gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
501,609 Commits 9 Branches 0 Tags
0e4b8a05b2ede5f29cb19eb790623262bd18c8d9
Commit Graph
501609 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Guillaume Girol 0e4b8a05b2 nixos/wrappers: allow setuid and setgid wrappers to run in user namespaces 
In user namespaces where an unprivileged user is mapped as root and root
is unmapped, setuid bits have no effect. However setuid root
executables like mount are still usable *in the namespace* as the user
already has the required privileges. This commit detects the situation
where the wrapper gained no privileges that the parent process did not
already have and in this case does less sanity checking. In short there
is no need to be picky since the parent already can execute the foo.real
executable themselves.

Details:
man 7 user_namespaces:
   Set-user-ID and set-group-ID programs
       When a process inside a user namespace executes a set-user-ID
       (set-group-ID) program, the process's effective user (group) ID
       inside the namespace is changed to whatever value is mapped for
       the user (group) ID of the file.  However, if either the user or
       the group ID of the file has no mapping inside the namespace, the
       set-user-ID (set-group-ID) bit is silently ignored: the new
       program is executed, but the process's effective user (group) ID
       is left unchanged.  (This mirrors the semantics of executing a
       set-user-ID or set-group-ID program that resides on a filesystem
       that was mounted with the MS_NOSUID flag, as described in
       mount(2).)

The effect of the setuid bit is that the real user id is preserved and
the effective and set user ids are changed to the owner of the wrapper.
We detect that no privilege was gained by checking that euid == suid
== ruid. In this case we stop checking that euid == owner of the
wrapper file.

As a reminder here are the values of euid, ruid, suid, stat.st_uid and
stat.st_mode & S_ISUID in various cases when running a setuid 42 executable as user 1000:

Normal case:
ruid=1000 euid=42 suid=42
setuid=2048, st_uid=42

nosuid mount:
ruid=1000 euid=1000 suid=1000
setuid=2048, st_uid=42

inside unshare -rm:
ruid=0 euid=0 suid=0
setuid=2048, st_uid=65534

inside unshare -rm, on a suid mount:
ruid=0 euid=0 suid=0
setuid=2048, st_uid=65534
 2023-08-09 12:00:00 +00:00
Maximilian BoschandGitHub f292b4964c Merge pull request #241693 from SuperSandro2000/matrix-synapse 
matrix-synapse: 1.86.0 -> 1.87.0
 2023-07-05 22:58:20 +02:00
Felix BühlerandGitHub b0cb93a3b3 Merge pull request #241278 from figsoda/argc 
argc: 1.6.0 -> 1.7.0
 2023-07-05 22:56:40 +02:00
JanikandGitHub 387bf208c8 Merge pull request #241675 from meppu/deno 2023-07-05 22:55:12 +02:00
Felix BühlerandGitHub abcf91eae4 Merge pull request #241456 from jopejoe1/noto 
noto-fonts: 23.5.1 -> 23.7.1
 2023-07-05 22:49:45 +02:00
Felix BühlerandGitHub 0ed080c913 Merge pull request #241525 from JulienMalka/ferretdb-bump 
ferretdb: 1.4.0 -> 1.5.0
 2023-07-05 22:49:20 +02:00
figsodaandGitHub 4515c5451c Merge pull request #241743 from r-ryantm/auto-update/eksctl 
eksctl: 0.146.0 -> 0.147.0
 2023-07-05 16:45:59 -04:00
Fabian AffolterandGitHub f7ce6cb355 Merge pull request #241653 from fabaff/jsonref-bump 
python311Packages.jsonref: 1.0.1 -> 1.1.0
 2023-07-05 22:39:43 +02:00
Fabian AffolterandGitHub a721896c2b Merge pull request #241621 from fabaff/html-sanitizer-bump 
python311Packages.html-sanitizer: 2.1 -> 2.2
 2023-07-05 22:39:03 +02:00
Fabian AffolterandGitHub 9113aea282 Merge pull request #241627 from fabaff/wpscan-bump 
wpscan: 3.8.22 -> 3.8.24
 2023-07-05 22:38:39 +02:00
Fabian AffolterandGitHub 9d86226a63 Merge pull request #241640 from fabaff/configargparse-bump 
python311Packages.configargparse: 1.5.3 -> 1.5.5
 2023-07-05 22:38:18 +02:00
Fabian AffolterandGitHub 8b8b8e9385 Merge pull request #241643 from fabaff/cloudsmith-api-bump 
python311Packages.cloudsmith-api: 2.0.2 -> 2.0.7
 2023-07-05 22:38:04 +02:00
Fabian AffolterandGitHub 8156792f65 Merge pull request #241649 from fabaff/hvac-bump 
python311Packages.hvac: 1.1.0 -> 1.1.1
 2023-07-05 22:37:55 +02:00
Fabian AffolterandGitHub 37a58d115c Merge pull request #241615 from fabaff/pynws-bump 
python311Packages.pynws: 1.4.1 -> 1.5.0
 2023-07-05 22:37:16 +02:00
Fabian AffolterandGitHub 120b02864b Merge pull request #241614 from fabaff/zamg-bump 
python311Packages.zamg: 0.2.3 -> 0.2.4
 2023-07-05 22:37:05 +02:00
Fabian AffolterandGitHub f96db75c44 Merge pull request #241613 from fabaff/ssdp-bump 
python311Packages.ssdp: 1.2.0 -> 1.3.0
 2023-07-05 22:36:44 +02:00
Fabian AffolterandGitHub b9d521d970 Merge pull request #241611 from fabaff/mechanicalsoup-bump 
python311Packages.mechanicalsoup: 1.2.0 -> 1.3.0
 2023-07-05 22:36:26 +02:00
Fabian AffolterandGitHub 1e3768932b Merge pull request #241610 from fabaff/checkov-bump 
checkov: 2.3.309 -> 2.3.311
 2023-07-05 22:36:05 +02:00
Fabian AffolterandGitHub c1eac078ff Merge pull request #241608 from fabaff/mitmproxy2swagger-bump 
mitmproxy2swagger: 0.10.0 -> 0.10.1
 2023-07-05 22:35:54 +02:00
Fabian AffolterandGitHub ea1dd1e054 Merge pull request #241607 from fabaff/fakeredis-bump 
python311Packages.fakeredis: 2.15.0 -> 2.16.0
 2023-07-05 22:35:45 +02:00
Fabian AffolterandGitHub 78ef58eca4 Merge pull request #241624 from fabaff/mypy-boto3-ebs-bump 
python311Packages.mypy-boto3-ebs: 1.26.0 -> 1.27.0
 2023-07-05 22:35:12 +02:00
Fabian AffolterandGitHub 00a3f60340 Merge pull request #241623 from fabaff/seatconnect-bump 
python311Packages.seatconnect: 1.1.6 -> 1.1.7
 2023-07-05 22:35:04 +02:00
Fabian AffolterandGitHub cb83e094bc Merge pull request #241618 from fabaff/meilisearch-bump 
python311Packages.meilisearch: 0.28.0 -> 0.28.1
 2023-07-05 22:34:44 +02:00
Fabian AffolterandGitHub 9b122c954c Merge pull request #241616 from fabaff/pontos-bump 
python311Packages.pontos: 23.7.0 -> 23.7.2
 2023-07-05 22:34:26 +02:00
Fabian AffolterandGitHub b901f36213 Merge pull request #241617 from fabaff/policyuniverse-bump 
python311Packages.policyuniverse: 1.5.1.20230608 -> 1.5.1.20230703
 2023-07-05 22:34:16 +02:00
Fabian AffolterandGitHub 9e40c1a47d Merge pull request #241622 from fabaff/sqlalchemy-mixins-bump 
python311Packages.sqlalchemy-mixins: 2.0.1 -> 2.0.3
 2023-07-05 22:34:00 +02:00
Fabian AffolterandGitHub 3cc4689339 Merge pull request #235848 from fabaff/prometheus-client-bump 
python310Packages.prometheus-client: 0.16.0 -> 0.17.0
 2023-07-05 22:33:21 +02:00
Ilan JoselevichandGitHub 08c696c8d7 Merge pull request #241712 from figsoda/overrides 
vimPlugins: clean up overrides
 2023-07-05 23:05:28 +03:00
Martin WeineltandGitHub d98ebdce38 Merge pull request #241742 from fabaff/update-component-packages 
home-assistant: update component-packages
 2023-07-05 22:04:19 +02:00
teutat3sandYureka 23de9f3b56 electron_25-bin: 25.1.1 -> 25.2.0 
https://github.com/electron/electron/releases/tag/v25.2.0
 2023-07-05 21:25:23 +02:00
teutat3sandYureka d05f851f77 electron_24-bin: 24.4.1 -> 24.5.1 
https://github.com/electron/electron/releases/tag/v24.6.0
https://github.com/electron/electron/releases/tag/v24.6.1
 2023-07-05 21:25:23 +02:00
teutat3sandYureka 47dc06c07e electron_23-bin: 23.3.7 -> 23.3.9 
https://github.com/electron/electron/releases/tag/v23.3.8
https://github.com/electron/electron/releases/tag/v23.3.9
 2023-07-05 21:25:23 +02:00
teutat3sandYureka f9a0d8ce77 electron_22-bin: 22.3.13 -> 22.3.15 
https://github.com/electron/electron/releases/tag/v22.3.14
https://github.com/electron/electron/releases/tag/v22.3.15
 2023-07-05 21:25:23 +02:00
Rick van SchijndelandGitHub 66591331b3 Merge pull request #227720 from amjoseph-nixpkgs/pr/chromium/cross/use-wrapper 
chromium: (cross): use cc-wrapper-clang instead of bare clang
 2023-07-05 21:06:03 +02:00
figsodaandGitHub 2704517829 Merge pull request #241725 from r-ryantm/auto-update/moon 
moon: 1.9.1 -> 1.9.2
 2023-07-05 15:03:21 -04:00
Weijia WangandGitHub c7a47f4f38 Merge pull request #241663 from wegank/numcodecs-avx2 
python310Packages.numcodecs: condition avx2 support
 2023-07-05 21:55:56 +03:00
K900andGitHub cd3f496d8b Merge pull request #241744 from K900/grub-oof 
nixos/iso-image: fix syntax
 2023-07-05 21:50:13 +03:00
K900 db9b857e1d nixos/iso-image: fix syntax 2023-07-05 21:49:03 +03:00
Weijia WangandGitHub bbddf19959 Merge pull request #241677 from wegank/partio-refactor 
partio: 1.17.0 -> 1.17.1
 2023-07-05 21:45:51 +03:00
R. Ryantm f3b63e8db0 eksctl: 0.146.0 -> 0.147.0 2023-07-05 18:41:40 +00:00
Fabian Affolter 5d03bfae2d home-assistant: update component-packages 2023-07-05 20:41:36 +02:00
Fabian AffolterandGitHub b61459af7f Merge pull request #241625 from fabaff/angr-bump 
python311Packages.angr: 9.2.57 -> 9.2.58
 2023-07-05 20:31:01 +02:00
Christina SørensenandAnderson Torres 75c672ac23 kamilalisp: 0.2 -> 0.2p 
bug fix release

Changelog: https://github.com/kspalaiologos/kamilalisp/releases/tag/v0.2p
 2023-07-05 15:29:27 -03:00
Sandro JäckelandAnderson Torres 948d08a1f1 vlc: disable parallel installing 
due to race condition on high core machines
 2023-07-05 15:16:36 -03:00
R. Ryantm ce771049d2 moon: 1.9.1 -> 1.9.2 2023-07-05 17:39:24 +00:00
Ulrik StridandGitHub 7f76939485 Merge pull request #241708 from Julow/ocamlformat-move 
ocamlPackages.ocamlformat: Move into 'ocamlPackages'
 2023-07-05 19:38:35 +02:00
Danil SuetinandMatthieu Coudron 4333f887a6 waybar: 0.9.18 -> 0.9.19 2023-07-05 18:56:49 +02:00
Fabian AffolterandGitHub 8522fadc44 Merge pull request #232034 from fabaff/stevedore-bump 
python310Packages.stevedore: 5.0.0 -> 5.1.0
 2023-07-05 18:48:10 +02:00
Will FancherandGitHub e520c2e278 Merge pull request #240600 from lilyinstarlight/fix/luksroot-lvm-default-off 
nixos/lvm: toggle initrd enable option independently of main options
 2023-07-05 12:42:45 -04:00
Maximilian BoschandGitHub d2e03dddbb Merge pull request #241655 from Ma27/forward-port-kernels 
Linux kernel updates 2023-07-01 (forward-port)
 2023-07-05 18:28:12 +02:00