nixpkgs/pkgs/build-support/setup-hooks/audit-tmpdir.sh
zimbatm 551aecfa83
tmpdir audit: only fail with files referenced below (#35068)
On Linux the `$TMPDIR` is `/build`. The TMPDIR audit looks for `$TMPDIR`
in the build output, which will then fail with packages like
/buildkite-agent.

This fixes the heuristic to look for `$TMPDIR/` instead.
2018-11-16 22:35:56 +01:00

42 lines
1.4 KiB
Bash

# Check whether RPATHs or wrapper scripts contain references to
# $TMPDIR. This is a serious security bug because it allows any user
# to inject files into search paths of other users' processes.
#
# It might be better to have Nix scan build output for any occurrence
# of $TMPDIR (which would also be good for reproducibility), but at
# the moment that would produce too many spurious errors (e.g. debug
# info or assertion messages that refer to $TMPDIR).
fixupOutputHooks+=('if [ -z "$noAuditTmpdir" -a -e "$prefix" ]; then auditTmpdir "$prefix"; fi')
auditTmpdir() {
local dir="$1"
[ -e "$dir" ] || return 0
header "checking for references to $TMPDIR/ in $dir..."
local i
while IFS= read -r -d $'\0' i; do
if [[ "$i" =~ .build-id ]]; then continue; fi
if isELF "$i"; then
if patchelf --print-rpath "$i" | grep -q -F "$TMPDIR/"; then
echo "RPATH of binary $i contains a forbidden reference to $TMPDIR/"
exit 1
fi
fi
if isScript "$i"; then
if [ -e "$(dirname "$i")/.$(basename "$i")-wrapped" ]; then
if grep -q -F "$TMPDIR/" "$i"; then
echo "wrapper script $i contains a forbidden reference to $TMPDIR/"
exit 1
fi
fi
fi
done < <(find "$dir" -type f -print0)
stopNest
}