Comparing 5e0383fa94..8543b3cc1a - alois31/lix

Author	SHA1	Message	Date
alois31	8543b3cc1a	libfetchers: allow automatic rejection of configuration options from flakes The `allow-flake-configuration` option allows the user to control whether to accept configuration options supplied by flakes. Unfortunately, setting this to false really meant "ask each time" (with an option to remember the choice for each specific option encountered). Let no mean no, and introduce (and default to) a separate value for the "ask each time" behaviour. Co-Authored-By: Jade Lovelace <lix@jade.fyi> Change-Id: `I7ccd67a95bfc92cffc1ebdc972d243f5191cc1b4`	2024-06-30 11:35:02 +02:00
alois31	cb79437c1c	tree-wide: unify progress bar inactive and paused states Previously, the progress bar had two subtly different states in which the bar would not actually render, both with their own shortcomings: inactive (which was irreversible) and paused (reversible, but swallowing logs). Furthermore, there was no way of resetting the statistics, so a very bad solution was implemented (`243c0f18da`) that would create a new logger for each line of the repl, leaking the previous one and discarding the value of printBuildLogs. Finally, if stderr was not attached to a TTY, the update thread was started even though the logger was not active, violating the invariant required by the destructor (which is not observed because the logger is leaked). In this commit, the two aforementioned states are unified into a single one, which can be exited again, correctly upholds the invariant that the update thread is only running while the progress bar is active, and does not swallow logs. The latter change in behavior is not expected to be a problems in the rare cases where the paused state was used before, since other loggers (like the simple one) don't exhibit it anyway. The startProgressBar/stopProgressBar API is removed due to being a footgun, and a new method for properly resetting the progress is added. Co-Authored-By: Qyriad <qyriad@qyriad.me> Change-Id: `I2b7c3eb17d439cd0c16f7b896cfb61239ac7ff3a`	2024-06-29 19:18:08 +02:00
alois31	2eac435bc7	libstore/build: use an allowlist approach to syscall filtering Previously, system call filtering (to prevent builders from storing files with setuid/setgid permission bits or extended attributes) was performed using a blocklist. While this looks simple at first, it actually carries significant security and maintainability risks: after all, the kernel may add new syscalls to achieve the same functionality one is trying to block, and it can even be hard to actually add the syscall to the blocklist when building against a C library that doesn't know about it yet. For a recent demonstration of this happening in practice to Nix, see the introduction of fchmodat2 [0] [1]. The allowlist approach does not share the same drawback. While it does require a rather large list of harmless syscalls to be maintained in the codebase, failing to update this list (and roll out the update to all users) in time has rather benign effects; at worst, very recent programs that already rely on new syscalls will fail with an error the same way they would on a slightly older kernel that doesn't support them yet. Most importantly, no unintended new ways of performing dangerous operations will be silently allowed. Another possible drawback is reduced system call performance due to the larger filter created by the allowlist requiring more computation [2]. However, this issue has not convincingly been demonstrated yet in practice, for example in systemd or various browsers. This commit tries to keep the behavior as close to unchanged as possible. Only newer syscalls that are not supported by glibc 2.38 (as found in NixOS 23.11) are blocked. Since this includes fchmodat2, the compatibility code added for handling this syscall can be removed too. [0] https://github.com/NixOS/nixpkgs/issues/300635 [1] https://github.com/NixOS/nix/issues/10424 [2] https://github.com/flatpak/flatpak/pull/4462#issuecomment-1061690607 Change-Id: `I541be3ea9b249bcceddfed6a5a13ac10b11e16ad`	2024-06-28 09:40:21 +02:00
alois31	51708e7433	libstore/build: always treat seccomp setup failures as fatal In `f047e4357b`, I missed the behavior that if building without a dedicated build user (i.e. in single-user setups), seccomp setup failures are silently ignored. This was introduced without explanation 7 years ago (`ff6becafa8`). Hopefully the only use-case nowadays is causing spurious test suite successes when messing up the seccomp filter during development. Let's try removing it. Change-Id: `Ibe51416d9c7a6dd635c2282990224861adf1ceab`	2024-06-28 09:40:15 +02:00

2 changed files with 1 additions and 3 deletions

									
										2

src/libexpr/flake/config.cc
									
										View file
										
				@ -68,8 +68,6 @@ void ConfigFile::apply()

				                    // FIXME: filter ANSI escapes, newlines, \r, etc.

				                    if (std::tolower(logger->ask(fmt("Do you want to allow configuration setting '%s' to be set to '" ANSI_RED "%s" ANSI_NORMAL "' (y/N)? This may allow the flake to gain root, see the nix.conf manual page.", name, valueS)).value_or('n')) == 'y') {

				                        trusted = true;

				                    } else {

				                        warn("you can set '%s' to '%b' to automatically reject configuration options supplied by flakes", "accept-flake-config", false);

				                    }

				                    if (std::tolower(logger->ask(fmt("do you want to permanently mark this value as %s (y/N)?",  trusted ? "trusted": "untrusted" )).value_or('n')) == 'y') {

				                        trustedList[name][valueS] = trusted;

									
										2

src/libfetchers/fetch-settings.hh
									
										View file
										
				@ -11,7 +11,7 @@

				namespace nix {

				enum class AcceptFlakeConfig { False, Ask, True };

				enum class AcceptFlakeConfig { True, Ask, False };

				struct FetchSettings : public Config

				{

Compare commits

4 commits

5e0383fa94 ... 8543b3cc1a

2

src/libexpr/flake/config.cc

View file

2

src/libfetchers/fetch-settings.hh

View file

Compare commits

4 commits 5e0383fa94 ... 8543b3cc1a

2 src/libexpr/flake/config.cc Unescape Escape View file

2 src/libfetchers/fetch-settings.hh Unescape Escape View file

4 commits

5e0383fa94 ... 8543b3cc1a

2

src/libexpr/flake/config.cc

View file

2

src/libfetchers/fetch-settings.hh

View file