lix-project/lix

Fork 59

Consider nesting the build directory in a not world-executable directory #919

New issue

Closed

opened 2025-07-16 04:54:11 +00:00 by alois31 · 6 comments

alois31 commented

2025-07-16 04:54:11 +00:00

Member

Describe the bug

Due to all parent directories of the build directory being world-executable, derivations can make their build directory world-writable. This allows other users to place unwanted files there, including AF_UNIX sockets which we probably don't want, similarly to the abstract sockets that are now blocked due to the network namespacing.

Steps To Reproduce

nix build --impure --expr '(import <nixpkgs> {}).runCommand "meow" {} "chmod 777 /build; sleep inf"'
Observe that the directory /nix/var/nix/builds/nix-build-meow.drv-0 is world-writable

Expected behavior

The build directory should not be world-writable, probably best using an intermediate directory with 700 permission.

`nix --version` output

nix (Lix, like Nix) 2.94.0-dev
System type: x86_64-linux
Additional system types: i686-linux, x86_64-v1-linux, x86_64-v2-linux, x86_64-v3-linux
Features: gc, signed-caches
System configuration file: /etc/nix/nix.conf
User configuration files: /home/aloisw/.config/nix/nix.conf:/etc/xdg/nix/nix.conf:/home/aloisw/.local/share/flatpak/exports/etc/xdg/nix/nix.conf:/var/lib/flatpak/exports/etc/xdg/nix/nix.conf:/home/aloisw/.nix-profile/etc/xdg/nix/nix.conf:/nix/profile/etc/xdg/nix/nix.conf:/home/aloisw/.local/state/nix/profile/etc/xdg/nix/nix.conf:/etc/profiles/per-user/aloisw/etc/xdg/nix/nix.conf:/nix/var/nix/profiles/default/etc/xdg/nix/nix.conf:/run/current-system/sw/etc/xdg/nix/nix.conf
Store directory: /nix/store
State directory: /nix/var/nix
Data directory: /nix/store/0f4j1zqffzg63746jgxi68g2g012wf15-lix-2.94.0-pre-20250713_2090853b8026/share

Additional context

Cppnix did this to make CVE-2024-38531 not exploitable due to lacking the allowlist sandbox (although apparently there might now be a way around that too?): github.com/NixOS/nix@1d3696f0fb, github.com/NixOS/nix@ede95b1fc1. However this has caused several regressions (keep-failed not working properly, build directory not being cleaned up, Darwin breakage) which we should avoid.

## Describe the bug Due to all parent directories of the build directory being world-executable, derivations can make their build directory world-writable. This allows other users to place unwanted files there, including AF_UNIX sockets which we probably don't want, similarly to the abstract sockets that are now blocked due to the network namespacing. ## Steps To Reproduce 1. `nix build --impure --expr '(import <nixpkgs> {}).runCommand "meow" {} "chmod 777 /build; sleep inf"'` 2. Observe that the directory /nix/var/nix/builds/nix-build-meow.drv-0 is world-writable ## Expected behavior The build directory should not be world-writable, probably best using an intermediate directory with 700 permission. ## `nix --version` output nix (Lix, like Nix) 2.94.0-dev System type: x86_64-linux Additional system types: i686-linux, x86_64-v1-linux, x86_64-v2-linux, x86_64-v3-linux Features: gc, signed-caches System configuration file: /etc/nix/nix.conf User configuration files: /home/aloisw/.config/nix/nix.conf:/etc/xdg/nix/nix.conf:/home/aloisw/.local/share/flatpak/exports/etc/xdg/nix/nix.conf:/var/lib/flatpak/exports/etc/xdg/nix/nix.conf:/home/aloisw/.nix-profile/etc/xdg/nix/nix.conf:/nix/profile/etc/xdg/nix/nix.conf:/home/aloisw/.local/state/nix/profile/etc/xdg/nix/nix.conf:/etc/profiles/per-user/aloisw/etc/xdg/nix/nix.conf:/nix/var/nix/profiles/default/etc/xdg/nix/nix.conf:/run/current-system/sw/etc/xdg/nix/nix.conf Store directory: /nix/store State directory: /nix/var/nix Data directory: /nix/store/0f4j1zqffzg63746jgxi68g2g012wf15-lix-2.94.0-pre-20250713_2090853b8026/share ## Additional context Cppnix did this to make CVE-2024-38531 not exploitable due to lacking the allowlist sandbox (although apparently there might now be a way around that too?): https://github.com/NixOS/nix/commit/1d3696f0fb88d610abc234a60e0d6d424feafdf1, https://github.com/NixOS/nix/commit/ede95b1fc133bd1d8eabc862f2e3e03c024cb7550. However this has caused several regressions ([keep-failed not working properly](https://github.com/NixOS/nix/commit/ebebe626ff4ec6da98c0a043c64b35efe1c05bc3), [build directory not being cleaned up](https://github.com/NixOS/nix/commit/76e4adfaac3083056e79b518ccc197a7645a0f2d), [Darwin breakage](https://github.com/NixOS/nix/commit/af2e1142b17dadf24a0b66d8973033dce6efa32b)) which we should avoid.

alois31 added the

bug

label

2025-07-16 04:54:11 +00:00

pennae commented

2025-07-16 08:17:04 +00:00

Owner

The build directory should not be world-writable, probably best using an intermediate directory with 700 permission.

that's only possible for linux-sandboxed builds due to filesystem namespacing. without namespacing all intermediates must be executable by the build user, otherwise everything breaks. the best we could do for those cases is to make the intermediate directory 750 owned by daemon user and build user group.

> The build directory should not be world-writable, probably best using an intermediate directory with 700 permission. that's only possible for linux-sandboxed builds due to filesystem namespacing. without namespacing all intermediates must be executable by the build user, otherwise everything breaks. the best we could do for those cases is to make the intermediate directory 750 owned by daemon user and build user group.

alois31 commented

2025-07-16 16:17:07 +00:00

Author

Member

You're right, that was actually the first regression they fixed but I overlooked it. They didn't do 750 but skipped the intermediate directory entirely without sandboxing. 700 but owned by the build user could work as well I guess. It probably doesn't really matter because with sandboxing disabled you can already place builder-accessible sockets anywhere you want.

You're right, that was actually the [first regression they fixed](https://github.com/NixOS/nix/commit/d54590fdf328ea2764cf79fcba72cbf091b38acf) but I overlooked it. They didn't do 750 but skipped the intermediate directory entirely without sandboxing. 700 but owned by the build user could work as well I guess. It probably doesn't really matter because with sandboxing disabled you can already place builder-accessible sockets anywhere you want.

jade commented

2025-07-16 17:21:08 +00:00

Owner

750 would still not fix it though, right? because nixbld could still do the connecting shenanigans.

alois31 commented

2025-07-16 17:43:51 +00:00

Author

Member

That would only be in the non-sandbox case. Sandboxed builds would get 700 root.

pennae commented

2025-07-16 18:04:23 +00:00

Owner

even in the sandboxed case we'd set the intermediate mode to 0710 just to keep the branch count low. darwin sandboxed builds still need it at 0710, and since linux sandbox builds are completely isolated from another anyway it seems a bit unnecessary to set g-x there.

lix-bot commented

2025-07-16 23:02:29 +00:00

Member

This issue was mentioned on Gerrit on the following CLs:

commit message in cl/3673 ("libstore: add intermediate directory to build-dirs")
commit message in cl/3675 ("libstore: add intermediate directory to build-dirs")
commit message in cl/3677 ("libstore: add intermediate directory to build-dirs")
commit message in cl/3680 ("libstore: add intermediate directory to build-dirs")

This issue was mentioned on Gerrit on the following CLs: * commit message in [cl/3673](https://gerrit.lix.systems/c/lix/+/3673) ("libstore: add intermediate directory to build-dirs") * commit message in [cl/3675](https://gerrit.lix.systems/c/lix/+/3675) ("libstore: add intermediate directory to build-dirs") * commit message in [cl/3677](https://gerrit.lix.systems/c/lix/+/3677) ("libstore: add intermediate directory to build-dirs") * commit message in [cl/3680](https://gerrit.lix.systems/c/lix/+/3680) ("libstore: add intermediate directory to build-dirs")