forked from lix-project/lix
b2027f70d9
derivations added to the store by clients have "correct" output
paths (meaning that the output paths are computed by hashing the
derivation according to a certain algorithm). This means that a
malicious user could craft a special .drv file to build *any*
desired path in the store with any desired contents (so long as the
path doesn't already exist). Then the attacker just needs to wait
for a victim to come along and install the compromised path.
For instance, if Alice (the attacker) knows that the latest Firefox
derivation in Nixpkgs produces the path
/nix/store/1a5nyfd4ajxbyy97r1fslhgrv70gj8a7-firefox-5.0.1
then (provided this path doesn't already exist) she can craft a .drv
file that creates that path (i.e., has it as one of its outputs),
add it to the store using "nix-store --add", and build it with
"nix-store -r". So the fake .drv could write a Trojan to the
Firefox path. Then, if user Bob (the victim) comes along and does
$ nix-env -i firefox
$ firefox
he executes the Trojan injected by Alice.
The fix is to have the Nix daemon verify that derivation outputs are
correct (in addValidPath()). This required some refactoring to move
the hash computation code to libstore.
83 lines
1.9 KiB
C++
83 lines
1.9 KiB
C++
#ifndef __DERIVATIONS_H
|
|
#define __DERIVATIONS_H
|
|
|
|
#include <map>
|
|
|
|
#include "types.hh"
|
|
#include "hash.hh"
|
|
|
|
|
|
namespace nix {
|
|
|
|
|
|
/* Extension of derivations in the Nix store. */
|
|
const string drvExtension = ".drv";
|
|
|
|
|
|
/* Abstract syntax of derivations. */
|
|
|
|
struct DerivationOutput
|
|
{
|
|
Path path;
|
|
string hashAlgo; /* hash used for expected hash computation */
|
|
string hash; /* expected hash, may be null */
|
|
DerivationOutput()
|
|
{
|
|
}
|
|
DerivationOutput(Path path, string hashAlgo, string hash)
|
|
{
|
|
this->path = path;
|
|
this->hashAlgo = hashAlgo;
|
|
this->hash = hash;
|
|
}
|
|
void parseHashInfo(bool & recursive, HashType & hashType, Hash & hash) const;
|
|
};
|
|
|
|
typedef std::map<string, DerivationOutput> DerivationOutputs;
|
|
|
|
/* For inputs that are sub-derivations, we specify exactly which
|
|
output IDs we are interested in. */
|
|
typedef std::map<Path, StringSet> DerivationInputs;
|
|
|
|
typedef std::map<string, string> StringPairs;
|
|
|
|
struct Derivation
|
|
{
|
|
DerivationOutputs outputs; /* keyed on symbolic IDs */
|
|
DerivationInputs inputDrvs; /* inputs that are sub-derivations */
|
|
PathSet inputSrcs; /* inputs that are sources */
|
|
string platform;
|
|
Path builder;
|
|
Strings args;
|
|
StringPairs env;
|
|
};
|
|
|
|
|
|
/* Write a derivation to the Nix store, and return its path. */
|
|
Path writeDerivation(const Derivation & drv, const string & name);
|
|
|
|
/* Parse a derivation. */
|
|
Derivation parseDerivation(const string & s);
|
|
|
|
/* Print a derivation. */
|
|
string unparseDerivation(const Derivation & drv);
|
|
|
|
/* Check whether a file name ends with the extensions for
|
|
derivations. */
|
|
bool isDerivation(const string & fileName);
|
|
|
|
/* Return true iff this is a fixed-output derivation. */
|
|
bool isFixedOutputDrv(const Derivation & drv);
|
|
|
|
Hash hashDerivationModulo(Derivation drv);
|
|
|
|
/* Memoisation of hashDerivationModulo(). */
|
|
typedef std::map<Path, Hash> DrvHashes;
|
|
|
|
extern DrvHashes drvHashes;
|
|
|
|
}
|
|
|
|
|
|
#endif /* !__DERIVATIONS_H */
|