{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/17501","repository_url":"https://api.github.com/repos/NixOS/nixpkgs","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/17501/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/17501/comments","events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/17501/events","html_url":"https://github.com/NixOS/nixpkgs/issues/17501","id":169301652,"number":17501,"title":"Building util-linux-2.28 on a grsecurity kernel fails at chmod","user":{"login":"mrobbetts","id":1067896,"avatar_url":"https://avatars.githubusercontent.com/u/1067896?v=3","gravatar_id":"","url":"https://api.github.com/users/mrobbetts","html_url":"https://github.com/mrobbetts","followers_url":"https://api.github.com/users/mrobbetts/followers","following_url":"https://api.github.com/users/mrobbetts/following{/other_user}","gists_url":"https://api.github.com/users/mrobbetts/gists{/gist_id}","starred_url":"https://api.github.com/users/mrobbetts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mrobbetts/subscriptions","organizations_url":"https://api.github.com/users/mrobbetts/orgs","repos_url":"https://api.github.com/users/mrobbetts/repos","events_url":"https://api.github.com/users/mrobbetts/events{/privacy}","received_events_url":"https://api.github.com/users/mrobbetts/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/6.topic:%20grsecurity","name":"6.topic: grsecurity","color":"fef2c0"}],"state":"open","locked":false,"assignee":{"login":"joachifm","id":41977,"avatar_url":"https://avatars.githubusercontent.com/u/41977?v=3","gravatar_id":"","url":"https://api.github.com/users/joachifm","html_url":"https://github.com/joachifm","followers_url":"https://api.github.com/users/joachifm/followers","following_url":"https://api.github.com/users/joachifm/following{/other_user}","gists_url":"https://api.github.com/users/joachifm/gists{/gist_id}","starred_url":"https://api.github.com/users/joachifm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joachifm/subscriptions","organizations_url":"https://api.github.com/users/joachifm/orgs","repos_url":"https://api.github.com/users/joachifm/repos","events_url":"https://api.github.com/users/joachifm/events{/privacy}","received_events_url":"https://api.github.com/users/joachifm/received_events","type":"User","site_admin":false},"assignees":[{"login":"joachifm","id":41977,"avatar_url":"https://avatars.githubusercontent.com/u/41977?v=3","gravatar_id":"","url":"https://api.github.com/users/joachifm","html_url":"https://github.com/joachifm","followers_url":"https://api.github.com/users/joachifm/followers","following_url":"https://api.github.com/users/joachifm/following{/other_user}","gists_url":"https://api.github.com/users/joachifm/gists{/gist_id}","starred_url":"https://api.github.com/users/joachifm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joachifm/subscriptions","organizations_url":"https://api.github.com/users/joachifm/orgs","repos_url":"https://api.github.com/users/joachifm/repos","events_url":"https://api.github.com/users/joachifm/events{/privacy}","received_events_url":"https://api.github.com/users/joachifm/received_events","type":"User","site_admin":false}],"milestone":null,"comments":8,"created_at":"2016-08-04T06:38:09Z","updated_at":"2016-08-15T05:27:18Z","closed_at":null,"body":"## Issue description\r\nIn updating my system to latest master commit of nixpkgs, it needs to rebuild util-linux. The build reliably fails for this package with:\r\n\r\n```\r\nchmod 4755 /nix/store/5h4p154sq6b39cccxk52g0kbnq62zgjf-util-linux-2.28-bin/bin/mount\r\nchmod: changing permissions of '/nix/store/5h4p154sq6b39cccxk52g0kbnq62zgjf-util-linux-2.28-bin/bin/mount': Permission denied\r\nmake[4]: *** [Makefile:11838: install-exec-hook-mount] Error 1\r\nmake[4]: Leaving directory '/tmp/nix-build-util-linux-2.28.drv-0/util-linux-2.28'\r\nmake[3]: *** [Makefile:11621: install-exec-am] Error 2\r\nmake[3]: Leaving directory '/tmp/nix-build-util-linux-2.28.drv-0/util-linux-2.28'\r\nmake[2]: *** [Makefile:11510: install-am] Error 2\r\nmake[2]: Leaving directory '/tmp/nix-build-util-linux-2.28.drv-0/util-linux-2.28'\r\nmake[1]: *** [Makefile:11202: install-recursive] Error 1\r\nmake[1]: Leaving directory '/tmp/nix-build-util-linux-2.28.drv-0/util-linux-2.28'\r\nmake: *** [Makefile:11504: install] Error 2\r\nbuilder for ‘/nix/store/4mz88a452sqhpvr4l1027f1x335rr7gd-util-linux-2.28.drv’ failed with exit code 2\r\n```\r\n\r\nI am running `grsecurity` on this system; at the time of the failure, my `dmesg -T` shows:\r\n```\r\n...\r\n[Wed Aug  3 23:31:14 2016] grsec: denied chmod +s of /nix/store/2z8glfy8gm2798jvf82difl5d4p2nfmp-openssh-7.2p2/libexec/ssh-keysign by /nix/store/07axizqswlwc819xcd8dk2m1q0ylddmh-coreutils-8.25/bin/coreutils[/nix/store/07ax:16147] uid/euid:30002/30002 gid/egid:30000/30000, parent /nix/store/5ypfn4kd8518d0qs094zk3bq8ma0gyzj-gnumake-4.2.1/bin/make[make:16101] uid/euid:30002/30002 gid/egid:30000/30000\r\n[Wed Aug  3 23:31:21 2016] grsec: denied chmod +s of /nix/store/5h4p154sq6b39cccxk52g0kbnq62zgjf-util-linux-2.28-bin/bin/mount by /nix/store/07axizqswlwc819xcd8dk2m1q0ylddmh-coreutils-8.25/bin/coreutils[chmod:19105] uid/euid:30003/30003 gid/egid:30000/30000, parent /nix/store/5ypfn4kd8518d0qs094zk3bq8ma0gyzj-gnumake-4.2.1/bin/make[make:19091] uid/euid:30003/30003 gid/egid:30000/30000\r\n```\r\n\r\nSo I guess there's something fishy going on between this package and `grsecurity`. Any ideas where the problem might be?\r\n\r\n\r\n## Technical details\r\n\r\n* System: (NixOS: `nixos-version`, Ubuntu/Fedora: `lsb_release -a`, ...)\r\n`16.09.git.99f63b4 (Flounder)`\r\n\r\n* Nix version: (run `nix-env --version`)\r\n`nix-env (Nix) 1.11.2`\r\n\r\n* Nixpkgs version: (run `nix-instantiate --eval '<nixpkgs>' -A lib.nixpkgsVersion`)\r\n`\"16.09.git.99f63b4\"`"},"comment":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/comments/239731767","html_url":"https://github.com/NixOS/nixpkgs/issues/17501#issuecomment-239731767","issue_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/17501","id":239731767,"user":{"login":"joachifm","id":41977,"avatar_url":"https://avatars.githubusercontent.com/u/41977?v=3","gravatar_id":"","url":"https://api.github.com/users/joachifm","html_url":"https://github.com/joachifm","followers_url":"https://api.github.com/users/joachifm/followers","following_url":"https://api.github.com/users/joachifm/following{/other_user}","gists_url":"https://api.github.com/users/joachifm/gists{/gist_id}","starred_url":"https://api.github.com/users/joachifm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joachifm/subscriptions","organizations_url":"https://api.github.com/users/joachifm/orgs","repos_url":"https://api.github.com/users/joachifm/repos","events_url":"https://api.github.com/users/joachifm/events{/privacy}","received_events_url":"https://api.github.com/users/joachifm/received_events","type":"User","site_admin":false},"created_at":"2016-08-15T05:27:18Z","updated_at":"2016-08-15T05:27:18Z","body":"I think this has to be addressed on the host OS side of things. As a short-term solution, I'll push a patch that conditionally permits `chmod +s` if the user has configured Nix to do sandboxed builds. Non-NixOS users will have to do so manually. Setting sysctls from within the build environment is not viable.\r\n\r\nDisabling chroot restrictions makes it easier for privileged processes to break out of a chroot jail, so it's kind of terrible to do so just to support an action that occurs every once in a while (or only very rarely for users primarily relying on binary substitutes), but for now that is the easiest way to go. That said, it's not like you're auto-owned by relaxing the chroot restrictions (you might be if you tend to run network facing daemons as root that rely on chroot for security, though).\r\n\r\nIdeally, we'd rely on RBAC to selectively grant permissions as and when needed. A close second would be to disable the restrictions before the build and re-enable them afterwards, but it's not clear to me how to make that user-friendly, suggestions are welcome."}}
{"actor":{"display_login":"joachifm"}}