From eb65b00f1e017203a345766f6af890966bbc7021 Mon Sep 17 00:00:00 2001
From: Steven Allen <steven@stebalien.com>
Date: Thu, 5 Feb 2026 11:45:57 -0800
Subject: [PATCH] nixos/captive-browser: remove the udhcpc setcap wrapper
 fallback

Remove the udhcpc setcap wrapper fallback as it allows any user to
execute arbitrary commands with the `cap_net_raw` capability.

Fixes CVE-2026-25740

https://github.com/NixOS/nixpkgs/security/advisories/GHSA-wc3r-c66x-8xmc
---
 doc/release-notes/rl-2605.section.md       |  2 ++
 nixos/modules/programs/captive-browser.nix | 13 +------------
 2 files changed, 3 insertions(+), 12 deletions(-)

diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index b0d55f8f5022..044ab6eefcdf 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -101,6 +101,8 @@
 - `jetbrains.plugins.addPlugins` no longer supports plugin names or ID strings.
   You can still use `addPlugins` with plugin derivations, such as plugins packaged outside of Nixpkgs.
 
+- The `programs.captive-browser` module no longer falls back on a setcap wrapper around udhcpc to discover your network's DNS server due to [GHSA-wc3r-c66x-8xmc](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-wc3r-c66x-8xmc) (CVE-2026-25740). If you're using this module, you must either configure `programs.captive-browser.dhcp-dns` manually or enable one of NetworkManager, dhcpcd, or systemd-networkd.
+
 - The `services.yggdrasil` module has been refactored with the following breaking changes:
   - The `services.yggdrasil.configFile` option has been removed. Configuration should now be specified directly via `services.yggdrasil.settings`.
   - The `services.yggdrasil.persistentKeys` option has been removed. To maintain persistent keys and IPv6 addresses across reboots, use `services.yggdrasil.settings.PrivateKeyPath` to securely load your private key from a file via systemd credentials. The private key must be in PEM format (PKCS #8).
diff --git a/nixos/modules/programs/captive-browser.nix b/nixos/modules/programs/captive-browser.nix
index 15c4d6237c01..368994e8829f 100644
--- a/nixos/modules/programs/captive-browser.nix
+++ b/nixos/modules/programs/captive-browser.nix
@@ -142,20 +142,9 @@ in
         else if config.networking.useNetworkd then
           "${cfg.package}/bin/systemd-networkd-dns ${iface [ ]}"
         else
-          "${config.security.wrapperDir}/udhcpc --quit --now -f ${iface [ "-i" ]} -O dns --script ${pkgs.writeShellScript "udhcp-script" ''
-            if [ "$1" = bound ]; then
-              echo "$dns"
-            fi
-          ''}"
+          throw "programs.captive-browser.dhcp-dns must be set"
       );
 
-    security.wrappers.udhcpc = {
-      owner = "root";
-      group = "root";
-      capabilities = "cap_net_raw+p";
-      source = "${pkgs.busybox}/bin/udhcpc";
-    };
-
     security.wrappers.captive-browser = mkIf requiresSetcapWrapper {
       owner = "root";
       group = "root";