From 5526a282b5b44e9296e61e07d7d2626a79141ac4 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Tue, 26 Feb 2013 02:30:19 +0100 Subject: Security: Don't allow builders to change permissions on files they don't own It turns out that in multi-user Nix, a builder may be able to do ln /etc/shadow $out/foo Afterwards, canonicalisePathMetaData() will be applied to $out/foo, causing /etc/shadow's mode to be set to 444 (readable by everybody but writable by nobody). That's obviously Very Bad. Fortunately, this fails in NixOS's default configuration because /nix/store is a bind mount, so "ln" will fail with "Invalid cross-device link". It also fails if hard-link restrictions are enabled, so a workaround is: echo 1 > /proc/sys/fs/protected_hardlinks The solution is to check that all files in $out are owned by the build user. This means that innocuous operations like "ln ${pkgs.foo}/some-file $out/" are now rejected, but that already failed in chroot builds anyway. --- src/libstore/optimise-store.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/libstore/optimise-store.cc') diff --git a/src/libstore/optimise-store.cc b/src/libstore/optimise-store.cc index e91c2b1ce52c..75f2d7d6cc40 100644 --- a/src/libstore/optimise-store.cc +++ b/src/libstore/optimise-store.cc @@ -32,7 +32,7 @@ struct MakeReadOnly { try { /* This will make the path read-only. */ - if (path != "") canonicalisePathMetaData(path, false); + if (path != "") canonicalisePathMetaData(path, false, -1); } catch (...) { ignoreException(); } -- cgit 1.4.1