From 4fe5ac83287678a5f870def74ed28f45ab22815f Mon Sep 17 00:00:00 2001 From: Ariadne Conill Date: Thu, 18 Mar 2021 23:15:01 -0600 Subject: database: do not chroot(".") unless actually necessary If we use default root (/), then we do not have to chroot to run scripts. Use APK_NO_CHROOT flag for this scenario to avoid the chroot. This helps with using apk with bwrap and OSTree. Closes #10736. --- src/apk_context.h | 1 + src/context.c | 1 + src/database.c | 14 ++++++++++++-- 3 files changed, 14 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/apk_context.h b/src/apk_context.h index 8f7ca5e..2b4b889 100644 --- a/src/apk_context.h +++ b/src/apk_context.h @@ -25,6 +25,7 @@ #define APK_NO_SCRIPTS BIT(8) #define APK_NO_CACHE BIT(9) #define APK_NO_COMMIT_HOOKS BIT(10) +#define APK_NO_CHROOT BIT(11) #define APK_FORCE_OVERWRITE BIT(0) #define APK_FORCE_OLD_APK BIT(1) diff --git a/src/context.c b/src/context.c index 784f082..a6d7e5d 100644 --- a/src/context.c +++ b/src/context.c @@ -42,6 +42,7 @@ int apk_ctx_prepare(struct apk_ctx *ac) if (!ac->keys_dir) ac->keys_dir = "etc/apk/keys"; if (!ac->root) ac->root = "/"; if (!ac->cache_max_age) ac->cache_max_age = 4*60*60; /* 4 hours default */ + if (!strcmp(ac->root, "/")) ac->flags |= APK_NO_CHROOT; /* skip chroot if root is default */ ac->root_fd = openat(AT_FDCWD, ac->root, O_RDONLY | O_CLOEXEC); if (ac->root_fd < 0 && (ac->open_flags & APK_OPENF_CREATE)) { diff --git a/src/database.c b/src/database.c index 4c32fdc..40efd93 100644 --- a/src/database.c +++ b/src/database.c @@ -1906,8 +1906,18 @@ int apk_db_run_script(struct apk_database *db, char *fn, char **argv) } if (pid == 0) { umask(0022); - if (fchdir(db->root_fd) == 0 && chroot(".") == 0) - execve(fn, argv, environment); + + if (fchdir(db->root_fd) != 0) { + apk_err(out, "%s: fchdir: %s", basename(fn), strerror(errno)); + exit(127); + } + + if (!(db->ctx->flags & APK_NO_CHROOT) && chroot(".") != 0) { + apk_err(out, "%s: chroot: %s", basename(fn), strerror(errno)); + exit(127); + } + + execve(fn, argv, environment); exit(127); /* should not get here */ } waitpid(pid, &status, 0); -- cgit v1.2.3-70-g09d2