'install' breaks sandbox isolation #2400

Open
mietek opened this Issue Jan 31, 2015 · 1 comment

Projects

None yet

4 participants

@mietek
Contributor
mietek commented Jan 31, 2015

It seems to me that when performing cabal install in a sandbox, cabal-install can break the intended sandbox isolation by using the Cabal library installed in the GHC user package DB, as opposed to its internal Cabal library.

  1. Install GHC 7.8.4 and cabal-install 1.20.0.3. Ensure ~/.ghc is empty:
$ rm -rf ~/.ghc
$ ghc-pkg list
/app/ghc/lib/ghc-7.8.4/package.conf.d
   Cabal-1.18.1.5
   array-0.5.0.0
   base-4.7.0.2
   bin-package-db-0.0.0.0
   binary-0.7.1.0
   bytestring-0.10.4.0
   containers-0.5.5.1
   deepseq-1.3.0.2
   directory-1.2.1.0
   filepath-1.3.0.2
   ghc-7.8.4
   ghc-prim-0.3.1.0
   haskeline-0.7.1.2
   haskell2010-1.1.2.0
   haskell98-2.0.0.3
   hoopl-3.10.0.1
   hpc-0.6.0.1
   integer-gmp-0.5.1.0
   old-locale-1.0.0.6
   old-time-1.1.0.2
   pretty-1.1.1.1
   process-1.2.0.0
   rts-1.0
   template-haskell-2.9.0.0
   terminfo-0.4.0.0
   time-1.4.2
   transformers-0.3.0.0
   unix-2.7.0.1
   xhtml-3000.2.1
  1. Ensure cabal is really 1.20.0.3:
$ cabal --version
cabal-install version 1.20.0.3
using version 1.20.0.0 of the Cabal library
  1. Without replacing cabal-install 1.20.0.3, install cabal-install 1.22.0.0. Ensure ~/.ghc is populated:
$ cabal --no-require-sandbox install cabal-install
$ ghc-pkg list
/app/ghc/lib/ghc-7.8.4/package.conf.d
   Cabal-1.18.1.5
   array-0.5.0.0
   base-4.7.0.2
   bin-package-db-0.0.0.0
   binary-0.7.1.0
   bytestring-0.10.4.0
   containers-0.5.5.1
   deepseq-1.3.0.2
   directory-1.2.1.0
   filepath-1.3.0.2
   ghc-7.8.4
   ghc-prim-0.3.1.0
   haskeline-0.7.1.2
   haskell2010-1.1.2.0
   haskell98-2.0.0.3
   hoopl-3.10.0.1
   hpc-0.6.0.1
   integer-gmp-0.5.1.0
   old-locale-1.0.0.6
   old-time-1.1.0.2
   pretty-1.1.1.1
   process-1.2.0.0
   rts-1.0
   template-haskell-2.9.0.0
   terminfo-0.4.0.0
   time-1.4.2
   transformers-0.3.0.0
   unix-2.7.0.1
   xhtml-3000.2.1
/root/.ghc/x86_64-linux-7.8.4/package.conf.d
   Cabal-1.22.0.0
   HTTP-4000.2.19
   mtl-2.2.1
   network-2.6.0.2
   network-uri-2.6.0.1
   parsec-3.1.8
   random-1.1
   stm-2.4.4
   text-1.2.0.4
   transformers-0.4.2.0
   zlib-0.5.4.2
  1. Note cabal is still seemingly using its internal Cabal library:
$ cabal --version
cabal-install version 1.20.0.3
using version 1.20.0.0 of the Cabal library
  1. Use cabal-install 1.20.0.3 to install some package in a sandbox. Note warnings:
$ mkdir ~/alex-a && cd ~/alex-a && cabal sandbox init && cabal install alex-3.1.4
Writing a default package environment file to
/root/alex-a/cabal.sandbox.config
Creating a new sandbox at /root/alex-a/.cabal-sandbox
Resolving dependencies...
Notice: installing into a sandbox located at /root/alex-a/.cabal-sandbox
Configuring primitive-0.5.4.0...
Configuring random-1.1...
Building primitive-0.5.4.0...
Building random-1.1...
Warning: /tmp/pkgConf-primitive-0.5.419500.0: Unrecognized field data-dir on
line 24
/tmp/pkgConf-primitive-0.5.419500.0: Unrecognized field key on line 4
Installed primitive-0.5.4.0
Warning: /tmp/pkgConf-random-119500.1: Unrecognized field data-dir on line 19
/tmp/pkgConf-random-119500.1: Unrecognized field key on line 4
Installed random-1.1
Configuring tf-random-0.5...
Building tf-random-0.5...
Warning: /tmp/pkgConf-tf-random-019500.5: Unrecognized field data-dir on line
33
/tmp/pkgConf-tf-random-019500.5: Unrecognized field key on line 4
Installed tf-random-0.5
Configuring QuickCheck-2.7.6...
Building QuickCheck-2.7.6...
Warning: /tmp/pkgConf-QuickCheck-2.719500.6: Unrecognized field data-dir on
line 37
/tmp/pkgConf-QuickCheck-2.719500.6: Unrecognized field key on line 4
Installed QuickCheck-2.7.6
Configuring alex-3.1.4...
Building alex-3.1.4...
Installed alex-3.1.4
  1. Remove populated ~/.ghc:
$ rm -rf ~/.ghc
  1. Use cabal-install 1.20.0.3 to install the same package in another sandbox. Note lack of warnings:
$ mkdir ~/alex-b && cd ~/alex-b && cabal sandbox init && cabal install alex-3.1.4
Writing a default package environment file to
/root/alex-b/cabal.sandbox.config
Creating a new sandbox at /root/alex-b/.cabal-sandbox
Resolving dependencies...
Notice: installing into a sandbox located at /root/alex-b/.cabal-sandbox
Configuring primitive-0.5.4.0...
Configuring random-1.1...
Building random-1.1...
Building primitive-0.5.4.0...
Installed primitive-0.5.4.0
Installed random-1.1
Configuring tf-random-0.5...
Building tf-random-0.5...
Installed tf-random-0.5
Configuring QuickCheck-2.7.6...
Building QuickCheck-2.7.6...
Installed QuickCheck-2.7.6
Configuring alex-3.1.4...
Building alex-3.1.4...
Installed alex-3.1.4

Judging by the warnings in step 5, which seem to be due to changes introduced in Cabal 1.22.0.0, the version of the Cabal library installed in the GHC user package DB somehow appears to be leaking into the sandbox. This is bad, as sandboxes are expected to isolate the user from the contents of the GHC user package DB (#1621 (comment)).

cc @23Skidoo @tibbe

@mietek mietek referenced this issue in mietek/halcyon Jan 31, 2015
Closed

Halcyon breaks if ~/.ghc is present #5

@mietek
Contributor
mietek commented Feb 2, 2015

Halcyon includes a workaround for this issue.

@ttuegel ttuegel added this to the cabal-install-1.24 milestone Apr 24, 2015
@ezyang ezyang modified the milestone: cabal-install 2.0 Sep 6, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment