3 files changed, 28 insertions, 2 deletions

diff --git a/nix/libstore/build.cc b/nix/libstore/build.cc
index 7dd630cc5d8..e72a0165987 100644
--- a/nix/libstore/build.cc
+++ b/nix/libstore/build.cc
@@ -2526,8 +2526,29 @@ void DerivationGoal::startBuilder()
         ctx.persona |= 0x0020000; /* == UNAME26 */
     }
 
-    /* Disable address space randomization for improved determinism. */
-    ctx.persona |= ADDR_NO_RANDOMIZE;
+    /* Check whether we can set ADDR_NO_RANDOMIZE, some container seccomp
+       policies block it. */
+    int currentPersonality = personality(0xffffffff);
+    if (currentPersonality == -1)
+      throw SysError("unable to get current personality");
+
+    if (personality(currentPersonality | ADDR_NO_RANDOMIZE) == -1) {
+        if (errno == EINVAL)
+            throw SysError("unexpectedly unable to add ADDR_NO_RANDOMIZE to personality");
+
+        /* Some other, unexpected errno; seccomp is probably behind it. */
+        if (!settings.allowASLR)
+            throw SysError("ADDR_NO_RANDOMIZE appears blocked and `--allow-aslr' was not passed, refusing to weaken reproducibility by default");
+
+        printMsg(lvlInfo, "the ADDR_NO_RANDOMIZE personality flag appears to be blocked, not using it");
+    }
+    else {
+        /* It worked, now first restore the original personality. */
+        if (personality(currentPersonality) == -1)
+            throw SysError("unable to restore personality after testing for availability of ADDR_NO_RANDOMIZE");
+        /* Disable address space randomization for improved determinism. */
+        ctx.persona |= ADDR_NO_RANDOMIZE;
+    }
 
 #endif
 
diff --git a/nix/libstore/globals.cc b/nix/libstore/globals.cc
index eb7e7dac413..aa808186bd0 100644
--- a/nix/libstore/globals.cc
+++ b/nix/libstore/globals.cc
@@ -53,6 +53,7 @@ Settings::Settings()
     showTrace = false;
     useHostLoopback = true;
     slirp4netns = SLIRP4NETNS;
+    allowASLR = false;
 }
 
 
diff --git a/nix/libstore/globals.hh b/nix/libstore/globals.hh
index 8ce8aa665a8..f6b856091fc 100644
--- a/nix/libstore/globals.hh
+++ b/nix/libstore/globals.hh
@@ -213,6 +213,10 @@ struct Settings {
     /* The filename to use for executing slirp4netns when it is needed. */
     Path slirp4netns;
 
+    /* Whether to proceed without the ADDR_NO_RANDOMIZE personality flag if
+     * its use is blocked. */
+    bool allowASLR;
+
 private:
     SettingsMap settings;