From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Subject: bug#37744: Per-user profile directory hijack (CVE-2019-17365 for Nix) Date: Tue, 15 Oct 2019 14:34:46 +0200 Message-ID: <87d0eyuqzd.fsf@gnu.org> References: <87o8yjsr8o.fsf@gnu.org> <87blujsqq0.fsf@gnu.org> <87y2xno85o.fsf@nckx> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:470:142:3::10]:41553) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iKM3X-0008Ck-HM for bug-guix@gnu.org; Tue, 15 Oct 2019 08:36:04 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1iKM3W-0001SI-Fa for bug-guix@gnu.org; Tue, 15 Oct 2019 08:36:03 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:34066) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1iKM3W-0001S6-Cp for bug-guix@gnu.org; Tue, 15 Oct 2019 08:36:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1iKM3W-0002KR-3E for bug-guix@gnu.org; Tue, 15 Oct 2019 08:36:02 -0400 Sender: "Debbugs-submit" Resent-Message-ID: In-Reply-To: <87y2xno85o.fsf@nckx> (Tobias Geerinckx-Rice's message of "Mon, 14 Oct 2019 13:53:35 +0200") List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org Sender: "bug-Guix" To: Tobias Geerinckx-Rice Cc: 37744@debbugs.gnu.org, guix-security@gnu.org Hi! Tobias Geerinckx-Rice skribis: > The 1777 is obviously very bad, no question. However: question: > > Ludovic Court=C3=A8s =E5=86=99=E9=81=93=EF=BC=9A >> I don=E2=80=99t see how to let the daemon create =E2=80=98per-user/$USER= =E2=80=99 on behalf >> of >> the client for clients connecting over TCP. Or we=E2=80=99d need to add= a >> challenge mechanism or authentication. > > I need more cluebat please: say I'm an attacker and connect to your > daemon (over TCP, why not), asking it to create an empty > =E2=80=98per-user/ludo=E2=80=99. You wouldn=E2=80=99t be able to do that because over TCP because the daemon can=E2=80=99t tell what user you are. Note that TCP has to be explicitly enabled through =E2=80=98guix-daemon --listen=3D0.0.0.0=E2=80=99. It=E2=80=99s meant for cluster setups where y= ou have one head node that clients connect to from remote nodes. I suppose we won=E2=80=99t be able to address the problem in this particular setup, unless we had some authentication mechanism like I wrote above (it could be a challenge like the MIT-MAGIC-COOKIE.) Ludo=E2=80=99.