colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

bunpen: peek through *all* symlinks, not just intermediary ones

Browse Source 
`mount` doesnt seem to mount over symlinks, hence why we have to follow even terminal symlinks
This commit is contained in:
Colin
2024-09-02 21:47:51 +00:00
parent 5e84056715
commit 0ee51d1812
1 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
pkgs/additional/bunpen/restrict/namespace.ha
View File

@@ -131,7 +131,6 @@ fn isolate_paths(paths: []path::buffer) void = {
"proc", "new/proc", "proc", rt::ext::mount_flag::NOSUID | rt::ext::mount_flag::NOEXEC | rt::ext::mount_flag::NODEV, null
));
// provide a new `/tmp` too.
errors::ext::swallow("[namespace] mkdir new/tmp", rt::mkdir("new/tmp", 0o777));
errors::ext::swallow("[namespace] mount -t tmpfs tmpfs new/tmp", rt::ext::mount("tmpfs", "new/tmp", "tmpfs", 0, null));
@@ -228,18 +227,19 @@ fn bind_component(old_fs: *fs::fs, new_fs: *fs::fs, strpath: str, remaining: str
let linktext = fs::readlink(old_fs, strpath)?;
log::printfln("[namespace/bind] ln new/{} -> {}", strpath, linktext);
fs::symlink(new_fs, linktext, strpath)?;
if (remaining != "") {
// bind the real path (or, the "more real" path, in case there are
// multiple layers of symlink).
let target_path: path::buffer = if (path::abs(linktext)) {
// foo/bar/baz/fnord with bar -> /target => `/target/baz/fnord`
yield path::init(linktext, remaining)?;
} else {
// foo/bar/baz/fnord with foo -> target => `foo/target/bar/baz`
yield path::init(strpath, "..", linktext, remaining)?;
};
return bind_leaf(old_fs, new_fs, &target_path);
// bind the real path (or, the "more real" path, in case there are
// multiple layers of symlink).
let target_path: path::buffer = if (path::abs(linktext)) {
// foo/bar/baz/fnord with (bar -> /target) => `/target/baz/fnord`
// foo/bar/baz/fnord with (fnord -> /target, remaining="") => `/target`
yield path::init(linktext, remaining)?;
} else {
// foo/bar/baz/fnord with (foo -> target) => `foo/target/bar/baz`
// foo/bar/baz/fnord with (fnord -> target, remaining="") => `foo/bar/baz/target`
yield path::init(strpath, "..", linktext, remaining)?;
};
return bind_leaf(old_fs, new_fs, &target_path);
} else if (fs::isdir(st.mode)) {
log::printfln("[namespace/bind] mkdir new/{}", strpath);
fs::mkdir(new_fs, strpath, st.mode)?;