bug#37744: Per-user profile directory hijack (CVE-2019-17365 for Nix)

[Tobias Geerinckx-Rice via Bug reports for GNU Guix <bug-guix@gnu.org>]

[-- Attachment #1: Type: text/plain, Size: 1064 bytes --]

Ludo',

That was swift, thanks!

IANAC++.

Ludovic Courtès 写道：
> diff --git a/nix/libstore/local-store.cc 
> b/nix/libstore/local-store.cc
> index 3b08492c64..3793382361 100644
> --- a/nix/libstore/local-store.cc
> +++ b/nix/libstore/local-store.cc
> @@ -88,8 +88,9 @@ LocalStore::LocalStore(bool reserveSpace)
>  
>          Path perUserDir = profilesDir + "/per-user";
>          createDirs(perUserDir);
> -        if (chmod(perUserDir.c_str(), 01777) == -1)
> -            throw SysError(format("could not set permissions on 
> '%1%' to 1777") % perUserDir);
> +        if (chmod(perUserDir.c_str(), 0755) == -1)
> +            throw SysError(format("could not set permissions on 
> '%1%' to 755")
> +                           % perUserDir);
>  
>          mode_t perm = 01775;

This is inside

  if (getuid() == 0 && settings.buildUsersGroup != "") {
    …
  }

It's not clear to me why the second condition here is relevant, 
but I don't have the big picture.  Nor do I suspect I want it.

Kind regards,

T G-R

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]