daemon: Allow ADDR_NO_RANDOMIZE to be omitted if `--allow-aslr'.

Docker's default seccomp filter prevents use of the ADDR_NO_RANDOMIZE flag
with the personality system call.  It causes personality to return EPERM.  In
general, we assume that any result other than the only documented one, EINVAL,
is caused by seccomp.  If we detect that ADDR_NO_RANDOMIZE is blocked, and the
--allow-aslr option was passed, we simply don't use it.

This allows guix-daemon to continue to work even in these containers, without
any implicit weakening of reproducibility.

Since it is presumably desirable to be able to build guix itself in such an
environment, also pass --allow-aslr to guix-daemon in test-env.

* nix/libstore/globals.hh (Settings::allowASLR): new field.
* nix/nix-daemon/guix-daemon.cc (options): add --allow-aslr option.
  (parse_opt): use it to set Settings::allowASLR.
* nix/libstore/build.cc (DerivationGoal::startBuilder): detect when
  ADDR_NO_RANDOMIZE is blocked and --allow-aslr is passed and don't use it in
  that case.
* doc/guix.texi: document --allow-aslr in "Invoking guix-daemon".
* build-aux/test-env.in: always pass --allow-aslr.

Fixes: guix/guix#3917
Change-Id: I51c5899a9559e161f9e107c2e6a36df395ab3134
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Modified-by: Ludovic Courtès <ludo@gnu.org>
Merges: #4616

4 files changed, 40 insertions, 2 deletions

diff --git a/nix/libstore/build.cc b/nix/libstore/build.cc
index 7dd630cc5d8..e72a0165987 100644
--- a/nix/libstore/build.cc
+++ b/nix/libstore/build.cc
@@ -2526,8 +2526,29 @@ void DerivationGoal::startBuilder()
         ctx.persona |= 0x0020000; /* == UNAME26 */
     }
 
-    /* Disable address space randomization for improved determinism. */
-    ctx.persona |= ADDR_NO_RANDOMIZE;
+    /* Check whether we can set ADDR_NO_RANDOMIZE, some container seccomp
+       policies block it. */
+    int currentPersonality = personality(0xffffffff);
+    if (currentPersonality == -1)
+      throw SysError("unable to get current personality");
+
+    if (personality(currentPersonality | ADDR_NO_RANDOMIZE) == -1) {
+        if (errno == EINVAL)
+            throw SysError("unexpectedly unable to add ADDR_NO_RANDOMIZE to personality");
+
+        /* Some other, unexpected errno; seccomp is probably behind it. */
+        if (!settings.allowASLR)
+            throw SysError("ADDR_NO_RANDOMIZE appears blocked and `--allow-aslr' was not passed, refusing to weaken reproducibility by default");
+
+        printMsg(lvlInfo, "the ADDR_NO_RANDOMIZE personality flag appears to be blocked, not using it");
+    }
+    else {
+        /* It worked, now first restore the original personality. */
+        if (personality(currentPersonality) == -1)
+            throw SysError("unable to restore personality after testing for availability of ADDR_NO_RANDOMIZE");
+        /* Disable address space randomization for improved determinism. */
+        ctx.persona |= ADDR_NO_RANDOMIZE;
+    }
 
 #endif
 
diff --git a/nix/libstore/globals.cc b/nix/libstore/globals.cc
index eb7e7dac413..aa808186bd0 100644
--- a/nix/libstore/globals.cc
+++ b/nix/libstore/globals.cc
@@ -53,6 +53,7 @@ Settings::Settings()
     showTrace = false;
     useHostLoopback = true;
     slirp4netns = SLIRP4NETNS;
+    allowASLR = false;
 }
 
 
diff --git a/nix/libstore/globals.hh b/nix/libstore/globals.hh
index 8ce8aa665a8..f6b856091fc 100644
--- a/nix/libstore/globals.hh
+++ b/nix/libstore/globals.hh
@@ -213,6 +213,10 @@ struct Settings {
     /* The filename to use for executing slirp4netns when it is needed. */
     Path slirp4netns;
 
+    /* Whether to proceed without the ADDR_NO_RANDOMIZE personality flag if
+     * its use is blocked. */
+    bool allowASLR;
+
 private:
     SettingsMap settings;
 
diff --git a/nix/nix-daemon/guix-daemon.cc b/nix/nix-daemon/guix-daemon.cc
index 58a6f3eba45..edbec81c43c 100644
--- a/nix/nix-daemon/guix-daemon.cc
+++ b/nix/nix-daemon/guix-daemon.cc
@@ -85,6 +85,7 @@ builds derivations on behalf of its clients.");
 #define GUIX_OPT_LOG_COMPRESSION 20
 #define GUIX_OPT_DISCOVER 21
 #define GUIX_OPT_ISOLATE_HOST_LOOPBACK 22
+#define GUIX_OPT_ALLOW_ASLR 23
 
 static const struct argp_option options[] =
   {
@@ -157,6 +158,14 @@ to live outputs") },
       n_("produce debugging output") },
     { "isolate-host-loopback", GUIX_OPT_ISOLATE_HOST_LOOPBACK, 0, 0,
       n_("do not allow fixed-output chroot builds to access the host loopback") },
+    { "allow-aslr", GUIX_OPT_ALLOW_ASLR, 0,
+#ifdef HAVE_SYS_PERSONALITY_H
+      0,
+#else
+      OPTION_HIDDEN,
+#endif
+      n_("allow builds to start even if address space layout \
+randomization (ASLR) cannot be disabled")},
     { 0, 0, 0, 0, 0 }
   };
 
@@ -292,6 +301,9 @@ parse_opt (int key, char *arg, struct argp_state *state)
     case GUIX_OPT_ISOLATE_HOST_LOOPBACK:
       settings.useHostLoopback = false;
       break;
+    case GUIX_OPT_ALLOW_ASLR:
+      settings.allowASLR = true;
+      break;
     default:
       return (error_t) ARGP_ERR_UNKNOWN;
     }