git/list[1] front-page[2] threads[3] people[4] search[5] about
 

FORCE_DIR_SET_GID denied inside nix's build sandbox

From
JMJulien Moutinho <julm+git@sourcephile.fr>
Date
Oct 25, 2022, 16:30 UTC
Message-ID
<20221025163024.uutqv7w24yi4eo5i@sourcephile.fr>
Hi,

While running public-inbox's tests inside nix's build sandbox I've noticed that when core.sharedRepository is set to 0600 git still tries in adjust_shared_perm() to set the g+s bit on directories. https://github.com/git/git/blob/1fc3c0ad407008c2f71dd9ae1241d8b75f8ef886/path.c#L901-L905

However, nix's build sandbox denies g+s (such chmod returning EPERM) because it could be leveraged to break the isolation of the build user. https://github.com/NixOS/nix/blob/b3d2a05c59266688aa904d5fb326394cbb7e9e90/src/libstore/sandbox-defaults.sb#L5-L7

So, on meta@public-inbox.org we were wondering whether git should maybe strip S_ISGID and retry to chmod() if it hits EPERM? https://public-inbox.org/meta/20221025101756.M341966@dcvr/T/#m3f4e9eba9b903a263221ab82ce7ddcd44248d033

Any thoughts on that matter? Thanks!

Next: Junio C Hamano
Message 1 of 3 in “FORCE_DIR_SET_GID denied inside nix's build sandbox”
  1. Julien MoutinhoOct 25, 2022
  2. Junio C HamanoOct 25, 2022
  3. Julien MoutinhoOct 25, 2022

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.