[Nix#8802] Nix exposes dmesg to the linux build sandbox by default #126

New issue

Open

opened 2024-03-16 06:45:02 +00:00 by lix-bot · 0 comments

lix-bot commented

2024-03-16 06:45:02 +00:00

Member

Upstream-Issue: NixOS/nix#8802

Describe the bug

The kernel log is available within the linux build sandbox.

Steps To Reproduce

nix-build --expr 'with import <nixpkgs> {}; runCommand "d" {buildInputs=[util-linux];} "dmesg -w"'

nix run --refresh --option extra-experimental-features 'nix-command flakes ca-derivations impure-derivations' github:tomberek/f/sockfault# SOME_SECRET_TO_INJECT

We can see that writing to and reading from dmesg allows for building a communication channel and a synchronization primitive. There are other more interesting things one might be able to do.

Expected behavior

Not sure if this is critical or if syslog/dmesg behavior is required anywhere else.

Additional context

Note that other ecosystems have dealt with this: https://github.com/containerd/containerd/pull/4491 and https://github.com/moby/moby/pull/37929

Ref: https://github.com/tomberek/f/tree/sockfault

Priorities

Add 👍 to issues you find important.

Upstream-Issue: https://git.lix.systems/NixOS/nix/issues/8802 **Describe the bug** The kernel log is available within the linux build sandbox. **Steps To Reproduce** 1. `nix-build --expr 'with import <nixpkgs> {}; runCommand "d" {buildInputs=[util-linux];} "dmesg -w"'` or 1. `nix run --refresh --option extra-experimental-features 'nix-command flakes ca-derivations impure-derivations' github:tomberek/f/sockfault# SOME_SECRET_TO_INJECT` We can see that writing to and reading from dmesg allows for building a communication channel and a synchronization primitive. There are other more interesting things one might be able to do. **Expected behavior** Not sure if this is critical or if syslog/dmesg behavior is required anywhere else. **Additional context** Note that other ecosystems have dealt with this: https://github.com/containerd/containerd/pull/4491 and https://github.com/moby/moby/pull/37929 Ref: https://github.com/tomberek/f/tree/sockfault **Priorities** Add :+1: to [issues you find important](https://github.com/NixOS/nix/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc).