daemon: Allow ADDR_NO_RANDOMIZE to be omitted if `--allow-aslr'.

Docker's default seccomp filter prevents use of the ADDR_NO_RANDOMIZE flag
with the personality system call.  It causes personality to return EPERM.  In
general, we assume that any result other than the only documented one, EINVAL,
is caused by seccomp.  If we detect that ADDR_NO_RANDOMIZE is blocked, and the
--allow-aslr option was passed, we simply don't use it.

This allows guix-daemon to continue to work even in these containers, without
any implicit weakening of reproducibility.

Since it is presumably desirable to be able to build guix itself in such an
environment, also pass --allow-aslr to guix-daemon in test-env.

* nix/libstore/globals.hh (Settings::allowASLR): new field.
* nix/nix-daemon/guix-daemon.cc (options): add --allow-aslr option.
  (parse_opt): use it to set Settings::allowASLR.
* nix/libstore/build.cc (DerivationGoal::startBuilder): detect when
  ADDR_NO_RANDOMIZE is blocked and --allow-aslr is passed and don't use it in
  that case.
* doc/guix.texi: document --allow-aslr in "Invoking guix-daemon".
* build-aux/test-env.in: always pass --allow-aslr.

Fixes: guix/guix#3917
Change-Id: I51c5899a9559e161f9e107c2e6a36df395ab3134
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Modified-by: Ludovic Courtès <ludo@gnu.org>
Merges: #4616

1 files changed, 15 insertions, 0 deletions

diff --git a/doc/guix.texi b/doc/guix.texi
index 51bab399b85..bb415f2cc59 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -1781,6 +1781,21 @@ user namespaces is missing (@pxref{Build Environment Setup}).  Use at
 your own risk!
 @end quotation
 
+@cindex ASLR (address space layout randomization), for builds
+@cindex address space layout randomization (ASLR), for builds
+@cindex Docker, running @command{guix-daemon}
+@cindex @command{guix-daemon}, running under Docker
+@item --allow-aslr
+Allow builds to start even if @acronym{ASLR, Address Space Layout
+Randomization} cannot be disabled on Linux systems.  This is normally
+done so as to increase reproducibility, but some environments, such as
+those affected by Docker's default seccomp policy, don't permit
+disabling ASLR.  Passing this option will allow builds to start with
+reduced reproducibility regardless.
+
+Note that passing this option doesn't ensure that ASLR is enabled, it
+only allows builds to start even when disabling it is blocked.
+
 @item --isolate-host-loopback
 Prevent fixed-output chroot builds from accessing the host loopback.
 When this is used, fixed-output builds will have their own loopback