Eelco Dolstra 5526a282b5 Security: Don't allow builders to change permissions on files they don't own ... It turns out that in multi-user Nix, a builder may be able to do ln /etc/shadow $out/foo Afterwards, canonicalisePathMetaData() will be applied to $out/foo, causing /etc/shadow's mode to be set to 444 (readable by everybody but writable by nobody). That's obviously Very Bad. Fortunately, this fails in NixOS's default configuration because /nix/store is a bind mount, so "ln" will fail with "Invalid cross-device link". It also fails if hard-link restrictions are enabled, so a workaround is: echo 1 > /proc/sys/fs/protected_hardlinks The solution is to check that all files in $out are owned by the build user. This means that innocuous operations like "ln ${pkgs.foo}/some-file $out/" are now rejected, but that already failed in chroot builds anyway.		2013-02-26 02:30:19 +01:00
..
dotgraph.cc	Comment out dead code in `nix-store'.	2010-05-31 16:36:20 +00:00
dotgraph.hh	Use "#pragma once" to prevent repeated header file inclusion	2012-07-18 14:59:03 -04:00
Makefile.am	When ‘--help’ is given, just run ‘man’ to show the manual page	2012-10-03 16:40:09 -04:00
nix-store.cc	Security: Don't allow builders to change permissions on files they don't own	2013-02-26 02:30:19 +01:00
xmlgraph.cc	Add XML output to `nix-store'.	2010-05-31 16:36:24 +00:00
xmlgraph.hh	Use "#pragma once" to prevent repeated header file inclusion	2012-07-18 14:59:03 -04:00