ryan77627/guix
1
0
Fork 0
mirror of https://git.in.rschanz.org/ryan77627/guix.git synced 2024-12-24 21:38:07 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

installer: final: Introduce call-with-mnt-container.

Browse source 
* gnu/installer/final.scm (call-with-mnt-container): New procedure,
(install-system): use it instead of call-with-container, to make sure that the
container is not jailed.
This commit is contained in:
Mathieu Othacehe 2020-09-09 09:24:49 +02:00
parent b3a83f1ece
commit cafbc5f390
No known key found for this signature in database
GPG key ID: 8354763531769CA6
1 changed files with 16 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
gnu/installer/final.scm
View file

@ -135,6 +135,20 @@ (define %not-nul
(_ #f))))))
pids)))
(define (call-with-mnt-container thunk)
"This is a variant of call-with-container. Run THUNK in a new container
process, within a separate MNT namespace. The container is not jailed so that
it can interact with the rest of the system."
(let ((pid (run-container "/" '() '(mnt) 1 thunk)))
;; Catch SIGINT and kill the container process.
(sigaction SIGINT
(lambda (signum)
(false-if-exception
(kill pid SIGKILL))))
(match (waitpid pid)
((_ . status) status))))
(define* (install-system locale #:key (users '()))
"Create /etc/shadow and /etc/passwd on the installation target for USERS.
Start COW-STORE service on target directory and launch guix install command in
@ -181,7 +195,7 @@ (define (assert-exit x)
;; To avoid this situation, mount the store overlay inside a container,
;; and run the installation from within that container.
(zero?
(call-with-container '()
(call-with-mnt-container
(lambda ()
(dynamic-wind
(lambda ()
@ -218,5 +232,4 @@ (define (assert-exit x)
;; Finally umount the cow-store and exit the container.
(unmount-cow-store (%installer-target-dir) backing-directory)
(assert-exit ret))))
#:namespaces '(mnt)))))
(assert-exit ret))))))))