Subject: bug#37744: Per-user profile directory hijack (CVE-2019-17365 for Nix)

From: Ludovic Courtès <[email-masked]>
Date: Wed, 16 Oct 2019 08:57:05 +0200

Hi Tobias,

Tobias Geerinckx-Rice <[email-masked]> skribis:

> No, I ask it nicely: ‘hullo daemon, I'm, er, "ludo"’.
>
> Of course the remote daemon doesn't trust me beyond pre-creating an
> empty per-user directory owned by the local "ludo" user only if such a
> user exists.  It doesn't even report succes or failure to avoid
> leaking valid user names.

Ah you’re right, the worst that can happen is that an empty directory is
created for someone else.  Sounds like a plan.

Ludo’.