New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make /var/empty immutable (with chattr +i) #18365

Merged
merged 2 commits into from Sep 7, 2016

Conversation

Projects
None yet
7 participants
@domenkozar
Member

domenkozar commented Sep 6, 2016

See #18358 and #14910 what bugs these caused.

cc @edolstra

@mention-bot

This comment has been minimized.

Show comment
Hide comment
@mention-bot

mention-bot Sep 6, 2016

@domenkozar, thanks for your PR! By analyzing the annotation information on this pull request, we identified @edolstra, @nathan7 and @peti to be potential reviewers

mention-bot commented Sep 6, 2016

@domenkozar, thanks for your PR! By analyzing the annotation information on this pull request, we identified @edolstra, @nathan7 and @peti to be potential reviewers

@edolstra

This comment has been minimized.

Show comment
Hide comment
@edolstra

edolstra Sep 6, 2016

Member

No, don't make it a link to the Nix store! Paths in the Nix store can have group = nixbld, which will probably cause sshd to fail. Just do chattr +i /var/empty.

Also, /var/empty is not a GC root, which might cause problems.

Member

edolstra commented Sep 6, 2016

No, don't make it a link to the Nix store! Paths in the Nix store can have group = nixbld, which will probably cause sshd to fail. Just do chattr +i /var/empty.

Also, /var/empty is not a GC root, which might cause problems.

@domenkozar

This comment has been minimized.

Show comment
Hide comment
@domenkozar
Member

domenkozar commented Sep 6, 2016

@edolstra updated

@domenkozar

This comment has been minimized.

Show comment
Hide comment
@domenkozar

domenkozar Sep 6, 2016

Member

Just a side note: lots of these mkdir -m commands claim to be idempotent, but they're really not since permissions are not reset if directory exists.

Member

domenkozar commented Sep 6, 2016

Just a side note: lots of these mkdir -m commands claim to be idempotent, but they're really not since permissions are not reset if directory exists.

@groxxda

This comment has been minimized.

Show comment
Hide comment
@groxxda

groxxda Sep 6, 2016

Contributor

Could we use a tmpfs with size=0,mode=000?

Contributor

groxxda commented Sep 6, 2016

Could we use a tmpfs with size=0,mode=000?

@domenkozar

This comment has been minimized.

Show comment
Hide comment
@domenkozar

domenkozar Sep 6, 2016

Member

@groxxda what advantage would that have over chattr +i?

Member

domenkozar commented Sep 6, 2016

@groxxda what advantage would that have over chattr +i?

@groxxda

This comment has been minimized.

Show comment
Hide comment
@groxxda

groxxda Sep 6, 2016

Contributor

@domenkozar it's probably just me not being a fan of chattr 😉
only advantage I can think of is file-system support. But it's probably not relevant because nobody has /var on a tmpfs

btw: Does your patch work when run twice?

Contributor

groxxda commented Sep 6, 2016

@domenkozar it's probably just me not being a fan of chattr 😉
only advantage I can think of is file-system support. But it's probably not relevant because nobody has /var on a tmpfs

btw: Does your patch work when run twice?

Make /var/empty immutable
Fixes #14910 and #18358

Deployed to an existing server, restarted sshd and polkit to verify
they don't fail.
@domenkozar

This comment has been minimized.

Show comment
Hide comment
@domenkozar

domenkozar Sep 6, 2016

Member

@groxxda it did, but I pushed a fix for rm: cannot remove '/var/empty': Operation not permitted

Member

domenkozar commented Sep 6, 2016

@groxxda it did, but I pushed a fix for rm: cannot remove '/var/empty': Operation not permitted

@grahamc grahamc changed the title from Make /var/empty immutable (symlink to nix store) to Make /var/empty immutable (with chattr +i) Sep 7, 2016

@grahamc

This comment has been minimized.

Show comment
Hide comment
@grahamc

grahamc Sep 7, 2016

Member

(Updated the title to reflect the solution)

Member

grahamc commented Sep 7, 2016

(Updated the title to reflect the solution)

@domenkozar

This comment has been minimized.

Show comment
Hide comment
@domenkozar

domenkozar Sep 7, 2016

Member

@edolstra any objections?

Member

domenkozar commented Sep 7, 2016

@edolstra any objections?

@domenkozar

This comment has been minimized.

Show comment
Hide comment
@domenkozar
Member

domenkozar commented Sep 7, 2016

@edolstra fixed

@edolstra edolstra merged commit 70be99c into master Sep 7, 2016

0 of 2 checks passed

continuous-integration/travis-ci/pr The Travis CI build is in progress
Details
continuous-integration/travis-ci/push The Travis CI build is in progress
Details

@peti peti deleted the fix-sshd-failure branch Sep 7, 2016

@fpletz

This comment has been minimized.

Show comment
Hide comment
@fpletz

fpletz Sep 20, 2016

Member

This breaks nixos-containers. Removing containers won't be possible because /var/empty can't be removed and the error message (Permission denied) is not very helpful because the root cause is the immutable flag.

@domenkozar Why is the immutable flag needed? Is something modifying this directory's permissions?

Member

fpletz commented on 3877ec5 Sep 20, 2016

This breaks nixos-containers. Removing containers won't be possible because /var/empty can't be removed and the error message (Permission denied) is not very helpful because the root cause is the immutable flag.

@domenkozar Why is the immutable flag needed? Is something modifying this directory's permissions?

This comment has been minimized.

Show comment
Hide comment
@twhitehead

twhitehead Nov 24, 2016

Contributor

I just finished running into this. As @fpletz says, it breaks nixos-container destroy and you have to go in manually and remove the immutable attribute and then cleanup the appropriate /var/lib/containers directory.

Contributor

twhitehead replied Nov 24, 2016

I just finished running into this. As @fpletz says, it breaks nixos-container destroy and you have to go in manually and remove the immutable attribute and then cleanup the appropriate /var/lib/containers directory.

@domenkozar

This comment has been minimized.

Show comment
Hide comment
@domenkozar

domenkozar Sep 21, 2016

Member

@fpletz I've linked two issues in description of the PR for motivation what issues we fix.

I think it's safe to disable this for containers.

Member

domenkozar commented Sep 21, 2016

@fpletz I've linked two issues in description of the PR for motivation what issues we fix.

I think it's safe to disable this for containers.

@domenkozar

This comment has been minimized.

Show comment
Hide comment
@domenkozar

domenkozar Sep 21, 2016

Member

@fpletz here needs to be added chattr -R -f -i: https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/virtualization/nixos-container/nixos-container.pl#L248

Any we probably should test if container deletion works in the tests.

Member

domenkozar commented Sep 21, 2016

@fpletz here needs to be added chattr -R -f -i: https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/virtualization/nixos-container/nixos-container.pl#L248

Any we probably should test if container deletion works in the tests.

@domenkozar

This comment has been minimized.

Show comment
Hide comment
@domenkozar

domenkozar Sep 21, 2016

Member

Ah it already is, but doesn't fail: http://hydra.nixos.org/build/40856595/log/raw

Member

domenkozar commented Sep 21, 2016

Ah it already is, but doesn't fail: http://hydra.nixos.org/build/40856595/log/raw

domenkozar added a commit that referenced this pull request Sep 30, 2016

domenkozar added a commit that referenced this pull request Sep 30, 2016

changelog for #18365
(cherry picked from commit 14c16f2)
Signed-off-by: Domen Kožar <domen@dev.si>

peterhoeg added a commit to peterhoeg/nixpkgs that referenced this pull request Oct 2, 2016

changelog for #18365
(cherry picked from commit 14c16f2)
Signed-off-by: Domen Kožar <domen@dev.si>

bramd added a commit to bramd/nixpkgs that referenced this pull request Oct 22, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment