From d798349ede3d6eb6e92a2e4f95f6b2179407ceb9 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Tue, 30 May 2017 13:43:51 +0200 Subject: [PATCH] canonicalisePathMetaData(): Remove extended attributes / ACLs EAs/ACLs are not part of the NAR canonicalisation. Worse, setting an ACL allows a builder to create writable files in the Nix store. So get rid of them. Closes #185. --- src/libstore/local-store.cc | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc index 3ac23ec26..5b03e86f3 100644 --- a/src/libstore/local-store.cc +++ b/src/libstore/local-store.cc @@ -27,6 +27,7 @@ #include #include #include +#include #endif #include @@ -407,6 +408,27 @@ static void canonicalisePathMetaData_(const Path & path, uid_t fromUid, InodesSe if (!(S_ISREG(st.st_mode) || S_ISDIR(st.st_mode) || S_ISLNK(st.st_mode))) throw Error(format("file ‘%1%’ has an unsupported type") % path); +#if __linux__ + /* Remove extended attributes / ACLs. */ + ssize_t eaSize = llistxattr(path.c_str(), nullptr, 0); + + if (eaSize < 0) { + if (errno != ENOTSUP) + throw SysError("querying extended attributes of ‘%s’", path); + } else if (eaSize > 0) { + std::vector eaBuf(eaSize); + + if ((eaSize = llistxattr(path.c_str(), eaBuf.data(), eaBuf.size())) < 0) + throw SysError("querying extended attributes of ‘%s’", path); + + for (auto & eaName: tokenizeString(std::string(eaBuf.data(), eaSize), std::string("\000", 1))) + if (lremovexattr(path.c_str(), eaName.c_str()) == -1) + throw SysError("removing extended attribute ‘%s’ from ‘%s’", eaName, path); + + assert(llistxattr(path.c_str(), nullptr, 0) == 0); + } +#endif + /* Fail if the file is not owned by the build user. This prevents us from messing up the ownership/permissions of files hard-linked into the output (e.g. "ln /etc/shadow $out/foo").