aws / aws/aws-nitro-enclaves-cli

Build process turns hardlinks into symlinks

Open
#744 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
156
Forks
99
PR merge metrics
No merged PRs in 30d

Description

On Ubuntu, the rust-coreutils multi-call binary (similar to busybox) uses hardlinks for each of the utilities. It also uses an [Ubuntu-specific patch](https://github.com/uutils/coreutils/issues/10135) that requires `/proc/self/exe` to point to a file with the same name as `argv[0]`.

When using `nitro-cli build-enclave` to convert a container with this package installed, the hardlinks get converted into symlinks. This then results in the coreutils binaries not working at all:

```
root@(none):~# ls -la /usr/bin/mkdir
Security violation: Requested utility `ls` does not match executable name:
/usr/bin/coreutils
root@(none):~# /bin/busybox ls -la /usr/bin/mkdir
lrwxrwxrwx 1 root root 32 Sep 26 18:16 /usr/bin/mkdir -> ../lib/cargo/bin/coreutils/mkdir
root@(none):~# /bin/busybox ls -la /usr/bin/../lib/cargo/bin/coreutils/mkdir
lrwxrwxrwx 1 root root 25 Oct 22 10:39 /usr/bin/../lib/cargo/bin/coreutils/mkdir -> ../../../../bin/coreutils
```

Contributor guide

Open the contributing guide

Research direction

Start at the nitro-cli build-enclave path and reproduce the conversion with a container containing rust-coreutils hardlinks. Trace how the container filesystem is assembled, then verify that the utility links remain hardlinks and that the resulting coreutils commands work inside the enclave.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
build-system, cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.