nixos/nix
1
1
Fork 0
mirror of https://github.com/NixOS/nix.git synced 2025-11-28 13:11:00 +01:00
Code Activity

Merge pull request from GHSA-2ffj-w4mj-pg37

Browse source 
Sandbox escape 2.19
This commit is contained in:
Eelco Dolstra 2024-03-07 11:56:24 +01:00 • committed by GitHub
commit 9179bc5a6e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
8 changed files with 255 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/libstore/build/local-derivation-goal.cc
View file

@ -2543,6 +2543,12 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs()
[&](const DerivationOutput::CAFixed & dof) {
auto & wanted = dof.ca.hash;
// Replace the output by a fresh copy of itself to make sure
// that there's no stale file descriptor pointing to it
Path tmpOutput = actualPath + ".tmp";
renameFile(actualPath, tmpOutput);
copyFile(tmpOutput, actualPath, true);
auto newInfo0 = newInfoFromCA(DerivationOutput::CAFloating {
.method = dof.ca.method,
.hashType = wanted.type,

5
src/libutil/file-system.cc
View file

@ -616,6 +616,11 @@ void copy(const fs::directory_entry & from, const fs::path & to, bool andDelete)
}
}
void copyFile(const Path & oldPath, const Path & newPath, bool andDelete)
{
return copy(fs::directory_entry(fs::path(oldPath)), fs::path(newPath), andDelete);
}
void renameFile(const Path & oldName, const Path & newName)
{
fs::rename(oldName, newName);

7
src/libutil/file-system.hh
View file

@ -186,6 +186,13 @@ void renameFile(const Path & src, const Path & dst);
*/
void moveFile(const Path & src, const Path & dst);
/**
* Recursively copy the content of `oldPath` to `newPath`. If `andDelete` is
* `true`, then also remove `oldPath` (making this equivalent to `moveFile`, but
* with the guaranty that the destination will be “fresh”, with no stale inode
* or file descriptor pointing to it).
*/
void copyFile(const Path & oldPath, const Path & newPath, bool andDelete);
/**
* Automatic cleanup of resources.