diff options
| author | Eelco Dolstra <edolstra@gmail.com> | 2019-10-09T16·01+0200 |
|---|---|---|
| committer | Eelco Dolstra <edolstra@gmail.com> | 2019-10-09T21·57+0200 |
| commit | 65953789bcd73f098486b0a385b4e661c0ccda19 (patch) | |
| tree | 92a0208f5a4455b89f9549b802dc0f063e64711f /scripts/install-multi-user.sh | |
| parent | 910b0fcc118cce3ade09f252da43fbe2436080e5 (diff) | |
Remove world-writability from per-user directories
'nix-daemon' now creates subdirectories for users when they first connect. Fixes #509 (CVE-2019-17365). Should also fix #3127. (cherry picked from commit 5a303093dcae1e5ce9212616ef18f2ca51020b0d)
Diffstat (limited to 'scripts/install-multi-user.sh')
| -rw-r--r-- | scripts/install-multi-user.sh | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/scripts/install-multi-user.sh b/scripts/install-multi-user.sh index a41309e930b5..2ebaa1abaff6 100644 --- a/scripts/install-multi-user.sh +++ b/scripts/install-multi-user.sh @@ -529,16 +529,15 @@ create_build_users() { } create_directories() { + # FIXME: remove all of this because it duplicates LocalStore::LocalStore(). + _sudo "to make the basic directory structure of Nix (part 1)" \ - mkdir -pv -m 0755 /nix /nix/var /nix/var/log /nix/var/log/nix /nix/var/log/nix/drvs /nix/var/nix{,/db,/gcroots,/profiles,/temproots,/userpool} + mkdir -pv -m 0755 /nix /nix/var /nix/var/log /nix/var/log/nix /nix/var/log/nix/drvs /nix/var/nix{,/db,/gcroots,/profiles,/temproots,/userpool} /nix/var/nix/{gcroots,profiles}/per-user _sudo "to make the basic directory structure of Nix (part 2)" \ - mkdir -pv -m 1777 /nix/var/nix/{gcroots,profiles}/per-user - - _sudo "to make the basic directory structure of Nix (part 3)" \ mkdir -pv -m 1775 /nix/store - _sudo "to make the basic directory structure of Nix (part 4)" \ + _sudo "to make the basic directory structure of Nix (part 3)" \ chgrp "$NIX_BUILD_GROUP_NAME" /nix/store _sudo "to set up the root user's profile (part 1)" \ |