apache / apache/buildstream

Information about host machine architecture leaks into sandbox

Open
#262 5 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
140
Forks
45
Avg merge
1d 3h
Merged PRs (30d)
6

Description

[See original issue on GitLab](https://gitlab.com/BuildStream/buildstream/-/issues/262)
In GitLab by [[Gitlab user @samthursfield]](https://gitlab.com/samthursfield) on Feb 20, 2018, 11:50

On the Linux platform at least, processes within the sandbox have access to the host's CPU info (`/proc/cpuinfo` and on x86 the `cpuid` instruction).

If build systems in the sandbox use `gcc -march=native` or something similar, reproducibility will be compromised and the built artifacts might not work on CPUs with a different feature set.

Contributor guide

Open the contributing guide

Research direction

Start by investigating how the Linux sandbox exposes /proc/cpuinfo and the x86 cpuid instruction. Confirm the current visibility from processes inside the sandbox and determine the project’s existing reproducibility expectations; done means host CPU features are no longer available to sandboxed builds.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux
Domain
build-system, operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.