Sandboxes: Make /tmp writeable to restore POSIX compliancy

kit-ty-kate · Aug 15, 2023 · 4972017 · 4972017
1 parent 8cc4a37
commit 4972017
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/src/state/shellscripts/bwrap.sh b/src/state/shellscripts/bwrap.sh
@@ -19,6 +19,7 @@ fi
 ARGS=(--unshare-net --new-session --die-with-parent)
 ARGS=("${ARGS[@]}" --proc /proc --dev /dev)
 ARGS=("${ARGS[@]}" --setenv TMPDIR /opam-tmp --setenv TMP /opam-tmp --setenv TEMPDIR /opam-tmp --setenv TEMP /opam-tmp)
+ARGS=("${ARGS[@]}" --bind /tmp /tmp)
 ARGS=("${ARGS[@]}" --tmpfs /opam-tmp)
 ARGS=("${ARGS[@]}" --tmpfs /run)
 # NOTE: When adding a new mount-point please sync with the loop below to avoid overriding the mount point
@@ -62,7 +63,7 @@ add_sys_mounts() {
 # See https://github.com/containers/bubblewrap/issues/413
 for dir in /*; do
     case "$dir" in
-    "/proc" | "/dev" | "/run" | "/opam-tmp") ;;
+    "/proc" | "/dev" | "/run" | "/tmp" | "/opam-tmp") ;;
     "/sys") ;; # Disabled without a corresponding bind, due to security concerns
     *) add_sys_mounts "$dir";;
     esac

diff --git a/src/state/shellscripts/sandbox_exec.sh b/src/state/shellscripts/sandbox_exec.sh
@@ -7,6 +7,7 @@ set -ue
 POL='(version 1)(allow default)(deny network*)(deny file-write*)'
 POL="$POL"'(allow network* (remote unix))'
 POL="$POL"'(allow file-write* (literal "/dev/null") (literal "/dev/dtracehelper"))'
+POL="$POL"'(allow file-write* (regex #"^(/private)?(/var)?/tmp/"))'
 
 add_mounts() {
     if [ -d "$2" ]; then