wroclaw-git-backups/nix
1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-07-03 06:11:46 +02:00
Code Activity

Merge pull request #11000 from hercules-ci/backport-10992-to-2.23-maintenance

Browse source 
[Backport 2.23-maintenance] Fix #10947; don't cache disallowed IFD
This commit is contained in:
Eelco Dolstra 2024-07-01 14:14:04 +02:00 • committed by GitHub
commit f80e0832bc
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 81 additions and 68 deletions
Download patch file Download diff file Expand all files Collapse all files

2
doc/manual/rl-next/harden-user-sandboxing.md
View file

@ -1,8 +1,6 @@
---
synopsis: Harden the user sandboxing
significance: significant
issues:
prs: <only provided once merged>
---
The build directory has been hardened against interference with the outside world by nesting it inside another directory owned by (and only readable by) the daemon user.

2
src/libexpr/primops.cc
View file

@ -79,7 +79,7 @@ StringMap EvalState::realiseContext(const NixStringContext & context, StorePathS
if (drvs.empty()) return {};
if (isIFD && !evalSettings.enableImportFromDerivation)
error<EvalError>(
error<EvalBaseError>(
"cannot build '%1%' during evaluation because the option 'allow-import-from-derivation' is disabled",
drvs.begin()->to_string(*store)
).debugThrow();

17
tests/functional/flakes/eval-cache.sh
View file

@ -7,12 +7,22 @@ requireGit
flake1Dir="$TEST_ROOT/eval-cache-flake"
createGitRepo "$flake1Dir" ""
cp ../simple.nix ../simple.builder.sh ../config.nix "$flake1Dir/"
git -C "$flake1Dir" add simple.nix simple.builder.sh config.nix
git -C "$flake1Dir" commit -m "config.nix"
cat >"$flake1Dir/flake.nix" <<EOF
{
description = "Fnord";
outputs = { self }: {
outputs = { self }: let inherit (import ./config.nix) mkDerivation; in {
foo.bar = throw "breaks";
drv = mkDerivation {
name = "build";
buildCommand = ''
echo true > \$out
'';
};
ifd = assert (import self.drv); self.drv;
};
}
EOF
@ -22,3 +32,8 @@ git -C "$flake1Dir" commit -m "Init"
expect 1 nix build "$flake1Dir#foo.bar" 2>&1 | grepQuiet 'error: breaks'
expect 1 nix build "$flake1Dir#foo.bar" 2>&1 | grepQuiet 'error: breaks'
# Conditional error should not be cached
expect 1 nix build "$flake1Dir#ifd" --option allow-import-from-derivation false 2>&1 \
| grepQuiet 'error: cannot build .* during evaluation because the option '\''allow-import-from-derivation'\'' is disabled'
nix build "$flake1Dir#ifd"

14
tests/nixos/user-sandboxing/attacker.c
View file

@ -9,11 +9,13 @@
#define SYS_fchmodat2 452
int fchmodat2(int dirfd, const char *pathname, mode_t mode, int flags) {
int fchmodat2(int dirfd, const char * pathname, mode_t mode, int flags)
{
return syscall(SYS_fchmodat2, dirfd, pathname, mode, flags);
}
int main(int argc, char **argv) {
int main(int argc, char ** argv)
{
if (argc <= 1) {
// stage 1: place the setuid-builder executable
@ -48,10 +50,9 @@ int main(int argc, char **argv) {
fprintf(stderr, "Entering the inotify loop\n");
for (;;) {
ssize_t len = read(fd, buf, sizeof(buf));
struct inotify_event *ev;
for (char *pe = buf; pe < buf + len;
pe += sizeof(struct inotify_event) + ev->len) {
ev = (struct inotify_event *)pe;
struct inotify_event * ev;
for (char * pe = buf; pe < buf + len; pe += sizeof(struct inotify_event) + ev->len) {
ev = (struct inotify_event *) pe;
fprintf(stderr, "folder %s created\n", ev->name);
// wait a bit to prevent racing against the creation
sleep(1);
@ -79,4 +80,3 @@ int main(int argc, char **argv) {
exit(0);
}
}