chrootenv: rewrite on top of GLib

Changes:

* doesn't handle root user separately
* doesn't chdir("/") which makes using it seamless
* only bind mounts, doesn't symlink (i.e. files)

Incidentally, fixes #33106.

It's about two times shorter than the previous version, and much
easier to read/follow through. It uses GLib quite heavily, along with
RAII (available in GCC/Clang).

4 files changed, 160 insertions, 247 deletions

diff --git a/pkgs/build-support/build-fhs-userenv/chrootenv.c b/pkgs/build-support/build-fhs-userenv/chrootenv.c
deleted file mode 100644
index 43abf976bde..00000000000
--- a/pkgs/build-support/build-fhs-userenv/chrootenv.c
+++ /dev/null
@@ -1,238 +0,0 @@
-#define _GNU_SOURCE
-
-#include <errno.h>
-#include <error.h>
-
-#define errorf(status, fmt, ...)                                               \
-  error_at_line(status, errno, __FILE__, __LINE__, fmt, ##__VA_ARGS__)
-
-#include <dirent.h>
-#include <ftw.h>
-#include <sched.h>
-#include <stdarg.h>
-#include <stdbool.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sysexits.h>
-#include <unistd.h>
-
-#include <sys/mount.h>
-#include <sys/stat.h>
-#include <sys/wait.h>
-
-#define LEN(x) (sizeof(x) / sizeof(*x))
-
-// TODO: fill together with @abbradar when he gets better
-const char *environ_blacklist[] = {};
-
-void environ_blacklist_filter() {
-  for (size_t i = 0; i < LEN(environ_blacklist); i++) {
-    if (unsetenv(environ_blacklist[i]) < 0)
-      errorf(EX_OSERR, "unsetenv(%s)", environ_blacklist[i]);
-  }
-}
-
-void bind(const char *from, const char *to) {
-  if (mkdir(to, 0755) < 0)
-    errorf(EX_IOERR, "mkdir(%s)", to);
-
-  if (mount(from, to, "bind", MS_BIND | MS_REC, NULL) < 0)
-    errorf(EX_OSERR, "mount(%s, %s)", from, to);
-}
-
-const char *bind_blacklist[] = {".", "..", "bin", "etc", "host", "usr"};
-
-bool str_contains(const char *needle, const char **haystack, size_t len) {
-  for (size_t i = 0; i < len; i++) {
-    if (!strcmp(needle, haystack[i]))
-      return true;
-  }
-
-  return false;
-}
-
-bool is_dir(const char *path) {
-  struct stat buf;
-
-  if (stat(path, &buf) < 0)
-    errorf(EX_IOERR, "stat(%s)", path);
-
-  return S_ISDIR(buf.st_mode);
-}
-
-void bind_to_cwd(const char *prefix) {
-  DIR *prefix_dir = opendir(prefix);
-
-  if (prefix_dir == NULL)
-    errorf(EX_IOERR, "opendir(%s)", prefix);
-
-  struct dirent *prefix_dirent;
-
-  while (prefix_dirent = readdir(prefix_dir)) {
-    if (str_contains(prefix_dirent->d_name, bind_blacklist,
-                     LEN(bind_blacklist)))
-      continue;
-
-    char *prefix_dirent_path;
-
-    if (asprintf(&prefix_dirent_path, "%s%s", prefix, prefix_dirent->d_name) <
-        0)
-      errorf(EX_IOERR, "asprintf");
-
-    if (is_dir(prefix_dirent_path)) {
-      bind(prefix_dirent_path, prefix_dirent->d_name);
-    } else {
-      char *host_target;
-
-      if (asprintf(&host_target, "host/%s", prefix_dirent->d_name) < 0)
-        errorf(EX_IOERR, "asprintf");
-
-      if (symlink(host_target, prefix_dirent->d_name) < 0)
-        errorf(EX_IOERR, "symlink(%s, %s)", host_target, prefix_dirent->d_name);
-
-      free(host_target);
-    }
-
-    free(prefix_dirent_path);
-  }
-
-  bind(prefix, "host");
-
-  if (closedir(prefix_dir) < 0)
-    errorf(EX_IOERR, "closedir(%s)", prefix);
-}
-
-void spitf(const char *path, char *fmt, ...) {
-  va_list args;
-  va_start(args, fmt);
-
-  FILE *f = fopen(path, "w");
-
-  if (f == NULL)
-    errorf(EX_IOERR, "spitf(%s): fopen", path);
-
-  if (vfprintf(f, fmt, args) < 0)
-    errorf(EX_IOERR, "spitf(%s): vfprintf", path);
-
-  if (fclose(f) < 0)
-    errorf(EX_IOERR, "spitf(%s): fclose", path);
-}
-
-int nftw_remove(const char *path, const struct stat *sb, int type,
-                struct FTW *ftw) {
-  return remove(path);
-}
-
-#define REQUIREMENTS                                                           \
-  "Requires Linux version >= 3.19 built with CONFIG_USER_NS option.\n"
-
-int main(int argc, char *argv[]) {
-  const char *self = *argv++;
-
-  if (argc < 2) {
-    fprintf(stderr, "Usage: %s command [arguments...]\n" REQUIREMENTS, self);
-    exit(EX_USAGE);
-  }
-
-  if (getenv("NIX_CHROOTENV") != NULL) {
-    fputs("Can't create chrootenv inside chrootenv!\n", stderr);
-    exit(EX_USAGE);
-  }
-
-  if (setenv("NIX_CHROOTENV", "1", false) < 0)
-    errorf(EX_OSERR, "setenv(NIX_CHROOTENV, 1)");
-
-  const char *temp = getenv("TMPDIR");
-
-  if (temp == NULL)
-    temp = "/tmp";
-
-  char *root;
-
-  if (asprintf(&root, "%s/chrootenvXXXXXX", temp) < 0)
-    errorf(EX_IOERR, "asprintf");
-
-  root = mkdtemp(root);
-
-  if (root == NULL)
-    errorf(EX_IOERR, "mkdtemp(%s)", root);
-
-  // Don't make root private so that privilege drops inside chroot are possible:
-  if (chmod(root, 0755) < 0)
-    errorf(EX_IOERR, "chmod(%s, 0755)", root);
-
-  pid_t cpid = fork();
-
-  if (cpid < 0)
-    errorf(EX_OSERR, "fork");
-
-  if (cpid == 0) {
-    uid_t uid = getuid();
-    gid_t gid = getgid();
-
-    // If we are root, no need to create new user namespace.
-    if (uid == 0) {
-      if (unshare(CLONE_NEWNS) < 0) {
-        fputs(REQUIREMENTS, stderr);
-        errorf(EX_OSERR, "unshare");
-      }
-      // Mark all mounted filesystems as slave so changes
-      // don't propagate to the parent mount namespace.
-      if (mount(NULL, "/", NULL, MS_REC | MS_SLAVE, NULL) < 0)
-        errorf(EX_OSERR, "mount");
-    } else {
-      // Create new mount and user namespaces. CLONE_NEWUSER
-      // requires a program to be non-threaded.
-      if (unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0) {
-        fputs(access("/proc/sys/kernel/unprivileged_userns_clone", F_OK)
-                  ? REQUIREMENTS
-                  : "Run: sudo sysctl -w kernel.unprivileged_userns_clone=1\n",
-              stderr);
-        errorf(EX_OSERR, "unshare");
-      }
-
-      // Map users and groups to the parent namespace.
-      // setgroups is only available since Linux 3.19:
-      spitf("/proc/self/setgroups", "deny");
-
-      spitf("/proc/self/uid_map", "%d %d 1", uid, uid);
-      spitf("/proc/self/gid_map", "%d %d 1", gid, gid);
-    }
-
-    if (chdir(root) < 0)
-      errorf(EX_IOERR, "chdir(%s)", root);
-
-    bind_to_cwd("/");
-
-    if (chroot(root) < 0)
-      errorf(EX_OSERR, "chroot(%s)", root);
-
-    if (chdir("/") < 0)
-      errorf(EX_IOERR, "chdir(/)");
-
-    environ_blacklist_filter();
-
-    if (execvp(*argv, argv) < 0)
-      errorf(EX_OSERR, "execvp(%s)", *argv);
-  }
-
-  int status;
-
-  if (waitpid(cpid, &status, 0) < 0)
-    errorf(EX_OSERR, "waitpid(%d)", cpid);
-
-  if (nftw(root, nftw_remove, getdtablesize(),
-           FTW_DEPTH | FTW_MOUNT | FTW_PHYS) < 0)
-    errorf(EX_IOERR, "nftw(%s)", root);
-
-  free(root);
-
-  if (WIFEXITED(status)) {
-    return WEXITSTATUS(status);
-  } else if (WIFSIGNALED(status)) {
-    kill(getpid(), WTERMSIG(status));
-  }
-
-  return EX_OSERR;
-}
diff --git a/pkgs/build-support/build-fhs-userenv/chrootenv/chrootenv.c b/pkgs/build-support/build-fhs-userenv/chrootenv/chrootenv.c
new file mode 100644
index 00000000000..c03a1710f45
--- /dev/null
+++ b/pkgs/build-support/build-fhs-userenv/chrootenv/chrootenv.c
@@ -0,0 +1,139 @@
+#define _GNU_SOURCE
+
+#include <glib.h>
+#include <glib/gstdio.h>
+
+#include <errno.h>
+#include <sched.h>
+#include <unistd.h>
+
+#define fail(s, err) g_error("%s: %s: %s", __func__, s, g_strerror(err))
+#define fail_if(expr)                                                          \
+  if (expr)                                                                    \
+    fail(#expr, errno);
+
+#include <ftw.h>
+
+#include <sys/mount.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+
+const gchar *bind_blacklist[] = {"bin", "etc", "host", "usr", NULL};
+
+void bind_mount(const gchar *source, const gchar *target) {
+  fail_if(g_mkdir(target, 0755));
+  fail_if(mount(source, target, "bind", MS_BIND | MS_REC, NULL));
+}
+
+void bind_mount_host(const gchar *host, const gchar *guest) {
+  g_autofree gchar *point = g_build_filename(guest, "host", NULL);
+  bind_mount(host, point);
+}
+
+void bind_mount_item(const gchar *host, const gchar *guest, const gchar *name) {
+  g_autofree gchar *source = g_build_filename(host, name, NULL);
+  g_autofree gchar *target = g_build_filename(guest, name, NULL);
+
+  if (G_LIKELY(g_file_test(source, G_FILE_TEST_IS_DIR)))
+    bind_mount(source, target);
+}
+
+void bind(const gchar *host, const gchar *guest) {
+  g_autoptr(GError) err = NULL;
+  g_autoptr(GDir) dir = g_dir_open(host, 0, &err);
+
+  if (err != NULL)
+    fail("g_dir_open", errno);
+
+  const gchar *item;
+
+  while (item = g_dir_read_name(dir))
+    if (!g_strv_contains(bind_blacklist, item))
+      bind_mount_item(host, guest, item);
+
+  bind_mount_host(host, guest);
+}
+
+void spit(const char *path, char *fmt, ...) {
+  va_list args;
+  va_start(args, fmt);
+
+  FILE *f = g_fopen(path, "w");
+
+  if (f == NULL)
+    fail("g_fopen", errno);
+
+  g_vfprintf(f, fmt, args);
+  fclose(f);
+}
+
+int nftw_remove(const char *path, const struct stat *sb, int type,
+                struct FTW *ftw) {
+  return remove(path);
+}
+
+int main(gint argc, gchar **argv) {
+  const gchar *self = *argv++;
+
+  if (argc < 2) {
+    g_message("%s command [arguments...]", self);
+    return 1;
+  }
+
+  if (g_getenv("NIX_CHROOTENV"))
+    g_warning("chrootenv doesn't stack!");
+  else
+    g_setenv("NIX_CHROOTENV", "", TRUE);
+
+  g_autofree gchar *prefix =
+      g_build_filename(g_get_tmp_dir(), "chrootenvXXXXXX", NULL);
+
+  fail_if(!g_mkdtemp_full(prefix, 0755));
+
+  pid_t cpid = fork();
+
+  if (cpid < 0)
+    fail("fork", errno);
+
+  else if (cpid == 0) {
+    uid_t uid = getuid();
+    gid_t gid = getgid();
+
+    if (unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0) {
+      int unshare_errno = errno;
+
+      g_message("Requires Linux version >= 3.19 built with CONFIG_USER_NS");
+      if (g_file_test("/proc/sys/kernel/unprivileged_userns_clone",
+                      G_FILE_TEST_EXISTS))
+        g_message("Run: sudo sysctl -w kernel.unprivileged_userns_clone=1");
+
+      fail("unshare", unshare_errno);
+    }
+
+    spit("/proc/self/setgroups", "deny");
+    spit("/proc/self/uid_map", "%d %d 1", uid, uid);
+    spit("/proc/self/gid_map", "%d %d 1", gid, gid);
+
+    bind("/", prefix);
+
+    fail_if(chroot(prefix));
+    fail_if(execvp(*argv, argv));
+  }
+
+  else {
+    int status;
+
+    fail_if(waitpid(cpid, &status, 0) != cpid);
+    fail_if(nftw(prefix, nftw_remove, getdtablesize(),
+                 FTW_DEPTH | FTW_MOUNT | FTW_PHYS));
+
+    if (WIFEXITED(status))
+      return WEXITSTATUS(status);
+
+    else if (WIFSIGNALED(status))
+      kill(getpid(), WTERMSIG(status));
+
+    return 1;
+  }
+}
diff --git a/pkgs/build-support/build-fhs-userenv/chrootenv/default.nix b/pkgs/build-support/build-fhs-userenv/chrootenv/default.nix
new file mode 100644
index 00000000000..375c30e1e46
--- /dev/null
+++ b/pkgs/build-support/build-fhs-userenv/chrootenv/default.nix
@@ -0,0 +1,19 @@
+{ stdenv, pkgconfig, glib }:
+
+stdenv.mkDerivation {
+  name = "chrootenv";
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ glib ];
+
+  buildCommand = ''
+    cc ${./chrootenv.c} $(pkg-config --cflags --libs glib-2.0) -o $out
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Setup mount/user namespace for FHS emulation";
+    license = licenses.free;
+    maintainers = with maintainers; [ yegortimoshenko ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/build-support/build-fhs-userenv/default.nix b/pkgs/build-support/build-fhs-userenv/default.nix
index 5f3ec4dc8ea..219530a67bd 100644
--- a/pkgs/build-support/build-fhs-userenv/default.nix
+++ b/pkgs/build-support/build-fhs-userenv/default.nix
@@ -1,4 +1,4 @@
-{ callPackage, runCommand, lib, writeScript, stdenv, coreutils, ruby }:
+{ callPackage, runCommand, lib, writeScript, stdenv, coreutils }:
 
 let buildFHSEnv = callPackage ./env.nix { }; in
 
@@ -7,14 +7,7 @@ args@{ name, runScript ? "bash", extraInstallCommands ? "", meta ? {}, passthru
 let
   env = buildFHSEnv (removeAttrs args [ "runScript" "extraInstallCommands" "meta" "passthru" ]);
 
-  chrootenv = stdenv.mkDerivation {
-    name = "chrootenv";
-
-    unpackPhase = "cp ${./chrootenv.c} chrootenv.c";
-    installPhase = "cp chrootenv $out";
-
-    makeFlags = [ "chrootenv" ];
-  };
+  chrootenv = callPackage ./chrootenv {};
 
   init = run: writeScript "${name}-init" ''
     #! ${stdenv.shell}