The 2.28.6 tarball already contains the mdbook 0.5 compatibility fix
and the GHSA-g3g9-5vj6-r3gj sandbox escape fix, so drop the
now-redundant downstream backports.
The 2.34.5 tarball already contains the GHSA-g3g9-5vj6-r3gj sandbox
escape fix and the landlock abstract socket hardening, so drop the
now-redundant downstream backports.
The 2.31.4 tarball already contains the lowdown 3.0 compatibility fix,
the GHSA-g3g9-5vj6-r3gj sandbox escape fix and the landlock abstract
socket hardening, so drop the now-redundant downstream backports.
The 2.30.4 tarball already contains the mdbook 0.5, lowdown 3.0 and
GHSA-g3g9-5vj6-r3gj fixes that were previously backported downstream,
so drop the now-redundant patches.
This addresses GHSA-g3g9-5vj6-r3gj, a vulnerability where
std::filesystem::copy_file follows symlinks when copying FOD outputs,
allowing a malicious builder to overwrite files outside the build
sandbox.
The patch puts FOD output copies in a temporary directory inside the
store (instead of the chroot) and tightens permissions on the
in-store temporary directory.
The second patch partially fixes the issue with cooperating processes being able
to communicate via abstract sockets. The fix is partial, because processes
outside the landlock domain of the sandboxed process can still connect to
a socket created by the FOD. There's no equivalent way of restricting inbound
connections. This closes the gap when there's no cooperating process on the host
(i.e. 2 separate FODs).
The patch applies landlock LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET on
kernels >= 6.12 (default on NixOS 25.11+) to deny abstract socket
connect from inside the build sandbox.
This addresses GHSA-g3g9-5vj6-r3gj, a vulnerability where
std::filesystem::copy_file follows symlinks when copying FOD outputs,
allowing a malicious builder to overwrite files outside the build
sandbox.
The patch puts FOD output copies in a temporary directory inside the
store (instead of the chroot) and tightens permissions on the
in-store temporary directory.
The second patch partially fixes the issue with cooperating processes being able
to communicate via abstract sockets. The fix is partial, because processes
outside the landlock domain of the sandboxed process can still connect to
a socket created by the FOD. There's no equivalent way of restricting inbound
connections. This closes the gap when there's no cooperating process on the host
(i.e. 2 separate FODs).
The patch applies landlock LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET on
kernels >= 6.12 (default on NixOS 25.11+) to deny abstract socket
connect from inside the build sandbox.
This addresses GHSA-g3g9-5vj6-r3gj, a vulnerability where
std::filesystem::copy_file follows symlinks when copying FOD outputs,
allowing a malicious builder to overwrite files outside the build
sandbox.
The patch puts FOD output copies in a temporary directory inside the
store (instead of the chroot) and tightens permissions on the
in-store temporary directory.
The second patch partially fixes the issue with cooperating processes being able
to communicate via abstract sockets. The fix is partial, because processes
outside the landlock domain of the sandboxed process can still connect to
a socket created by the FOD. There's no equivalent way of restricting inbound
connections. This closes the gap when there's no cooperating process on the host
(i.e. 2 separate FODs).
The patch applies landlock LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET on
kernels >= 6.12 (default on NixOS 25.11+) to deny abstract socket
connect from inside the build sandbox.
This addresses GHSA-g3g9-5vj6-r3gj, a vulnerability where
std::filesystem::copy_file follows symlinks when copying FOD outputs,
allowing a malicious builder to overwrite files outside the build
sandbox.
The patch puts FOD output copies in a temporary directory inside the
store (instead of the chroot) and tightens permissions on the
in-store temporary directory.
This addresses GHSA-g3g9-5vj6-r3gj, a vulnerability where
std::filesystem::copy_file follows symlinks when copying FOD outputs,
allowing a malicious builder to overwrite files outside the build
sandbox.
The patch puts FOD output copies in a temporary directory inside the
store (instead of the chroot) and tightens permissions on the
in-store temporary directory.
Jörg Thalheim