Eelco Dolstra 5526a282b5 Security: Don't allow builders to change permissions on files they don't own ... It turns out that in multi-user Nix, a builder may be able to do ln /etc/shadow $out/foo Afterwards, canonicalisePathMetaData() will be applied to $out/foo, causing /etc/shadow's mode to be set to 444 (readable by everybody but writable by nobody). That's obviously Very Bad. Fortunately, this fails in NixOS's default configuration because /nix/store is a bind mount, so "ln" will fail with "Invalid cross-device link". It also fails if hard-link restrictions are enabled, so a workaround is: echo 1 > /proc/sys/fs/protected_hardlinks The solution is to check that all files in $out are owned by the build user. This means that innocuous operations like "ln ${pkgs.foo}/some-file $out/" are now rejected, but that already failed in chroot builds anyway.		2013-02-26 02:30:19 +01:00
..
build.cc	Security: Don't allow builders to change permissions on files they don't own	2013-02-26 02:30:19 +01:00
derivations.cc	Only substitute wanted outputs of a derivation	2012-11-26 17:15:09 +01:00
derivations.hh	Only substitute wanted outputs of a derivation	2012-11-26 17:15:09 +01:00
gc.cc	Delete a left-over trash directory before doing a GC	2013-01-05 00:13:29 +01:00
globals.cc	Add `Settings::nixDaemonSocketFile'.	2013-02-19 10:19:18 +01:00
globals.hh	Add `Settings::nixDaemonSocketFile'.	2013-02-19 10:19:18 +01:00
local-store.cc	Security: Don't allow builders to change permissions on files they don't own	2013-02-26 02:30:19 +01:00
local-store.hh	Security: Don't allow builders to change permissions on files they don't own	2013-02-26 02:30:19 +01:00
Makefile.am	Add builtin constants ‘langVersion’ and ‘nixVersion’	2012-11-27 13:29:55 +01:00
misc.cc	nix-store -q --roots: Respect the gc-keep-outputs/gc-keep-derivations settings	2012-12-20 18:41:44 +01:00
misc.hh	nix-store -q --roots: Respect the gc-keep-outputs/gc-keep-derivations settings	2012-12-20 18:41:44 +01:00
optimise-store.cc	Security: Don't allow builders to change permissions on files they don't own	2013-02-26 02:30:19 +01:00
pathlocks.cc	Set the close-on-exec flag on file descriptors	2012-03-05 20:29:00 +01:00
pathlocks.hh	Use "#pragma once" to prevent repeated header file inclusion	2012-07-18 14:59:03 -04:00
references.cc	Use data() instead of c_str() where appropriate	2012-02-09 18:27:45 +01:00
references.hh	Use "#pragma once" to prevent repeated header file inclusion	2012-07-18 14:59:03 -04:00
remote-store.cc	Add `Settings::nixDaemonSocketFile'.	2013-02-19 10:19:18 +01:00
remote-store.hh	nix-store -q --roots: Respect the gc-keep-outputs/gc-keep-derivations settings	2012-12-20 18:41:44 +01:00
schema.sql	* Store the size of a store path in the database (to be precise, the	2010-11-16 17:11:46 +00:00
store-api.cc	Merge branch 'master' into no-manifests	2012-08-27 11:09:07 -04:00
store-api.hh	nix-store -q --roots: Respect the gc-keep-outputs/gc-keep-derivations settings	2012-12-20 18:41:44 +01:00
worker-protocol.hh	Add `Settings::nixDaemonSocketFile'.	2013-02-19 10:19:18 +01:00