A modern, delicious implementation of the Nix package manager, focused on correctness, usability, and growth — and committed to doing right by its community https://lix.systems
Find a file
alois31 127ee1a101
libstore/build: use an allowlist approach to syscall filtering
Previously, system call filtering (to prevent builders from storing files with
setuid/setgid permission bits or extended attributes) was performed using a
blocklist. While this looks simple at first, it actually carries significant
security and maintainability risks: after all, the kernel may add new syscalls
to achieve the same functionality one is trying to block, and it can even be
hard to actually add the syscall to the blocklist when building against a C
library that doesn't know about it yet. For a recent demonstration of this
happening in practice to Nix, see the introduction of fchmodat2 [0] [1].

The allowlist approach does not share the same drawback. While it does require
a rather large list of harmless syscalls to be maintained in the codebase,
failing to update this list (and roll out the update to all users) in time has
rather benign effects; at worst, very recent programs that already rely on new
syscalls will fail with an error the same way they would on a slightly older
kernel that doesn't support them yet. Most importantly, no unintended new ways
of performing dangerous operations will be silently allowed.

Another possible drawback is reduced system call performance due to the larger
filter created by the allowlist requiring more computation [2]. However, this
issue has not convincingly been demonstrated yet in practice, for example in
systemd or various browsers. To the contrary, it has been measured that the the
actual filter constructed here has approximately the same overhead as a very
simple filter blocking only one system call.

This commit tries to keep the behavior as close to unchanged as possible. The
system call list is in line with libseccomp 2.5.5 and glibc 2.39, which are the
latest versions at the point of writing. Since libseccomp 2.5.5 is already a
requirement and the distributions shipping this together with older versions of
glibc are mostly not a thing any more, this should not lead to more build
failures any more.

[0] https://github.com/NixOS/nixpkgs/issues/300635
[1] https://github.com/NixOS/nix/issues/10424
[2] https://github.com/flatpak/flatpak/pull/4462#issuecomment-1061690607

Change-Id: I541be3ea9b249bcceddfed6a5a13ac10b11e16ad
2024-07-25 18:24:40 +02:00
.github .github: clean up stale things and wrong references 2024-06-12 15:34:23 -07:00
bench Add benchmarking scripts 2024-04-08 19:50:24 -07:00
clang-tidy clang-tidy: work with angle brackets and external projects 2024-05-24 02:22:58 +00:00
contrib function-trace: always show the trace 2019-09-18 23:23:21 +02:00
doc Merge changes Id8b3d289,Ib75ab5b8,I3792eeb3 into main 2024-07-19 18:52:46 +00:00
lix-doc lix-doc: update dependencies and refactor 2024-07-10 02:25:48 +00:00
maintainers libstore/build: use an allowlist approach to syscall filtering 2024-07-25 18:24:40 +02:00
meson libexpr: rewrite the parser with pegtl instead of flex/bison 2024-06-25 12:24:58 +00:00
misc De-vendor nixfmt 2024-07-22 21:09:58 +04:00
nix-support De-vendor nixfmt 2024-07-22 21:09:58 +04:00
perl libutil: allow draining Generator<Bytes> into sinks 2024-07-03 11:46:53 +00:00
releng doc/release-notes: link the upcoming release notes again 2024-07-17 22:12:41 +00:00
scripts remove the autoconf+Make buildsystem 2024-05-07 17:04:30 -06:00
src libstore/build: use an allowlist approach to syscall filtering 2024-07-25 18:24:40 +02:00
subprojects/aws_sdk build: fix static aws-cpp-sdk 2024-05-30 00:40:25 -06:00
tests libstore/build: use an allowlist approach to syscall filtering 2024-07-25 18:24:40 +02:00
.clang-format Add pre-commit checks 2024-03-29 22:57:40 -07:00
.clang-tidy Add basic clang-tidy config 2024-03-29 20:26:38 -07:00
.dir-locals.el .dir-locals.el: Set c-block-comment-prefix 2020-07-10 11:21:06 +02:00
.editorconfig add editorconfig for markdown 2024-05-24 02:22:44 +00:00
.envrc .envrc: remove MAKEFLAGS and use clang environment by default 2024-06-25 12:36:18 -06:00
.gitignore Put into place initial release engineering 2024-06-06 20:53:08 -07:00
.this-is-lix devShell: guard against running from another directory 2024-06-24 13:41:38 -07:00
CONTRIBUTING.md chore: re-work the contribution guide 2024-05-07 01:28:35 +00:00
COPYING Add pre-commit checks 2024-03-29 22:57:40 -07:00
default.nix Format Nix code with nixfmt 2024-04-08 13:00:00 -07:00
docker.nix releng: support multiarch docker images 2024-06-09 20:33:24 -07:00
flake.lock [resubmit] flake: update nixpkgs pin 23.11->24.05 (+ boehmgc compat changes) 2024-06-12 15:34:22 -07:00
flake.nix libstore/build: use an allowlist approach to syscall filtering 2024-07-25 18:24:40 +02:00
justfile justfile: accept extra options to just setup and pass them to meson 2024-06-24 13:37:01 -07:00
meson.build libstore: Add FreeBSD findPlatformRoots 2024-07-23 17:49:33 +00:00
meson.options build: expose option to enable or disable precompiled std headers 2024-06-06 12:46:26 -06:00
package.nix libstore/build: use an allowlist approach to syscall filtering 2024-07-25 18:24:40 +02:00
README.md chore: rebrand Nix to Lix when it makes sense 2024-06-01 20:31:24 +02:00
shell.nix shell.nix: conform to documentation 2024-05-27 16:47:40 +02:00
treefmt.toml Format Nix code with nixfmt 2024-04-08 13:00:00 -07:00
version.json version: update to 2.91-dev for main 2024-06-15 18:46:18 -07:00

Lix

Lix is an implementation of Nix, a powerful package management system for Linux and other Unix systems that makes package management reliable and reproducible.

Read more about us at https://lix.systems.

Installation

On Linux and macOS the easiest way to install Lix is to run the following shell command (as a user other than root):

$ curl -sSf -L https://install.lix.systems/lix | sh -s -- install

For systems that already have a Nix implementation installed, such as NixOS systems, read our install page

Building And Developing

See our Hacking guide in our manual for instruction on how to to set up a development environment and build Lix from source.

Additional Resources

License

Lix is released under the LGPL v2.1.