lix-project/lix
17
37
Fork 14
Code Issues 286 Code Review (Gerrit) Projects 1 Releases Wiki Activity

Lix allows configuration which makes everyone inside the sandbox effectively root #242

New issue
Open
opened 2024-04-19 20:07:22 +00:00 by nrabulinski · 5 comments
nrabulinski commented 2024-04-19 20:07:22 +00:00
Member
Copy link

Describe the bug

Well, not a bug exactly but currently Lix allows the user to implicitly set the build user group to root. This used to be disallowed, but because it broke RPM builds someone decided to ifdef it out 16 years ago :^) 98968fbb63 just for the code to finally be completely removed a bit over a year ago 479c011784

Steps To Reproduce

  1. Add build-users-group = to nix config
  2. Restart the daemon
  3. Enjoy root in the sandbox

Expected behavior

Nix should always default to using the nixbld group, or at least should do so when it's running as root

nix --version output

All nix versions since circa 2008

Additional context

IMO we don't necessarily need to disallow setting build-users-group = root, even though there may be hardly any reason to do so, but defaulting to the group of the user who's running the process is bad

## Describe the bug Well, not a bug exactly but currently Lix allows the user to *implicitly* set the build user group to root. This used to be disallowed, but because it broke RPM builds someone decided to ifdef it out 16 years ago :^) https://github.com/NixOS/nix/commit/98968fbb63a1a049b2439bfc2a7d53e5b51471e3 just for the code to finally be completely removed a bit over a year ago https://github.com/NixOS/nix/commit/479c0117840a5dc710019db006c5940b29d98dcc ## Steps To Reproduce 1. Add `build-users-group =` to nix config 2. Restart the daemon 3. Enjoy root in the sandbox ## Expected behavior Nix should always default to using the `nixbld` group, or at least should do so when it's running as root ## `nix --version` output All nix versions since circa 2008 ## Additional context IMO we don't necessarily need to disallow setting `build-users-group = root`, even though there may be hardly any reason to do so, but defaulting to the group of the user who's running the process is bad
nrabulinski added the
bug
 label 2024-04-19 20:07:22 +00:00
jade commented 2024-04-19 20:51:59 +00:00
Owner
Copy link

I think we should probably disallow setting build-users-group = root and let whoever (probably nobody) be grumpy about it breaking their special use case that we probably should not support to begin with.

Also nice CTF challenge :P https://jade.fyi/blog/reproducible-pwning-writeup/

I think we should probably disallow setting `build-users-group = root` and let whoever (probably nobody) be grumpy about it breaking their special use case that we probably should not support to begin with. Also nice CTF challenge :P https://jade.fyi/blog/reproducible-pwning-writeup/
nrabulinski commented 2024-04-19 21:21:22 +00:00
Author
Member
Copy link

@jade wants to kill NixOS CTF challenges this is so sad (jk next year we'll have a Nix 0day dw)

@jade wants to kill NixOS CTF challenges this is so sad (jk next year we'll have a Nix 0day dw)
lunaphied commented 2024-04-20 19:52:25 +00:00
Owner
Copy link

Wouldn't this affect single-user Lix installations?

Wouldn't this affect single-user Lix installations?
nrabulinski commented 2024-04-20 21:39:51 +00:00
Author
Member
Copy link

It shouldn't since the worst offender here is "if build-users-group is set to empty, default to running user's group" which is a bad default. And as a bonus disallowing it to be root since putting root inside the sandbox is universally a bad idea

It shouldn't since the worst offender here is "if `build-users-group` is *set* to empty, default to running user's group" which is a bad default. And as a bonus disallowing it to be `root` since putting root inside the sandbox is universally a bad idea
jade added the
E/easy
E/help wanted
 labels 2024-05-03 22:51:43 +00:00
jade commented 2024-05-03 22:53:36 +00:00
Owner
Copy link

Yeah, this seems reasonable as a resolution. Action items:

  • Restore the checking code that got commented out due to RedHat builder
  • Fail if the group is set to empty explicitly (maybe? thoughts?)
Yeah, this seems reasonable as a resolution. Action items: - Restore the checking code that got commented out due to RedHat builder - Fail if the group is *set* to empty explicitly (maybe? thoughts?)
qyriad added the
Area/store
 label 2024-05-06 00:54:00 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
git-series/activity-cleanup
release-2.90
sb/tom-hubrecht/primops.cc-v2
sb/bacchanalia/cache-strlen%topic=substr-perf
sb/arcuru/commit-msg
sb/qyriad/beta-1
sb/qyriad/2.90-beta.0
rbt/pre-commit-update
sb/rbt/test-branch
sb/rbt/justfile
sb/rbt/repl-overlays
sb/fuck/what
sb/rbt/pre-commit
sb/rbt/makeflags
sb/pennae/io-rewrite
sb/qyriad/maint-meson
sb/qyriad/maint/meson
sb/puck/meson-c-api
sb/pennae/parser-rewrite
sb/jade/burn-it-all
dependabot/github_actions/zeebe-io/backport-action-2.4.1
dependabot/github_actions/cachix/install-nix-action-25
dependabot/github_actions/actions/labeler-5
dependabot/github_actions/cachix/cachix-action-14
2.90.0-rc1
2.90-beta.1
2.90-beta.0
Labels
Clear labels   
Area/build-packaging

regarding the building or packaging of Lix itself

  
Area/evaluator

libexpr and anything else related to the evaluation of Nix expressions

  
Area/flakes

   
Area/profiles

profiles: nix-env, nix profile, and installer flavors all alike

  
Area/remote-builds

remote builds

  
Area/repl

nix repl

  
Area/store

libstore and anything else relating to the Nix store

  
bug

it's a bug

  
Cross Compilation

   
devx

development experience issues

  
docs

   
Downstream Dependents

regarding an external tool's usage with Lix (e.g. nix-eval-jobs)

  
E/easy

bug is relatively simple and could simply be fixed with some minor effort

  
E/hard

this issue should probably be solved with close involvement of an expert

  
E/help wanted

maintainers may not get to this soon, but we want it fixed

  
E/reproducible

This bug is reproducible and obvious.

  
E/requires rearchitecture

this bug cannot be fixed properly without fixing a known architectural flaw

  
imported

Issue imported from upstream nix (please do not remove this label, it will cause dupes if import is rerun)

  
Needs Langver

We can't get to this until we implement language versioning

  
OS/Linux

Affects specifically Lix on Linux

  
OS/macOS

Affects specifically Lix on macOS

  
performance

make lix go faster

  
regression

This is a regression since some previous version of Lix

  
release-blocker

Blocks public release

  
RFD

Request for discussion

  
stability

Fixing this makes the software more stable

  
Status
blocked
Blocked on something

  
Status
invalid
not our bug, duplicate, similar

  
Status
postponed
closed but should maybe look at later (generally with S-wontfix)

  
Status
wontfix
We chose not to change this (see issue comments for more detail).

  
testing

Tests that should be added

  
ux

makes the user experience better :)

No labels
Area/build-packaging
Area/evaluator
Area/flakes
Area/profiles
Area/remote-builds
Area/repl
Area/store
bug
Cross Compilation
devx
docs
Downstream Dependents
E/easy
E/hard
E/help wanted
E/reproducible
E/requires rearchitecture
imported
Needs Langver
OS/Linux
OS/macOS
performance
regression
release-blocker
RFD
stability
Status
blocked
Status
invalid
Status
postponed
Status
wontfix
testing
ux
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: lix-project/lix#242
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?