GNU bug report logs - #37744
Insecure permissions on /var/guix/profiles/per-user (CVE-2019-18192)

Previous Next

Full log

View this message in rfc822 format

From: Ludovic Courtès <ludo <at> gnu.org>
To: 37744 <at> debbugs.gnu.org
Cc: GNU Guix maintainers <guix-maintainers <at> gnu.org>, guix-security <at> gnu.org
Subject: bug#37744: Per-user profile directory hijack (CVE-2019-17365 for Nix)
Date: Mon, 14 Oct 2019 09:58:47 +0200

Ludovic Courtès <ludo <at> gnu.org> skribis:

> Looks like we’ll need to do something similar to:
> <https://github.com/NixOS/nix/pull/3136/commits/5a303093dcae1e5ce9212616ef18f2ca51020b0d>.

Compared to the Nix build daemon, our daemon can accept connections over
TCP in addition to Unix-domain sockets, so the bit that does:

  store->createUser(userName, userId);

won’t work in that context (it would create ‘per-user/root’.)

I don’t see how to let the daemon create ‘per-user/$USER’ on behalf of
the client for clients connecting over TCP.  Or we’d need to add a
challenge mechanism or authentication.

Thoughts?

Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.