bug#37744: Per-user profile directory hijack (CVE-2019-17365 for Nix)

[Tobias Geerinckx-Rice via Bug reports for GNU Guix]

Ludo',

That was swift, thanks!

IANAC++.

Ludovic Courtès 写道：

diff --git a/nix/libstore/local-store.cc b/nix/libstore/local-store.cc

index 3b08492c64..3793382361 100644
--- a/nix/libstore/local-store.cc
+++ b/nix/libstore/local-store.cc
@@ -88,8 +88,9 @@ LocalStore::LocalStore(bool reserveSpace)

         createDirs(perUserDir);
-        if (chmod(perUserDir.c_str(), 01777) == -1)

+        if (chmod(perUserDir.c_str(), 0755) == -1)

+                           % perUserDir);

Path perUserDir = profilesDir + "/per-user"; - throw SysError(format("could not set permissions on '%1%' to 1777") % perUserDir); + throw SysError(format("could not set permissions on '%1%' to 755") mode_t perm = 01775;

This is inside

 if (getuid() == 0 && settings.buildUsersGroup != "") {
   …
 }



Kind regards,

T G-R

It's not clear to me why the second condition here is relevant, but I don't have the big picture. Nor do I suspect I want it.

signature.asc
Description: PGP signature