@@ -23,6 +23,43 @@ import mcpp.xlings;
2323
2424namespace mcpp ::toolchain {
2525
26+ // ── #273 sandbox containment ─────────────────────────────────────────────
27+ // patchelf_walk once escaped its sandbox through a symlinked payload
28+ // directory (an e2e sandbox seeded `registry/data/xpkgs/xim-x-gcc` from the
29+ // user's real ~/.xlings via `ln -s`) and rewrote PT_INTERP/RUNPATH of the
30+ // REAL installation against loader paths inside a soon-deleted mktemp dir.
31+ //
32+ // Containment rule: every rewrite in this module is fenced by ONE explicit
33+ // trust root — the owning sandbox's registry (`cfg.registryDir`), resolved
34+ // once at the entry point via `containment_root` and threaded down as a
35+ // parameter. The root is a first-class fact of the system; it is never
36+ // re-derived from the payload path (canonicalizing the payload first would
37+ // resolve the malicious symlink and collapse the fence into a tautology).
38+ export std::filesystem::path
39+ containment_root (const std::filesystem::path& registryDir) {
40+ std::error_code ec;
41+ auto canon = std::filesystem::weakly_canonical (registryDir, ec);
42+ if (ec) return {}; // empty root → escapes_containment fails closed
43+ return canon;
44+ }
45+
46+ // True when `file`'s physical (symlink-resolved) location falls outside
47+ // `rootCanon`. Fails CLOSED: an empty root or an unresolvable path counts
48+ // as escaping — never patch what cannot be proven contained. Comparison is
49+ // per path component (a `registry-evil` sibling sharing the string prefix
50+ // is outside).
51+ export bool escapes_containment (const std::filesystem::path& file,
52+ const std::filesystem::path& rootCanon) {
53+ if (rootCanon.empty ()) return true ;
54+ std::error_code ec;
55+ auto real = std::filesystem::weakly_canonical (file, ec);
56+ if (ec) return true ;
57+ auto r = rootCanon.generic_string ();
58+ auto f = real.generic_string ();
59+ if (f == r) return false ;
60+ return !(f.size () > r.size () && f.starts_with (r) && f[r.size ()] == ' /'
61+ }
62+
2663// Run patchelf on every dynamic ELF in `dir` (recursively):
2764// - Set PT_INTERP to `loader` (the sandbox-local glibc loader).
2865// - Set RUNPATH to `rpath` (colon-separated list of sandbox lib dirs).
@@ -36,7 +73,8 @@ namespace mcpp::toolchain {
3673export void patchelf_walk (const std::filesystem::path& dir,
3774 const std::filesystem::path& loader,
3875 const std::string& rpath,
39- const std::filesystem::path& patchelfBin)
76+ const std::filesystem::path& patchelfBin,
77+ const std::filesystem::path& fenceRoot)
4078{
4179 if (!std::filesystem::exists (dir) || !std::filesystem::exists (patchelfBin))
4280 return ;
@@ -54,6 +92,14 @@ export void patchelf_walk(const std::filesystem::path& dir,
5492 if (!is || m[0 ] != 0x7f || m[1 ] != ' E' 2 ] != ' L' 3 ] != ' F'
5593 continue ;
5694 is.close ();
95+ // #273 fence: never rewrite files that physically live outside the
96+ // sandbox (payload reached through a symlink → foreign installation).
97+ if (escapes_containment (path, fenceRoot)) {
98+ mcpp::log::verbose (" toolchain" std::format (
99+ " patchelf_walk: skip (outside sandbox, #273 fence): {}"
100+ path.string ()));
101+ continue ;
102+ }
57103 // Probe PT_INTERP — skip static binaries (no interp).
58104 auto probe = std::format (" {} --print-interpreter {} 2>/dev/null"
59105 mcpp::platform::shell::quote (patchelfBin.string ()),
@@ -152,8 +198,16 @@ export std::string detect_baked_loader(const std::string& specsContent) {
152198
153199void fixup_gcc_specs (const std::filesystem::path& gccPkgRoot,
154200 const std::filesystem::path& glibcLibDir,
155- const std::filesystem::path& gccLibDir)
201+ const std::filesystem::path& gccLibDir,
202+ const std::filesystem::path& fenceRoot)
156203{
204+ // #273 fence: a payload reached through a symlink is a foreign
205+ // installation — its specs file must not be rewritten either.
206+ if (escapes_containment (gccPkgRoot, fenceRoot)) {
207+ mcpp::log::verbose (" toolchain"
208+ " fixup_gcc_specs: skip (payload outside sandbox, #273 fence)"
209+ return ;
210+ }
157211 std::filesystem::path specsParent;
158212 std::error_code ec;
159213 for (auto it = std::filesystem::directory_iterator (gccPkgRoot / " lib" " gcc"
@@ -215,7 +269,14 @@ void fixup_gcc_specs(const std::filesystem::path& gccPkgRoot,
215269// C++ only: -nostdinc++ -stdlib=libc++ + payload libc++ headers/libs
216270// On macOS the C library comes from the SDK: --sysroot=<sdk> + libc++ headers.
217271export void fixup_clang_cfg (const std::filesystem::path& payloadRoot,
218- const std::filesystem::path& glibcLibDir) {
272+ const std::filesystem::path& glibcLibDir,
273+ const std::filesystem::path& fenceRoot) {
274+ // #273 fence — same rule as fixup_gcc_specs above.
275+ if (escapes_containment (payloadRoot, fenceRoot)) {
276+ mcpp::log::verbose (" toolchain"
277+ " fixup_clang_cfg: skip (payload outside sandbox, #273 fence)"
278+ return ;
279+ }
219280 auto binDir = payloadRoot / " bin"
220281 if (!std::filesystem::exists (binDir)) return ;
221282
@@ -344,15 +405,20 @@ void gcc_post_install_fixup(const mcpp::config::GlobalConfig& cfg,
344405
345406 mcpp::log::verbose (" toolchain" std::format (
346407 " gcc fixup: patchelf_walk rpath='{}'"
408+ // Single trust root for every walk below — including the binutils
409+ // SIBLING payloads, which the entry-point ownership guard does not
410+ // cover (it only vets the gcc payload itself).
411+ auto fence = containment_root (cfg.registryDir );
347412 auto binutilsRoot = mcpp::xlings::paths::xim_tool_root (xlEnv, " binutils"
348413 if (std::filesystem::exists (binutilsRoot)) {
349414 for (auto & v : std::filesystem::directory_iterator (binutilsRoot))
350- patchelf_walk (v.path (), loader, rpath, patchelfBin);
415+ patchelf_walk (v.path (), loader, rpath, patchelfBin, fence );
351416 }
352- patchelf_walk (payloadRoot, loader, rpath, patchelfBin);
417+ patchelf_walk (payloadRoot, loader, rpath, patchelfBin, fence );
353418
354419 mcpp::log::verbose (" toolchain" " gcc fixup: fixup_gcc_specs"
355- fixup_gcc_specs (payloadRoot, glibcLibDir, gccLibDir);
420+ fixup_gcc_specs (payloadRoot, glibcLibDir, gccLibDir,
421+ containment_root (cfg.registryDir ));
356422 } else {
357423 mcpp::ui::warning (
358424 " could not locate sandbox glibc/gcc/patchelf paths; "
@@ -385,10 +451,11 @@ void llvm_post_install_fixup(const mcpp::config::GlobalConfig& cfg,
385451 rpath += llvmLib.string () + " :" string ();
386452 mcpp::log::verbose (" toolchain" std::format (
387453 " llvm fixup: patchelf_walk lib/ rpath='{}'"
388- patchelf_walk (llvmLib, loader, rpath, patchelfBin);
454+ patchelf_walk (llvmLib, loader, rpath, patchelfBin,
455+ containment_root (cfg.registryDir ));
389456 }
390457 mcpp::log::verbose (" toolchain" " llvm fixup: fixup_clang_cfg"
391- fixup_clang_cfg (payloadRoot, glibcLibDir);
458+ fixup_clang_cfg (payloadRoot, glibcLibDir, containment_root (cfg. registryDir ) );
392459}
393460
394461// ── the single fixup pipeline entry ──────────────────────────────────────
@@ -416,17 +483,17 @@ export void ensure_post_install_fixup(const mcpp::config::GlobalConfig& cfg,
416483 // are not ours to patch — their owner already ran the fixup, and patching
417484 // through the symlink would rewrite the canonical files against OUR
418485 // (possibly ephemeral) paths, bricking the owner's toolchain.
419- {
420- std:: error_code ec;
421- auto canonicalRoot = std::filesystem::weakly_canonical (payloadRoot, ec);
422- auto homeRegistry = std::filesystem::weakly_canonical (cfg. registryDir , ec);
423- if (!ec && !canonicalRoot. string (). starts_with (homeRegistry. string ())) {
424- mcpp::log::verbose ( " toolchain " , std::format (
425- " skip {} fixup: payload '{}' resolves outside this home ('{}') — "
426- " inherited payload, owner is responsible for its fixup " ,
427- kind, payloadRoot. string (), canonicalRoot. string ()));
428- return ;
429- }
486+ // Rewritten on the shared containment predicate (#273): the old inline
487+ // check reused one error_code across both canonicalizations (the second
488+ // success cleared the first failure) and compared raw strings without a
489+ // component boundary (a `registry-evil` sibling passed). The predicate
490+ // fails closed on any resolution error.
491+ if ( escapes_containment (payloadRoot, containment_root (cfg. registryDir ))) {
492+ mcpp::log::verbose ( " toolchain " , std::format (
493+ " skip {} fixup: payload '{}' resolves outside this home — "
494+ " inherited payload, owner is responsible for its fixup " ,
495+ kind, payloadRoot. string ())) ;
496+ return ;
430497 }
431498
432499 auto xlEnv = mcpp::config::make_xlings_env (cfg);
0 commit comments