Merge pull request #5634 from kit-ty-kate/rw-slash-tmp

Sandboxes: Make /tmp writable to restore POSIX compliancy

master_changes.md

@@ -66,6 +66,7 @@ users)
 ## Format upgrade
 
 ## Sandbox
+  * Make /tmp writable again to restore POSIX compliancy [#5634 @kit-ty-kate - fixes #5462]
 
 ## VCS
 

src/state/shellscripts/bwrap.sh

@@ -19,6 +19,7 @@ fi
 ARGS=(--unshare-net --new-session --die-with-parent)
 ARGS=("${ARGS[@]}" --proc /proc --dev /dev)
 ARGS=("${ARGS[@]}" --setenv TMPDIR /opam-tmp --setenv TMP /opam-tmp --setenv TEMPDIR /opam-tmp --setenv TEMP /opam-tmp)
+ARGS=("${ARGS[@]}" --bind /tmp /tmp)
 ARGS=("${ARGS[@]}" --tmpfs /opam-tmp)
 ARGS=("${ARGS[@]}" --tmpfs /run)
 # NOTE: When adding a new mount-point please sync with the loop below to avoid overriding the mount point
@@ -62,7 +63,7 @@ add_sys_mounts() {
 # See https://github.com/containers/bubblewrap/issues/413
 for dir in /*; do
     case "$dir" in
-    "/proc" | "/dev" | "/run" | "/opam-tmp") ;;
+    "/proc" | "/dev" | "/run" | "/tmp" | "/opam-tmp") ;;
     "/sys") ;; # Disabled without a corresponding bind, due to security concerns
     *) add_sys_mounts "$dir";;
     esac
@@ -98,6 +99,12 @@ add_dune_cache_mount() {
   mount_linked_cache "$dune_cache"
 }
 
+# In case OPAMROOT happens to be in one of the writeable directories we
+# need to make sure it is read-only
+if [ -n ${OPAMROOT+x} ]; then
+  add_mounts ro "$OPAMROOT"
+fi
+
 # When using opam variable that must be defined at action time, add them also
 # at init check in OpamAuxCommands.check_and_revert_sandboxing (like
 # OPAM_SWITCH_PREFIX).

src/state/shellscripts/sandbox_exec.sh

@@ -7,6 +7,7 @@ set -ue
 POL='(version 1)(allow default)(deny network*)(deny file-write*)'
 POL="$POL"'(allow network* (remote unix))'
 POL="$POL"'(allow file-write* (literal "/dev/null") (literal "/dev/dtracehelper"))'
+POL="$POL"'(allow file-write* (regex #"^(/private)?(/var)?/tmp/"))'
 
 add_mounts() {
     if [ -d "$2" ]; then
@@ -55,6 +56,12 @@ add_dune_cache_mount() {
   add_mounts rw "$dune_cache"
 }
 
+# In case OPAMROOT happens to be in one of the writeable directories we
+# need to make sure it is read-only
+if [ -n ${OPAMROOT+x} ]; then
+  add_mounts ro "$OPAMROOT"
+fi
+
 # When using opam variable that must be defined at action time, add them also
 # at init check in OpamAuxCommands.check_and_revert_sandboxing (like
 # OPAM_SWITCH_PREFIX).