New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

'install' breaks sandbox isolation #2400

Open
mietek opened this Issue Jan 31, 2015 · 1 comment

Comments

Projects
None yet
5 participants
@mietek
Contributor

mietek commented Jan 31, 2015

It seems to me that when performing cabal install in a sandbox, cabal-install can break the intended sandbox isolation by using the Cabal library installed in the GHC user package DB, as opposed to its internal Cabal library.

  1. Install GHC 7.8.4 and cabal-install 1.20.0.3. Ensure ~/.ghc is empty:
$ rm -rf ~/.ghc
$ ghc-pkg list
/app/ghc/lib/ghc-7.8.4/package.conf.d
   Cabal-1.18.1.5
   array-0.5.0.0
   base-4.7.0.2
   bin-package-db-0.0.0.0
   binary-0.7.1.0
   bytestring-0.10.4.0
   containers-0.5.5.1
   deepseq-1.3.0.2
   directory-1.2.1.0
   filepath-1.3.0.2
   ghc-7.8.4
   ghc-prim-0.3.1.0
   haskeline-0.7.1.2
   haskell2010-1.1.2.0
   haskell98-2.0.0.3
   hoopl-3.10.0.1
   hpc-0.6.0.1
   integer-gmp-0.5.1.0
   old-locale-1.0.0.6
   old-time-1.1.0.2
   pretty-1.1.1.1
   process-1.2.0.0
   rts-1.0
   template-haskell-2.9.0.0
   terminfo-0.4.0.0
   time-1.4.2
   transformers-0.3.0.0
   unix-2.7.0.1
   xhtml-3000.2.1
  1. Ensure cabal is really 1.20.0.3:
$ cabal --version
cabal-install version 1.20.0.3
using version 1.20.0.0 of the Cabal library
  1. Without replacing cabal-install 1.20.0.3, install cabal-install 1.22.0.0. Ensure ~/.ghc is populated:
$ cabal --no-require-sandbox install cabal-install
$ ghc-pkg list
/app/ghc/lib/ghc-7.8.4/package.conf.d
   Cabal-1.18.1.5
   array-0.5.0.0
   base-4.7.0.2
   bin-package-db-0.0.0.0
   binary-0.7.1.0
   bytestring-0.10.4.0
   containers-0.5.5.1
   deepseq-1.3.0.2
   directory-1.2.1.0
   filepath-1.3.0.2
   ghc-7.8.4
   ghc-prim-0.3.1.0
   haskeline-0.7.1.2
   haskell2010-1.1.2.0
   haskell98-2.0.0.3
   hoopl-3.10.0.1
   hpc-0.6.0.1
   integer-gmp-0.5.1.0
   old-locale-1.0.0.6
   old-time-1.1.0.2
   pretty-1.1.1.1
   process-1.2.0.0
   rts-1.0
   template-haskell-2.9.0.0
   terminfo-0.4.0.0
   time-1.4.2
   transformers-0.3.0.0
   unix-2.7.0.1
   xhtml-3000.2.1
/root/.ghc/x86_64-linux-7.8.4/package.conf.d
   Cabal-1.22.0.0
   HTTP-4000.2.19
   mtl-2.2.1
   network-2.6.0.2
   network-uri-2.6.0.1
   parsec-3.1.8
   random-1.1
   stm-2.4.4
   text-1.2.0.4
   transformers-0.4.2.0
   zlib-0.5.4.2
  1. Note cabal is still seemingly using its internal Cabal library:
$ cabal --version
cabal-install version 1.20.0.3
using version 1.20.0.0 of the Cabal library
  1. Use cabal-install 1.20.0.3 to install some package in a sandbox. Note warnings:
$ mkdir ~/alex-a && cd ~/alex-a && cabal sandbox init && cabal install alex-3.1.4
Writing a default package environment file to
/root/alex-a/cabal.sandbox.config
Creating a new sandbox at /root/alex-a/.cabal-sandbox
Resolving dependencies...
Notice: installing into a sandbox located at /root/alex-a/.cabal-sandbox
Configuring primitive-0.5.4.0...
Configuring random-1.1...
Building primitive-0.5.4.0...
Building random-1.1...
Warning: /tmp/pkgConf-primitive-0.5.419500.0: Unrecognized field data-dir on
line 24
/tmp/pkgConf-primitive-0.5.419500.0: Unrecognized field key on line 4
Installed primitive-0.5.4.0
Warning: /tmp/pkgConf-random-119500.1: Unrecognized field data-dir on line 19
/tmp/pkgConf-random-119500.1: Unrecognized field key on line 4
Installed random-1.1
Configuring tf-random-0.5...
Building tf-random-0.5...
Warning: /tmp/pkgConf-tf-random-019500.5: Unrecognized field data-dir on line
33
/tmp/pkgConf-tf-random-019500.5: Unrecognized field key on line 4
Installed tf-random-0.5
Configuring QuickCheck-2.7.6...
Building QuickCheck-2.7.6...
Warning: /tmp/pkgConf-QuickCheck-2.719500.6: Unrecognized field data-dir on
line 37
/tmp/pkgConf-QuickCheck-2.719500.6: Unrecognized field key on line 4
Installed QuickCheck-2.7.6
Configuring alex-3.1.4...
Building alex-3.1.4...
Installed alex-3.1.4
  1. Remove populated ~/.ghc:
$ rm -rf ~/.ghc
  1. Use cabal-install 1.20.0.3 to install the same package in another sandbox. Note lack of warnings:
$ mkdir ~/alex-b && cd ~/alex-b && cabal sandbox init && cabal install alex-3.1.4
Writing a default package environment file to
/root/alex-b/cabal.sandbox.config
Creating a new sandbox at /root/alex-b/.cabal-sandbox
Resolving dependencies...
Notice: installing into a sandbox located at /root/alex-b/.cabal-sandbox
Configuring primitive-0.5.4.0...
Configuring random-1.1...
Building random-1.1...
Building primitive-0.5.4.0...
Installed primitive-0.5.4.0
Installed random-1.1
Configuring tf-random-0.5...
Building tf-random-0.5...
Installed tf-random-0.5
Configuring QuickCheck-2.7.6...
Building QuickCheck-2.7.6...
Installed QuickCheck-2.7.6
Configuring alex-3.1.4...
Building alex-3.1.4...
Installed alex-3.1.4

Judging by the warnings in step 5, which seem to be due to changes introduced in Cabal 1.22.0.0, the version of the Cabal library installed in the GHC user package DB somehow appears to be leaking into the sandbox. This is bad, as sandboxes are expected to isolate the user from the contents of the GHC user package DB (#1621 (comment)).

cc @23Skidoo @tibbe

@mietek

This comment has been minimized.

Show comment
Hide comment
@mietek

mietek Feb 2, 2015

Contributor

Halcyon includes a workaround for this issue.

Contributor

mietek commented Feb 2, 2015

Halcyon includes a workaround for this issue.

@mietek mietek referenced this issue Feb 19, 2015

Open

Increase isolation #46

3 of 4 tasks complete

@ttuegel ttuegel added this to the cabal-install-1.24 milestone Apr 24, 2015

@23Skidoo 23Skidoo modified the milestones: cabal-install 1.24, cabal-install 1.26 Feb 21, 2016

@ezyang ezyang modified the milestone: cabal-install 2.0 Sep 6, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment