Security: sandbox escape #426

New issue

Closed

opened 2024-06-27 15:54:57 +00:00 by roberth · 5 comments

roberth commented

2024-06-27 15:54:57 +00:00

With the Nix team we've posted a fix for a sandbox escape vulnerability.
Next time I'd like to coordinate this with you. Perhaps we could set up a private matrix room for this purpose?
Also I couldn't find anything about reporting security issues just now; we provide a security policy through GitHub's UI, so you could perhaps do something similar here, or work around a missing feature with an issue template that contains it.

With the Nix team we've posted a fix for [a sandbox escape vulnerability](https://discourse.nixos.org/t/security-fix-nix-derivation-sandbox-escape/47778). Next time I'd like to coordinate this with you. Perhaps we could set up a private matrix room for this purpose? Also I couldn't find anything about reporting security issues just now; we provide a security policy through GitHub's UI, so you could perhaps do something similar here, or work around a missing feature with an issue template that contains it.

roberth commented

2024-06-27 15:57:59 +00:00

Author

In fact, let me apologize for failing to coordinate anything with you this first time.

lunaphied commented

2024-07-07 20:29:36 +00:00

Owner

We (Lix) provide a security contact email of security@lix.systems (that address is from memory so someone might have to correct us on the precise address). However I'm not sure where (or if) this is documented anywhere. Providing a formal documentation of our security policy is a TODO that needs to be rectified though.

We (Lix) provide a security contact email of `security@lix.systems` (that address is from memory so someone might have to correct us on the precise address). However I'm not sure where (or if) this is documented anywhere. Providing a formal documentation of our security policy is a TODO that needs to be rectified though.

jade commented

2024-07-11 11:00:12 +00:00

Owner

It's on the website. We should probably do something about this bug, since @emilylange fixed the bugs in the patch.

emilylange commented

2024-07-11 12:42:09 +00:00

Member

since @emilylange fixed the bugs in the patch.

Thanks for the ping @jade, but I wasn't involved it this at all 🫣

Maybe you intended to ping a different username?

> since @emilylange fixed the bugs in the patch. Thanks for the ping @jade, but I wasn't involved it this at all 🫣 Maybe you intended to ping a different username?

jade self-assigned this 2024-08-09 23:10:43 +00:00

jade commented

2024-08-10 02:14:04 +00:00

Owner

Our own security response to this was extremely lacklustre nonetheless, and we did not clearly communicate amongst ourselves or to others what the status of this bug is.

I would be more inclined to pick the patches if they had less apparent regression potential, such as the way they broke the macOS sandbox, and if it were more clear which commits are actually the security patch.

It appears that the way that the GitHub tooling works greatly obscures which commits are related to the patch and its subsequent fixup by emilazy.

Also, the added test would not work on Lix since we block fchmodat2 having setuid mode flags, so I have to figure out how to even port that, if at all.

I believe that Lix is not vulnerable to this issue because we have a hard requirement that seccomp on Linux is fully set up, so there is no way to produce a setuid binary and thus no way to obtain execution as the build user. I nevertheless intend to move the build directories to be more secure, in the future, after 2.91. Our own security response to this was extremely lacklustre nonetheless, and we did not clearly communicate amongst ourselves or to others what the status of this bug is. I would be more inclined to pick the patches if they had less apparent regression potential, such as the way they broke the macOS sandbox, and if it were more clear which commits are actually the security patch. It appears that the way that the GitHub tooling works greatly obscures which commits are related to the patch and its subsequent fixup by emilazy. Also, the added test would not work on Lix since we block fchmodat2 having setuid mode flags, so I have to figure out how to even port that, if at all.

jade closed this issue

2024-09-26 00:41:55 +00:00