containers/bubblewrap

`--block-fd` does not work

M83tUt3 opened this issue · 1 comments

I'm having issues getting --block-fd to work. It's not actually blocking the sandbox in any way I've tried.
Minimal example:

bwrap --ro-bind / / --block-fd 9999 /usr/bin/sh # fd 9999 does not exist

The expectation is that the sandbox blocks, but it does not.

I do not really know C but I think the issue is in the TEMP_FAILURE_RETRY macro.
It seems to only loop when the given expression (read in this case) exits with EINTR, which seems inappropiate here.

bubblewrap/bubblewrap.c

Lines 47 to 54 in 8e51677

#ifndef TEMP_FAILURE_RETRY
#define TEMP_FAILURE_RETRY(expression) \
(__extension__ \
({ long int __result; \
do __result = (long int) (expression); \
while (__result == -1L && errno == EINTR); \
__result; }))
#endif

bubblewrap/bubblewrap.c

Lines 3261 to 3266 in 8e51677

if (opt_block_fd != -1)
{
char b[1];
(void) TEMP_FAILURE_RETRY (read (opt_block_fd, b, 1));
close (opt_block_fd);
}

nvm fixed it