lix/src
Alois Wohlschlager 127ee1a101
libstore/build: use an allowlist approach to syscall filtering
Previously, system call filtering (to prevent builders from storing files with
setuid/setgid permission bits or extended attributes) was performed using a
blocklist. While this looks simple at first, it actually carries significant
security and maintainability risks: after all, the kernel may add new syscalls
to achieve the same functionality one is trying to block, and it can even be
hard to actually add the syscall to the blocklist when building against a C
library that doesn't know about it yet. For a recent demonstration of this
happening in practice to Nix, see the introduction of fchmodat2 [0] [1].

The allowlist approach does not share the same drawback. While it does require
a rather large list of harmless syscalls to be maintained in the codebase,
failing to update this list (and roll out the update to all users) in time has
rather benign effects; at worst, very recent programs that already rely on new
syscalls will fail with an error the same way they would on a slightly older
kernel that doesn't support them yet. Most importantly, no unintended new ways
of performing dangerous operations will be silently allowed.

Another possible drawback is reduced system call performance due to the larger
filter created by the allowlist requiring more computation [2]. However, this
issue has not convincingly been demonstrated yet in practice, for example in
systemd or various browsers. To the contrary, it has been measured that the the
actual filter constructed here has approximately the same overhead as a very
simple filter blocking only one system call.

This commit tries to keep the behavior as close to unchanged as possible. The
system call list is in line with libseccomp 2.5.5 and glibc 2.39, which are the
latest versions at the point of writing. Since libseccomp 2.5.5 is already a
requirement and the distributions shipping this together with older versions of
glibc are mostly not a thing any more, this should not lead to more build
failures any more.

[0] https://github.com/NixOS/nixpkgs/issues/300635
[1] https://github.com/NixOS/nix/issues/10424
[2] https://github.com/flatpak/flatpak/pull/4462#issuecomment-1061690607

Change-Id: I541be3ea9b249bcceddfed6a5a13ac10b11e16ad
2024-07-25 18:24:40 +02:00
..
build-remote build-remote: truncate+hash store URI used in lockfile paths 2024-05-31 12:18:24 +00:00
libcmd language: cleanly ban integer overflows 2024-07-13 00:59:33 +02:00
libexpr Merge "libexpr/gc-alloc: fix compilation with !HAVE_BOEHMGC" into main 2024-07-22 23:14:59 +00:00
libfetchers fix building with Musl, fixing static builds 2024-07-24 17:21:40 +00:00
libmain libutil: make basic loggers thread-safe 2024-07-20 12:33:49 +00:00
libstore libstore/build: use an allowlist approach to syscall filtering 2024-07-25 18:24:40 +02:00
libutil fix building with Musl, fixing static builds 2024-07-24 17:21:40 +00:00
nix Merge changes I8d87c0e9,I25937702 into main 2024-07-15 23:18:03 +00:00
nix-build tree-wide: unify progress bar inactive and paused states 2024-07-01 18:19:34 +02:00
nix-channel util.{hh,cc}: Split out users.{hh,cc} 2024-05-29 11:01:34 +02:00
nix-collect-garbage Fix dry-run flag for nix-collect-garbage 2024-07-09 13:55:05 +00:00
nix-copy-closure Merge pull request #9277 from keszybz/file-permissions 2024-03-04 05:26:17 +01:00
nix-env Use std::strong_ordering for version comparison 2024-07-12 16:48:28 +02:00
nix-instantiate libexpr: pass Exprs as references, not pointers 2024-06-17 19:46:44 +00:00
nix-store libstore: remove WriteConn::sink fields 2024-07-16 00:57:42 +00:00
pch build-time: remove 20% more by PCH'ing C++ stdlib 2024-05-30 21:54:21 +00:00
resolve-system-dependencies remove the autoconf+Make buildsystem 2024-05-07 17:04:30 -06:00
lix-base.pc.in packaging: rename nixexpr -> lixexpr and so on 2024-05-23 16:45:23 -06:00
meson.build meson: implement functional tests 2024-03-27 18:37:50 -06:00