Please test your packages with sandboxed build system

[aparcar]

Dear @openwrt/packages-write ,

Please try to build your maintained packages with the following pull request. It will shake up the build system, however should also massively improve a major security vector which persisted for years...

openwrt/openwrt#22353

Thanks

[hnyman]

Could there be some initial listing of suspects in the current situation,e.g. from grepping buildbot log of an all packages build run?

I suspect that many modern go or python packages are affected, but I remember running into embedded sub-package downloads in quite unexpected places.

Could the first step be some kind of logging of the downloads, without breaking on them?

[GeorgeSapkin]

I haven't looked into it at all so far, but Go itself breaks with ccache: error: Read-only file system when sandboxing is enabled.

[hnyman]

I have given feedback in the PR that there seems to be trouble with multi-threaded builds (-j something), as gnu make uses /tmp as the jobserver status pipe file directory. At least ninja build tool uses that natively, so packages utilising ninja will break.

A global solution is likely needed for that, as the jobserver directory is determined from the already existing env variables when you issue the 'make' command to launch the build, so setting value in makefiles does not work. Easiest solution would be to allow access to /tmp.

[aparcar]

Maybe give openwrt its own /tmp folder as a whole?

[hnyman]

Maybe give openwrt its own /tmp folder as a whole?

What do you mean? Global /tmp somehow re-allocated just for OpenWrt building, and another /tmp-something created for others and communicated by changing env variables?

The point is that the env variable should be set separately before the build 'make -j xxx' command is issued. So something (outside makefiles) needs to create it beforehand and set the variable(s) for it to be noticed. We setting tmpdir variables in rules.mk is already too late for that global make jobserver dir purpose.

In buildbot you can do that somewhat easily, as the whole build is scripted anyhow. We could set MAKE_TMPDIR to something pre-defined for the sandbox, just before the make step, (or include it in the make commands).

But I assume that to protect users' self-compilation environments, this would eventually be enabled for all.
For casual users, the challenge will be that there is no <buildroot>/tmp when starting. It will be created by the make. We can naturally argue that feed update etc. will create <buildroot>/tmp in the process, so it could be set before the 'make -j xxx' is issued, but if you have already updated all and just ran make dirclean to clear all, there is again no <buildroot>/tmp/ if you issue 'make'.

But still, even if there is a dir, something should set the env var so that "make -j ..." can properly utilise it.

(but I am not sure if this should be discussed here, or in the actual PR openwrt/openwrt#22353 where I also wrote a bit deeper analysis of the situation yesterday)

[danielfdickinson]

This isn't really ready for package building - openwrt core doesn't successfully build (util-linux uses ninja and therefore runs into what is probably the issue mentioned above), so testing packages builds is rather difficult.

make V=sc 2>&1 | tee build.log

-DNCURSES_WIDECHAR -MD -MQ lib/libtcolors.a.p/colors.c.o -MF lib/libtcolors.a.p/colors.c.o.d -o lib/libtcolors.a.p/colors.c.o -c ../lib/colors.c
../lib/colors.c: In function 'colors_terminal_is_ready':
../lib/colors.c:562:21: error: implicit declaration of function 'setupterm' [-Wimplicit-function-declaration]
  562 |                 if (setupterm(NULL, STDOUT_FILENO, &ret) == 0 && ret == 1) {
      |                     ^~~~~~~~~
../lib/colors.c:562:21: warning: nested extern declaration of 'setupterm' [-Wnested-externs]
../lib/colors.c:563:35: error: implicit declaration of function 'tigetnum' [-Wimplicit-function-declaration]
  563 |                         ncolors = tigetnum("colors");
      |                                   ^~~~~~~~
../lib/colors.c:563:35: warning: nested extern declaration of 'tigetnum' [-Wnested-externs]
../lib/colors.c:564:25: error: implicit declaration of function 'del_curterm' [-Wimplicit-function-declaration]
  564 |                         del_curterm(cur_term);
      |                         ^~~~~~~~~~~
../lib/colors.c:564:25: warning: nested extern declaration of 'del_curterm' [-Wnested-externs]
../lib/colors.c:564:37: error: 'cur_term' undeclared (first use in this function)
  564 |                         del_curterm(cur_term);
      |                                     ^~~~~~~~
../lib/colors.c:564:37: note: each undeclared identifier is reported only once for each function it appears in
ninja: build stopped: subcommand failed.
make[4]: *** [Makefile:1028: /home/daniel/Build/sandbox-rpi-5/openwrt/build_dir/target-aarch64_cortex-a76_musl/util-linux-2.41.3/.built_compile] Error 1

[danielfdickinson]

Ok. It is likely not the Ninja issue. (make -j1 ... also fails). The removing of /tmp from the command line also doesn't help.

I wonder if util-linux package has been pulling from the OS for some terminal information.

In any even a little more information about the environment:

• Debian 13 (trixie). Fully up to date. With GNOME. Has bubblewrap.
• building openwrt from https://github.com/aparcar/openwrt.git sandbox branch
• all feeds updated and installed