On Sun, Oct 08, 2017 at 09:54:22PM +0200, Ludovic Courtès wrote: > ludo@gnu.org (Ludovic Courtès) skribis: > > > ludo@gnu.org (Ludovic Courtès) skribis: > > > >> On GuixSD, ‘activate-setuid-programs’ in (gnu build activation) would > >> create setuid-root binaries under /gnu/store for all the programs listed > >> under ‘setuid-programs’ in the ‘operating-system’ declaration. > > > > Fixed by > > . > > Detailed announcement at: > > https://lists.gnu.org/archive/html/guix-devel/2017-10/msg00090.html FYI, this was assigned CVE-2017-1000455. I just received the attached JSON from the Distributed Weakness Filing project (DWF) in response to my CVE application. I assume it will show up in the regular places (MITRE etc) eventually. Having thought about this bug for a while, I think it was not too bad in practice. The setuid executable files could be copied or preserved somehow by an attacker whether they were in the store or in /run/setuid-programs.