about summary refs log tree commit diff
diff options
context:
space:
mode:
authorEelco Dolstra <eelco.dolstra@logicblox.com>2013-06-13T15·12+0200
committerEelco Dolstra <eelco.dolstra@logicblox.com>2013-06-13T15·12+0200
commitcd49ee08970f0fa44053fb12cdf29668e8131a51 (patch)
tree4aafca00a479cc18e8759636ff1c2140dba2735a
parent1e2c7c04b1125fb63fae733fc27abb86743b8224 (diff)
Fix a security bug in hash rewriting
Before calling dumpPath(), we have to make sure the files are owned by
the build user.  Otherwise, the build could contain a hard link to
(say) /etc/shadow, which would then be read by the daemon and
rewritten as a world-readable file.

This only affects systems that don't have hard link restrictions
enabled.
-rw-r--r--src/libstore/build.cc6
1 files changed, 6 insertions, 0 deletions
diff --git a/src/libstore/build.cc b/src/libstore/build.cc
index 2d33719573d0..e49c66fc576a 100644
--- a/src/libstore/build.cc
+++ b/src/libstore/build.cc
@@ -1489,6 +1489,12 @@ void DerivationGoal::buildDone()
             /* Apply hash rewriting if necessary. */
             if (!rewritesFromTmp.empty()) {
                 printMsg(lvlError, format("warning: rewriting hashes in `%1%'; cross fingers") % path);
+
+                /* Canonicalise first.  This ensures that the path
+                   we're rewriting doesn't contain a hard link to
+                   /etc/shadow or something like that. */
+                canonicalisePathMetaData(path, buildUser.enabled() ? buildUser.getUID() : -1);
+
                 /* FIXME: this is in-memory. */
                 StringSink sink;
                 dumpPath(path, sink);