From 42fee36c0bf90750d21c966dd1ed16a6c09343f6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christina=20S=C3=B8rensen?= Date: Sun, 27 Oct 2024 13:45:02 +0100 Subject: [PATCH 1/2] guix: format with rfc-style MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Christina Sørensen --- pkgs/by-name/gu/guix/package.nix | 76 +++++++++++++++++--------------- 1 file changed, 40 insertions(+), 36 deletions(-) diff --git a/pkgs/by-name/gu/guix/package.nix b/pkgs/by-name/gu/guix/package.nix index 90eb4dfefec4..f05be0f98ce5 100644 --- a/pkgs/by-name/gu/guix/package.nix +++ b/pkgs/by-name/gu/guix/package.nix @@ -1,39 +1,40 @@ -{ lib -, stdenv -, fetchurl -, fetchpatch -, autoreconfHook -, disarchive -, git -, glibcLocales -, guile -, guile-avahi -, guile-gcrypt -, guile-git -, guile-gnutls -, guile-json -, guile-lib -, guile-lzlib -, guile-lzma -, guile-semver -, guile-ssh -, guile-sqlite3 -, guile-zlib -, guile-zstd -, help2man -, makeWrapper -, pkg-config -, po4a -, scheme-bytestructures -, texinfo -, bzip2 -, libgcrypt -, sqlite -, nixosTests +{ + lib, + stdenv, + fetchurl, + fetchpatch, + autoreconfHook, + disarchive, + git, + glibcLocales, + guile, + guile-avahi, + guile-gcrypt, + guile-git, + guile-gnutls, + guile-json, + guile-lib, + guile-lzlib, + guile-lzma, + guile-semver, + guile-ssh, + guile-sqlite3, + guile-zlib, + guile-zstd, + help2man, + makeWrapper, + pkg-config, + po4a, + scheme-bytestructures, + texinfo, + bzip2, + libgcrypt, + sqlite, + nixosTests, -, stateDir ? "/var" -, storeDir ? "/gnu/store" -, confDir ? "/etc" + stateDir ? "/var", + storeDir ? "/gnu/store", + confDir ? "/etc", }: stdenv.mkDerivation rec { @@ -157,7 +158,10 @@ stdenv.mkDerivation rec { changelog = "https://git.savannah.gnu.org/cgit/guix.git/plain/NEWS?h=v${version}"; license = licenses.gpl3Plus; mainProgram = "guix"; - maintainers = with maintainers; [ cafkafk foo-dogsquared ]; + maintainers = with maintainers; [ + cafkafk + foo-dogsquared + ]; platforms = platforms.linux; }; } From 633a3b8f191360638702597c4d4193c85a3be678 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christina=20S=C3=B8rensen?= Date: Sun, 27 Oct 2024 13:57:29 +0100 Subject: [PATCH 2/2] guix: build user takeover patch MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit guix has recently announced a security vulnerability that allows local users to gain priveleges of build users, and further manipulate output of any build (including with setguid). This commit fixes the issue by backporting the remediation commits pushed to guix main to 1.4.0 as a patch. Users will still have to reboot and follow other remediation steps as described in the guix blogpost. Refs: https://guix.gnu.org/en/blog/2024/build-user-takeover-vulnerability/ Signed-off-by: Christina Sørensen --- .../guix/guix-build-user-takeover-fix.patch | 42 +++++++++++++++++++ pkgs/by-name/gu/guix/package.nix | 3 ++ 2 files changed, 45 insertions(+) create mode 100644 pkgs/by-name/gu/guix/guix-build-user-takeover-fix.patch diff --git a/pkgs/by-name/gu/guix/guix-build-user-takeover-fix.patch b/pkgs/by-name/gu/guix/guix-build-user-takeover-fix.patch new file mode 100644 index 000000000000..0e22f0f35042 --- /dev/null +++ b/pkgs/by-name/gu/guix/guix-build-user-takeover-fix.patch @@ -0,0 +1,42 @@ +diff --git a/nix/libstore/build.cc b/nix/libstore/build.cc +index c5383bc..50d1abc 100644 +--- a/nix/libstore/build.cc ++++ b/nix/libstore/build.cc +@@ -2312,15 +2312,6 @@ void DerivationGoal::registerOutputs() + Path actualPath = path; + if (useChroot) { + actualPath = chrootRootDir + path; +- if (pathExists(actualPath)) { +- /* Move output paths from the chroot to the store. */ +- if (buildMode == bmRepair) +- replaceValidPath(path, actualPath); +- else +- if (buildMode != bmCheck && rename(actualPath.c_str(), path.c_str()) == -1) +- throw SysError(format("moving build output `%1%' from the chroot to the store") % path); +- } +- if (buildMode != bmCheck) actualPath = path; + } else { + Path redirected = redirectedOutputs[path]; + if (buildMode == bmRepair +@@ -2360,6 +2351,21 @@ void DerivationGoal::registerOutputs() + something like that. */ + canonicalisePathMetaData(actualPath, buildUser.enabled() ? buildUser.getUID() : -1, inodesSeen); + ++ if (useChroot) { ++ if (pathExists(actualPath)) { ++ /* Now that output paths have been canonicalized (in particular ++ there are no setuid files left), move them outside of the ++ chroot and to the store. */ ++ if (buildMode == bmRepair) ++ replaceValidPath(path, actualPath); ++ else ++ if (buildMode != bmCheck && rename(actualPath.c_str(), path.c_str()) == -1) ++ throw SysError(format("moving build output `%1%' from the chroot to the store") % path); ++ } ++ if (buildMode != bmCheck) actualPath = path; ++ } ++ ++ + /* FIXME: this is in-memory. */ + StringSink sink; + dumpPath(actualPath, sink); diff --git a/pkgs/by-name/gu/guix/package.nix b/pkgs/by-name/gu/guix/package.nix index f05be0f98ce5..5752a45ae635 100644 --- a/pkgs/by-name/gu/guix/package.nix +++ b/pkgs/by-name/gu/guix/package.nix @@ -57,6 +57,9 @@ stdenv.mkDerivation rec { url = "https://git.savannah.gnu.org/cgit/guix.git/patch/?id=ff1251de0bc327ec478fc66a562430fbf35aef42"; hash = "sha256-f4KWDVrvO/oI+4SCUHU5GandkGtHrlaM1BWygM/Qlao="; }) + # manual port of build user takeover remediation commit + # see https://guix.gnu.org/en/blog/2024/build-user-takeover-vulnerability + ./guix-build-user-takeover-fix.patch ]; postPatch = ''