A modern, delicious implementation of the Nix package manager, focused on correctness, usability, and growth — and committed to doing right by its community https://lix.systems
Find a file
Eelco Dolstra 5526a282b5 Security: Don't allow builders to change permissions on files they don't own
It turns out that in multi-user Nix, a builder may be able to do

  ln /etc/shadow $out/foo

Afterwards, canonicalisePathMetaData() will be applied to $out/foo,
causing /etc/shadow's mode to be set to 444 (readable by everybody but
writable by nobody).  That's obviously Very Bad.

Fortunately, this fails in NixOS's default configuration because
/nix/store is a bind mount, so "ln" will fail with "Invalid
cross-device link".  It also fails if hard-link restrictions are
enabled, so a workaround is:

  echo 1 > /proc/sys/fs/protected_hardlinks

The solution is to check that all files in $out are owned by the build
user.  This means that innocuous operations like "ln
${pkgs.foo}/some-file $out/" are now rejected, but that already failed
in chroot builds anyway.
2013-02-26 02:30:19 +01:00
corepkgs corepkgs/fetchurl: Enable making the downloaded file executable 2013-01-21 10:20:52 +01:00
doc Document ‘hashString’ 2013-02-08 20:04:14 +01:00
misc Rename nix-worker to nix-daemon 2012-10-03 17:59:23 -04:00
perl Nix::Store::derivationFromPath: Return derivation outputs 2013-02-05 16:02:57 +01:00
scripts build-remote: Use the --quiet flag 2013-02-19 16:56:31 +01:00
src Security: Don't allow builders to change permissions on files they don't own 2013-02-26 02:30:19 +01:00
tests Rename "hash" to "hashString" and handle SHA-1 2013-02-08 19:36:23 +01:00
.gitignore Rename nix-worker to nix-daemon 2012-10-03 17:59:23 -04:00
AUTHORS * Put something in here. 2004-11-07 20:30:02 +00:00
bootstrap.sh bootstrap: Simplify & make more robust. 2011-09-06 12:11:05 +00:00
build.nix Add an experimental nix-make file 2012-05-21 09:43:01 -04:00
configure.ac Urgggh 2013-01-02 23:52:15 +01:00
COPYING * Change this to LGPL to keep the government happy. 2006-04-25 16:41:06 +00:00
INSTALL * Autoconf / Automake configuration and building. 2003-04-04 16:14:56 +00:00
Makefile.am Fix the tarball build 2012-10-03 21:01:03 -04:00
nix.spec.in Fix RPM build 2012-12-05 23:25:40 +01:00
README * Install documentation in $(docdir) (i.e. share/doc/nix). 2008-11-19 13:19:09 +00:00
release.nix Urgggh 2013-01-02 23:52:15 +01:00
substitute.mk Urgggh 2013-01-02 23:52:15 +01:00
version Bump version number to 1.4 2013-01-07 14:48:44 +01:00

Nix is a purely functional package manager.  For installation and
usage instructions, please read the manual, which can be found in
`docs/manual/manual.html', and additionally at the Nix website at
<http://nixos.org/>.


Acknowledgments

This product includes software developed by the OpenSSL Project for
use in the OpenSSL Toolkit (http://www.OpenSSL.org/).