Harden jailed native build execution

modules/fruix/system/freebsd/build.scm

@@ -175,7 +175,7 @@
          (string-append "KERNCONF=" (assoc-ref common 'kernconf)))
    (assoc-ref common 'make-flags)))
 
-(define* (make-command-string common build-root target #:key (parallel? #f) (destdir #f))
+(define* (make-command-string common build-root target #:key (parallel? #f) (destdir #f) (extra-variables '()))
   (string-join
    (append
     (list "env" (string-append "MAKEOBJDIRPREFIX=" build-root "/obj") "make")
@@ -186,9 +186,15 @@
     (if destdir
         (list (string-append "DESTDIR=" destdir))
         '())
+    extra-variables
     (list target))
    " "))
 
+(define* (native-install-command-string common build-root target destdir)
+  (make-command-string common build-root target
+                       #:destdir destdir
+                       #:extra-variables '("NO_ROOT=yes" "NO_FSCHG=yes")))
+
 (define (run-command/log log-file command)
   (mkdir-p (dirname log-file))
   (let ((status (system* "sh" "-c" (string-append command " >" log-file " 2>&1"))))
@@ -209,11 +215,18 @@
 (define (current-user-name)
   (safe-command-output "id" "-un"))
 
+(define (user-home-directory user)
+  (and user
+       (let ((entry (safe-command-output "getent" "passwd" user)))
+         (and entry
+              (match (string-split entry #\:)
+                ((_ _ _ _ _ home _)
+                 (and (string-prefix? "/" home)
+                      home))
+                (_ #f))))))
+
 (define (current-user-home)
-  (let ((home (getenv "HOME")))
-    (and home
-         (string-prefix? "/" home)
-         home)))
+  (user-home-directory (current-user-name)))
 
 (define (default-jail-build-executor)
   (if (jail-build-available?)
@@ -545,9 +558,9 @@
              (mkdir-p stage-root)
              (run-command/log-with-executor executor common build-root
                                             install-log
-                                            (string-append (make-command-string common build-root "installworld" #:destdir stage-root)
+                                            (string-append (native-install-command-string common build-root "installworld" stage-root)
                                                            " && "
-                                                           (make-command-string common build-root "distribution" #:destdir stage-root)))
+                                                           (native-install-command-string common build-root "distribution" stage-root)))
              (let* ((keep-paths (build-plan-ref plan 'keep-paths '()))
                     (selected-root (if (null? keep-paths)
                                        stage-root
@@ -560,7 +573,7 @@
              (mkdir-p stage-root)
              (run-command/log-with-executor executor common build-root
                                             install-log
-                                            (make-command-string common build-root "installkernel" #:destdir stage-root))
+                                            (native-install-command-string common build-root "installkernel" stage-root))
              stage-root)
             (else
              (error (format #f "unsupported native FreeBSD build system: ~a"

tests/build-jails.scm

@@ -19,6 +19,8 @@
   (@@ (fruix system freebsd build) run-script-in-temporary-jail))
 (define run-command/log-with-executor
   (@@ (fruix system freebsd build) run-command/log-with-executor))
+(define native-install-command-string
+  (@@ (fruix system freebsd build) native-install-command-string))
 
 (define (trim text)
   (string-trim-both text))
@@ -66,7 +68,15 @@
        (build-root (mktemp-directory "/tmp/fruix-build-jails-native.XXXXXX"))
        (log-file (string-append build-root "/logs/make-vars.log"))
        (common `((source-root . "/usr/src")
-                 (kernconf-path . "/usr/src/sys/amd64/conf/GENERIC"))))
+                 (target . "amd64")
+                 (target-arch . "amd64")
+                 (kernconf . "GENERIC")
+                 (kernconf-path . "/usr/src/sys/amd64/conf/GENERIC")
+                 (make-flags . ()))))
+  (test-assert "native install command disables root-only flags"
+    (let ((command (native-install-command-string common build-root "installworld" "/tmp/stage")))
+      (and (string-contains command "NO_ROOT=yes")
+           (string-contains command "NO_FSCHG=yes"))))
   (run-command/log-with-executor executor common build-root log-file
                                  "make -C /usr/src -V .CURDIR")
   (test-assert "native build executor can run make with mounted source tree"