wroclaw-git-backups/nix
1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-07-06 21:41:48 +02:00
Code Activity

Remove world-writability from per-user directories

Browse source 
'nix-daemon' now creates subdirectories for users when they first
connect.

Fixes #509 (CVE-2019-17365).
Should also fix #3127.
This commit is contained in:
Eelco Dolstra 2019-10-09 18:01:21 +02:00
parent 4331eeb13d
commit 5a303093dc
No known key found for this signature in database
GPG key ID: 8170B4726D7198DE
11 changed files with 41 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

9
src/nix-daemon/nix-daemon.cc
View file

@ -742,7 +742,8 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
}
static void processConnection(bool trusted)
static void processConnection(bool trusted,
const std::string & userName, uid_t userId)
{
MonitorFdHup monitor(from.fd);
@ -793,6 +794,8 @@ static void processConnection(bool trusted)
params["path-info-cache-size"] = "0";
auto store = openStore(settings.storeUri, params);
store->createUser(userName, userId);
tunnelLogger->stopWork();
to.flush();
@ -1053,7 +1056,7 @@ static void daemonLoop(char * * argv)
/* Handle the connection. */
from.fd = remote.get();
to.fd = remote.get();
processConnection(trusted);
processConnection(trusted, user, peer.uid);
exit(0);
}, options);
@ -1133,7 +1136,7 @@ static int _main(int argc, char * * argv)
}
}
} else {
processConnection(true);
processConnection(true, "root", 0);
}
} else {
daemonLoop(argv);