Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

'install' breaks sandbox isolation #2400

Closed
mietek opened this issue Jan 31, 2015 · 2 comments
Closed

'install' breaks sandbox isolation #2400

mietek opened this issue Jan 31, 2015 · 2 comments

Comments

@mietek
Copy link
Contributor

mietek commented Jan 31, 2015

It seems to me that when performing cabal install in a sandbox, cabal-install can break the intended sandbox isolation by using the Cabal library installed in the GHC user package DB, as opposed to its internal Cabal library.

  1. Install GHC 7.8.4 and cabal-install 1.20.0.3. Ensure ~/.ghc is empty:
$ rm -rf ~/.ghc
$ ghc-pkg list
/app/ghc/lib/ghc-7.8.4/package.conf.d
   Cabal-1.18.1.5
   array-0.5.0.0
   base-4.7.0.2
   bin-package-db-0.0.0.0
   binary-0.7.1.0
   bytestring-0.10.4.0
   containers-0.5.5.1
   deepseq-1.3.0.2
   directory-1.2.1.0
   filepath-1.3.0.2
   ghc-7.8.4
   ghc-prim-0.3.1.0
   haskeline-0.7.1.2
   haskell2010-1.1.2.0
   haskell98-2.0.0.3
   hoopl-3.10.0.1
   hpc-0.6.0.1
   integer-gmp-0.5.1.0
   old-locale-1.0.0.6
   old-time-1.1.0.2
   pretty-1.1.1.1
   process-1.2.0.0
   rts-1.0
   template-haskell-2.9.0.0
   terminfo-0.4.0.0
   time-1.4.2
   transformers-0.3.0.0
   unix-2.7.0.1
   xhtml-3000.2.1
  1. Ensure cabal is really 1.20.0.3:
$ cabal --version
cabal-install version 1.20.0.3
using version 1.20.0.0 of the Cabal library
  1. Without replacing cabal-install 1.20.0.3, install cabal-install 1.22.0.0. Ensure ~/.ghc is populated:
$ cabal --no-require-sandbox install cabal-install
$ ghc-pkg list
/app/ghc/lib/ghc-7.8.4/package.conf.d
   Cabal-1.18.1.5
   array-0.5.0.0
   base-4.7.0.2
   bin-package-db-0.0.0.0
   binary-0.7.1.0
   bytestring-0.10.4.0
   containers-0.5.5.1
   deepseq-1.3.0.2
   directory-1.2.1.0
   filepath-1.3.0.2
   ghc-7.8.4
   ghc-prim-0.3.1.0
   haskeline-0.7.1.2
   haskell2010-1.1.2.0
   haskell98-2.0.0.3
   hoopl-3.10.0.1
   hpc-0.6.0.1
   integer-gmp-0.5.1.0
   old-locale-1.0.0.6
   old-time-1.1.0.2
   pretty-1.1.1.1
   process-1.2.0.0
   rts-1.0
   template-haskell-2.9.0.0
   terminfo-0.4.0.0
   time-1.4.2
   transformers-0.3.0.0
   unix-2.7.0.1
   xhtml-3000.2.1
/root/.ghc/x86_64-linux-7.8.4/package.conf.d
   Cabal-1.22.0.0
   HTTP-4000.2.19
   mtl-2.2.1
   network-2.6.0.2
   network-uri-2.6.0.1
   parsec-3.1.8
   random-1.1
   stm-2.4.4
   text-1.2.0.4
   transformers-0.4.2.0
   zlib-0.5.4.2
  1. Note cabal is still seemingly using its internal Cabal library:
$ cabal --version
cabal-install version 1.20.0.3
using version 1.20.0.0 of the Cabal library
  1. Use cabal-install 1.20.0.3 to install some package in a sandbox. Note warnings:
$ mkdir ~/alex-a && cd ~/alex-a && cabal sandbox init && cabal install alex-3.1.4
Writing a default package environment file to
/root/alex-a/cabal.sandbox.config
Creating a new sandbox at /root/alex-a/.cabal-sandbox
Resolving dependencies...
Notice: installing into a sandbox located at /root/alex-a/.cabal-sandbox
Configuring primitive-0.5.4.0...
Configuring random-1.1...
Building primitive-0.5.4.0...
Building random-1.1...
Warning: /tmp/pkgConf-primitive-0.5.419500.0: Unrecognized field data-dir on
line 24
/tmp/pkgConf-primitive-0.5.419500.0: Unrecognized field key on line 4
Installed primitive-0.5.4.0
Warning: /tmp/pkgConf-random-119500.1: Unrecognized field data-dir on line 19
/tmp/pkgConf-random-119500.1: Unrecognized field key on line 4
Installed random-1.1
Configuring tf-random-0.5...
Building tf-random-0.5...
Warning: /tmp/pkgConf-tf-random-019500.5: Unrecognized field data-dir on line
33
/tmp/pkgConf-tf-random-019500.5: Unrecognized field key on line 4
Installed tf-random-0.5
Configuring QuickCheck-2.7.6...
Building QuickCheck-2.7.6...
Warning: /tmp/pkgConf-QuickCheck-2.719500.6: Unrecognized field data-dir on
line 37
/tmp/pkgConf-QuickCheck-2.719500.6: Unrecognized field key on line 4
Installed QuickCheck-2.7.6
Configuring alex-3.1.4...
Building alex-3.1.4...
Installed alex-3.1.4
  1. Remove populated ~/.ghc:
$ rm -rf ~/.ghc
  1. Use cabal-install 1.20.0.3 to install the same package in another sandbox. Note lack of warnings:
$ mkdir ~/alex-b && cd ~/alex-b && cabal sandbox init && cabal install alex-3.1.4
Writing a default package environment file to
/root/alex-b/cabal.sandbox.config
Creating a new sandbox at /root/alex-b/.cabal-sandbox
Resolving dependencies...
Notice: installing into a sandbox located at /root/alex-b/.cabal-sandbox
Configuring primitive-0.5.4.0...
Configuring random-1.1...
Building random-1.1...
Building primitive-0.5.4.0...
Installed primitive-0.5.4.0
Installed random-1.1
Configuring tf-random-0.5...
Building tf-random-0.5...
Installed tf-random-0.5
Configuring QuickCheck-2.7.6...
Building QuickCheck-2.7.6...
Installed QuickCheck-2.7.6
Configuring alex-3.1.4...
Building alex-3.1.4...
Installed alex-3.1.4

Judging by the warnings in step 5, which seem to be due to changes introduced in Cabal 1.22.0.0, the version of the Cabal library installed in the GHC user package DB somehow appears to be leaking into the sandbox. This is bad, as sandboxes are expected to isolate the user from the contents of the GHC user package DB (#1621 (comment)).

cc @23Skidoo @tibbe

@mietek
Copy link
Contributor Author

mietek commented Feb 2, 2015

Halcyon includes a workaround for this issue.

@mietek
Copy link
Contributor Author

mietek commented Jun 7, 2019

Closing as obsolete.

@mietek mietek closed this as completed Jun 7, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

5 participants