Status Update
No update yet.
Comments
ma...@google.com
Portage is suppose to ignore these collisions:
COLLISION_IGNORE="*.py[co] *$py.class */dropin.cache /usr/lib/debug/.build-id"
Will move to build team.
bl...@google.com
va...@google.com
it's not because of the collision detection. sandbox things the target (which is outside of the build tree) is being written to, so it rejects it. guessing we have a TOCTOU race here ...
$ sandbox
$ cat doit.sh
#!/bin/bash
while [[ ! -e $SANDBOX_LOG ]] ; do
strace -o log.1 ln -s /bin/bash ./f &
strace -o log.2 ln -s /bin/bash ./f &
rm -f f
wait
done
$ ./doit.sh
...
* ACCESS DENIED: symlinkat: ./f
...
va...@google.com
it seems like this bug has been here forever. i stopped history searching when i hit 2005.
it does indeed look like a TOCTOU. the situation of multiple processes trying to create the same symlink pretty much never happens.
should be easy to fix.
va...@google.com
as for why this is showing up now, we've been on sandbox-2.11 from 2016. it had a bug where it didn't check symlinkat properly. i fixed it in sandbox-2.12+. i just recently upgraded us to the latest sandbox release which includes the symlinkat check, and the portage splitdebug install step uses that.
the bug exists for many functions, it just required a specific behavior to be triggered, and that behavior has only showed up so far in code that used symlinkat.
at any rate, fixed upstream:
ap...@google.com
Branch: main
commit a9031d7d0c5da213ff769c78f8dce2c47cd54c5c
Author: Mike Frysinger <vapier@chromium.org>
Date: Wed Oct 27 23:46:42 2021
sandbox: backport upstream fix for symlink toctou race
BUG=b:204375293
TEST=CQ passes
Change-Id: Ie8e47fd0dcd23aaeba7beaba8651dfa891cb9797
Reviewed-on:
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: Manoj Gupta <manojgupta@chromium.org>
Commit-Queue: Mike Frysinger <vapier@chromium.org>
A sys-apps/sandbox/files/sandbox-2.27-symlink-toctou.patch
M sys-apps/sandbox/sandbox-2.27-r1.ebuild
Description
CQ is failing forhttps://chromium-review.googlesource.com/c/chromiumos/overlays/chromiumos-overlay/+/3220220 due to portage having a permission denied error.
Example log:https://logs.chromium.org/logs/chromeos/buildbucket/cr-buildbucket/8832181829708125505/+/u/update_sdk/call_chromite.api.SdkService_Update/call_build_API_script/stdout