bug#37744: Per-user profile directory hijack (CVE-2019-17365 for Nix)

["Ludovic Courtès" <ludo@gnu.org>]

Hi!

Tobias Geerinckx-Rice <me@tobias.gr> skribis:

> The 1777 is obviously very bad, no question.  However: question:
>
> Ludovic Courtès 写道：
>> I don’t see how to let the daemon create ‘per-user/$USER’ on behalf
>> of
>> the client for clients connecting over TCP.  Or we’d need to add a
>> challenge mechanism or authentication.
>
> I need more cluebat please: say I'm an attacker and connect to your
> daemon (over TCP, why not), asking it to create an empty
> ‘per-user/ludo’.

You wouldn’t be able to do that because over TCP because the daemon
can’t tell what user you are.

Note that TCP has to be explicitly enabled through ‘guix-daemon
--listen=0.0.0.0’.  It’s meant for cluster setups where you have one
head node that clients connect to from remote nodes.

I suppose we won’t be able to address the problem in this particular
setup, unless we had some authentication mechanism like I wrote above
(it could be a challenge like the MIT-MAGIC-COOKIE.)

Ludo’.