forked from lix-project/lix
Previously, system call filtering (to prevent builders from storing files with
setuid/setgid permission bits or extended attributes) was performed using a
blocklist. While this looks simple at first, it actually carries significant
security and maintainability risks: after all, the kernel may add new syscalls
to achieve the same functionality one is trying to block, and it can even be
hard to actually add the syscall to the blocklist when building against a C
library that doesn't know about it yet. For a recent demonstration of this
happening in practice to Nix, see the introduction of fchmodat2 [0] [1].
The allowlist approach does not share the same drawback. While it does require
a rather large list of harmless syscalls to be maintained in the codebase,
failing to update this list (and roll out the update to all users) in time has
rather benign effects; at worst, very recent programs that already rely on new
syscalls will fail with an error the same way they would on a slightly older
kernel that doesn't support them yet. Most importantly, no unintended new ways
of performing dangerous operations will be silently allowed.
Another possible drawback is reduced system call performance due to the larger
filter created by the allowlist requiring more computation [2]. However, this
issue has not convincingly been demonstrated yet in practice, for example in
systemd or various browsers.
This commit tries to keep the behavior as close to unchanged as possible. Only
newer syscalls that are not supported by glibc 2.38 (as found in NixOS 23.11)
are blocked. Since this includes fchmodat2, the compatibility code added for
handling this syscall can be removed too.
[0] https://github.com/NixOS/nixpkgs/issues/300635
[1] https://github.com/NixOS/nix/issues/10424
[2] https://github.com/flatpak/flatpak/pull/4462#issuecomment-1061690607
Change-Id: I541be3ea9b249bcceddfed6a5a13ac10b11e16ad
128 lines
3.5 KiB
Nix
128 lines
3.5 KiB
Nix
# Verify that Linux builds cannot create setuid or setgid binaries.
|
|
|
|
{ lib, config, nixpkgs, ... }:
|
|
|
|
let
|
|
pkgs = config.nodes.machine.nixpkgs.pkgs;
|
|
in
|
|
{
|
|
name = "setuid";
|
|
|
|
nodes.machine =
|
|
{ config, lib, pkgs, ... }:
|
|
{ virtualisation.writableStore = true;
|
|
nix.settings.substituters = lib.mkForce [ ];
|
|
nix.nixPath = [ "nixpkgs=${lib.cleanSource pkgs.path}" ];
|
|
virtualisation.additionalPaths = [
|
|
pkgs.stdenvNoCC
|
|
pkgs.pkgsi686Linux.stdenvNoCC
|
|
];
|
|
};
|
|
|
|
testScript = { nodes }: ''
|
|
# fmt: off
|
|
start_all()
|
|
|
|
# Copying to /tmp should succeed.
|
|
machine.succeed(r"""
|
|
nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" {} "
|
|
mkdir -p $out
|
|
cp ${pkgs.coreutils}/bin/id /tmp/id
|
|
")'
|
|
""".strip())
|
|
|
|
machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
|
|
|
|
machine.succeed("rm /tmp/id")
|
|
|
|
# Creating a setuid binary should fail.
|
|
machine.fail(r"""
|
|
nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" {} "
|
|
mkdir -p $out
|
|
cp ${pkgs.coreutils}/bin/id /tmp/id
|
|
chmod 4755 /tmp/id
|
|
")'
|
|
""".strip())
|
|
|
|
machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
|
|
|
|
machine.succeed("rm /tmp/id")
|
|
|
|
# Creating a setgid binary should fail.
|
|
machine.fail(r"""
|
|
nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" {} "
|
|
mkdir -p $out
|
|
cp ${pkgs.coreutils}/bin/id /tmp/id
|
|
chmod 2755 /tmp/id
|
|
")'
|
|
""".strip())
|
|
|
|
machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
|
|
|
|
machine.succeed("rm /tmp/id")
|
|
|
|
# The checks should also work on 32-bit binaries.
|
|
machine.fail(r"""
|
|
nix-build --no-sandbox -E '(with import <nixpkgs> { system = "i686-linux"; }; runCommand "foo" {} "
|
|
mkdir -p $out
|
|
cp ${pkgs.coreutils}/bin/id /tmp/id
|
|
chmod 2755 /tmp/id
|
|
")'
|
|
""".strip())
|
|
|
|
machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
|
|
|
|
machine.succeed("rm /tmp/id")
|
|
|
|
# The tests above use fchmodat(). Test chmod() as well.
|
|
machine.succeed(r"""
|
|
nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ perl ]; } "
|
|
mkdir -p $out
|
|
cp ${pkgs.coreutils}/bin/id /tmp/id
|
|
perl -e \"chmod 0666, qw(/tmp/id) or die\"
|
|
")'
|
|
""".strip())
|
|
|
|
machine.succeed('[[ $(stat -c %a /tmp/id) = 666 ]]')
|
|
|
|
machine.succeed("rm /tmp/id")
|
|
|
|
machine.fail(r"""
|
|
nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ perl ]; } "
|
|
mkdir -p $out
|
|
cp ${pkgs.coreutils}/bin/id /tmp/id
|
|
perl -e \"chmod 04755, qw(/tmp/id) or die\"
|
|
")'
|
|
""".strip())
|
|
|
|
machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
|
|
|
|
machine.succeed("rm /tmp/id")
|
|
|
|
# And test fchmod().
|
|
machine.succeed(r"""
|
|
nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ perl ]; } "
|
|
mkdir -p $out
|
|
cp ${pkgs.coreutils}/bin/id /tmp/id
|
|
perl -e \"my \\\$x; open \\\$x, qw(/tmp/id); chmod 01750, \\\$x or die\"
|
|
")'
|
|
""".strip())
|
|
|
|
machine.succeed('[[ $(stat -c %a /tmp/id) = 1750 ]]')
|
|
|
|
machine.succeed("rm /tmp/id")
|
|
|
|
machine.fail(r"""
|
|
nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ perl ]; } "
|
|
mkdir -p $out
|
|
cp ${pkgs.coreutils}/bin/id /tmp/id
|
|
perl -e \"my \\\$x; open \\\$x, qw(/tmp/id); chmod 04777, \\\$x or die\"
|
|
")'
|
|
""".strip())
|
|
|
|
machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
|
|
|
|
machine.succeed("rm /tmp/id")
|
|
'';
|
|
}
|