From 5cefb13ddd4d51a63a387e74c138035b7b8b8537 Mon Sep 17 00:00:00 2001 From: Roel Janssen Date: Thu, 19 Apr 2018 17:11:30 +0200 Subject: [PATCH] guix-daemon: Disable garbage collection for remote connections. * nix/nix-daemon/nix-daemon.cc (isRemoteConnection): New variable. (performOp): For wopCollectGarbage, throw an error when isRemoteConnection is set. (acceptConnection): Set isRemoteConnection when connection is not AF_UNIX. * tests/guix-daemon.sh: Add a test for the new behavior. --- nix/nix-daemon/nix-daemon.cc | 10 +++++++++- tests/guix-daemon.sh | 14 ++++++++++++++ 2 files changed, 23 insertions(+), 1 deletion(-) diff --git a/nix/nix-daemon/nix-daemon.cc b/nix/nix-daemon/nix-daemon.cc index deb7003d7e..782e4acfc5 100644 --- a/nix/nix-daemon/nix-daemon.cc +++ b/nix/nix-daemon/nix-daemon.cc @@ -54,7 +54,9 @@ static FdSink to(STDOUT_FILENO); bool canSendStderr; - +/* This variable is used to keep track of whether a connection + comes from a host other than the host running guix-daemon. */ +static bool isRemoteConnection; /* This function is called anytime we want to write something to stderr. If we're in a state where the protocol allows it (i.e., @@ -529,6 +531,11 @@ static void performOp(bool trusted, unsigned int clientVersion, } case wopCollectGarbage: { + if (isRemoteConnection) { + throw Error("Garbage collection is disabled for remote hosts."); + break; + } + GCOptions options; options.action = (GCOptions::GCAction) readInt(from); options.pathsToDelete = readStorePaths(from); @@ -934,6 +941,7 @@ static void acceptConnection(int fdSocket) connection. Setting these to -1 means: do not change. */ settings.clientUid = clientUid; settings.clientGid = clientGid; + isRemoteConnection = (remoteAddr.ss_family != AF_UNIX); /* Handle the connection. */ from.fd = remote; diff --git a/tests/guix-daemon.sh b/tests/guix-daemon.sh index 6f91eb58bf..9ae6e0b77a 100644 --- a/tests/guix-daemon.sh +++ b/tests/guix-daemon.sh @@ -194,6 +194,20 @@ do kill "$daemon_pid" done +# Make sure garbage collection from a TCP connection does not work. + +tcp_socket="127.0.0.1:9999" +guix-daemon --listen="$tcp_socket" & +daemon_pid=$! + +GUIX_DAEMON_SOCKET="guix://$tcp_socket" +export GUIX_DAEMON_SOCKET + +if guix gc; then false; else true; fi + +unset GUIX_DAEMON_SOCKET +kill "$daemon_pid" + # Log compression. guix-daemon --listen="$socket" --disable-chroot --debug --log-compression=gzip &