Subject: [PATCH] restrict access to daemon-socket in tests
From: Reepca Russelstein <[email-masked]>
To: [email-masked]
Date: Sun, 20 Oct 2024 18:13:55 -0500
List-Id: <debbugs-submit.debbugs.gnu.org>

In guix-daemons run with --disable-chroot, only trusted users should be
allowed access to the daemon socket, because anyone with access to the
daemon socket in this situation can take control over the build user (or
if there are no build users, the daemon user) by making a builder put a
setuid binary in /tmp.

As I would like to strongly encourage the regular running of 'make
check', it would therefore be good to limit access to the
test-environment daemon's socket.  The attached patch does this by
modifying test-env so that it ensures strict permissions on
$GUIX_STATE_DIRECTORY/daemon-socket.

- reepca

From 2e74d48f103e8561f8099b474faa413483aa6613 Mon Sep 17 00:00:00 2001
Message-ID: <[email-masked]>
From: Reepca Russelstein <[email-masked]>
Date: Sat, 19 Oct 2024 20:48:29 -0500
Subject: [PATCH] build-aux: test-env.in: restrict access to daemon-socket in
 tests.

With the weak isolation available to the test daemon, it is essential to
disallow untrusted access to it, as otherwise another local user can gain our
user's credentials easily.

* build-aux/test-env.in: ensure the daemon-socket directory is freshly-created
  with 0700 permissions.

Change-Id: I742f70fc6fc28e5b4dc88d590eef3daf1b964670
---
 build-aux/test-env.in | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/build-aux/test-env.in b/build-aux/test-env.in
index ca786437e9..9caa29da58 100644
--- a/build-aux/test-env.in
+++ b/build-aux/test-env.in
@@ -97,7 +97,12 @@ then
         GUIX_ALLOW_UNAUTHENTICATED_SUBSTITUTES			\
         GUIX_CONFIGURATION_DIRECTORY XDG_CACHE_HOME
 
+    # Create a fresh directory with restrictive permissions so that our test
+    # daemon's weak isolation can't be exploited by other users
+    rm -rf "$GUIX_STATE_DIRECTORY/daemon-socket"
+    mkdir -m 0700 "$GUIX_STATE_DIRECTORY/daemon-socket"
+
     # Launch the daemon without chroot support because is may be
     # unavailable, for instance if we're not running as root.
     "@abs_top_builddir@/pre-inst-env"				\

-- 
2.45.2