wroclaw-git-backups/nix
1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-07-07 01:51:47 +02:00
Code Activity

Add a seccomp filter to prevent creating setuid/setgid binaries

Browse source 
This prevents builders from setting the S_ISUID or S_ISGID bits,
preventing users from using a nixbld* user to create a setuid/setgid
binary to interfere with subsequent builds under the same nixbld* uid.

This is based on aszlig's seccomp code
(47f587700d).

Reported by Linus Heckemann.
This commit is contained in:
Eelco Dolstra 2017-05-29 11:34:24 +02:00
parent 6e01ecd112
commit 6cc6c15a2d
No known key found for this signature in database
GPG key ID: 8170B4726D7198DE
5 changed files with 54 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

39
src/libstore/build.cc
View file

@ -46,6 +46,7 @@
#include <sys/param.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <seccomp.h>
#define pivot_root(new_root, put_old) (syscall(SYS_pivot_root, new_root, put_old))
#endif
@ -2298,6 +2299,42 @@ void DerivationGoal::doExportReferencesGraph()
}
void setupSeccomp()
{
#if __linux__
scmp_filter_ctx ctx;
if (!(ctx = seccomp_init(SCMP_ACT_ALLOW)))
throw SysError("unable to initialize seccomp mode 2");
Finally cleanup([&]() {
seccomp_release(ctx);
});
if (seccomp_arch_add(ctx, SCMP_ARCH_X86) != 0)
throw SysError("unable to add 32-bit seccomp architecture");
for (int perm : { S_ISUID, S_ISGID }) {
// TODO: test chmod and fchmod.
if (seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(chmod), 1,
SCMP_A1(SCMP_CMP_MASKED_EQ, perm, perm)) != 0)
throw SysError("unable to add seccomp rule");
if (seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(fchmod), 1,
SCMP_A1(SCMP_CMP_MASKED_EQ, perm, perm)) != 0)
throw SysError("unable to add seccomp rule");
if (seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(fchmodat), 1,
SCMP_A2(SCMP_CMP_MASKED_EQ, perm, perm)) != 0)
throw SysError("unable to add seccomp rule");
}
if (seccomp_load(ctx) != 0)
throw SysError("unable to load seccomp BPF program");
#endif
}
void DerivationGoal::runChild()
{
/* Warning: in the child we should absolutely not make any SQLite
@ -2307,6 +2344,8 @@ void DerivationGoal::runChild()
commonChildInit(builderOut);
setupSeccomp();
bool setUser = true;
/* Make the contents of netrc available to builtin:fetchurl