GNU bug report logs - #37744
Insecure permissions on /var/guix/profiles/per-user (CVE-2019-18192)

Previous Next

Full log

Message #39 received at 37744 <at> debbugs.gnu.org (full text, mbox):

From: "pelzflorian (Florian Pelz)" <pelzflorian <at> pelzflorian.de>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 37744 <at> debbugs.gnu.org, guix-security <at> gnu.org
Subject: Re: bug#37744: Per-user profile directory hijack (CVE-2019-17365 for
 Nix)
Date: Wed, 16 Oct 2019 16:22:21 +0200

Thank you for ensuring security issues are fixed.

On Wed, Oct 16, 2019 at 12:22:33PM +0200, Ludovic Courtès wrote:
> +This is now fixed by letting @command{guix-daemon} create these directories on
> +behalf of users and removing the world-writable permissions on
> +@code{per-user}.  On multi-user systems, we recommend updating the daemon now.
> +To do that, run @code{sudo guix pull} if you're on a foreign distro, or run
> +@code{sudo guix pull && sudo guix system reconfigure @dots{}} on Guix
> +System.")))

Why sudo guix pull?  It should be without sudo, am I wrong?

I will translate now and submit a patch.

Regards,
Florian

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.