("/proc/self/uid_map", "%d %d 1", uid, uid);
     spit("/proc/self/gid_map", "%d %d 1", gid, gid);
 
-    bind("/", prefix);
+    // If there is a /host directory, assume this is nested chrootenv and use it as host instead.
+    gboolean nested_host = g_file_test("/host", G_FILE_TEST_EXISTS | G_FILE_TEST_IS_DIR);
+    g_autofree const gchar *host = nested_host ? "/host" : "/";
+
+    bind(host, prefix);
+
+    // Replace /host by an actual (inner) /host.
+    if (nested_host) {
+      fail_if(g_mkdir("/real-host", 0755));
+      fail_if(mount("/host/host", "/real-host", NULL, MS_BIND | MS_REC, NULL));
+      // For some reason umount("/host") returns EBUSY even immediately after
+      // pivot_root. We detach it at least to keep `/proc/mounts` from blowing
+      // up in nested cases.
+      fail_if(umount2("/host", MNT_DETACH));
+      fail_if(mount("/real-host", "/host", NULL, MS_MOVE, NULL));
+      fail_if(rmdir("/real-host"));
+    }
 
-    fail_if(chroot(prefix));
     fail_if(chdir("/"));
     fail_if(execvp(*argv, argv));
   }
@@ -130,10 +146,7 @@ int main(gint argc, gchar **argv) {
     int status;
 
     fail_if(waitpid(cpid, &status, 0) != cpid);
-    // glibc 2.27 (and possibly other versions) can't handle
-    // an nopenfd value larger than 2^19
-    fail_if(nftw(prefix, nftw_remove, min(getdtablesize(), 1<<19),
-                 FTW_DEPTH | FTW_MOUNT | FTW_PHYS));
+    fail_if(rmdir(prefix));
 
     if (WIFEXITED(status))
       return WEXITSTATUS(status);