From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: Can unprivileged users corrupt the store with bad tarballs? Date: Thu, 03 Apr 2014 21:39:06 +0200 Message-ID: <87eh1ep5id.fsf@gnu.org> References: <87zjk2gsoc.fsf@yeeloong.lan> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:39639) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WVnTn-0005VH-FQ for guix-devel@gnu.org; Thu, 03 Apr 2014 15:39:21 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WVnTh-00066a-Ho for guix-devel@gnu.org; Thu, 03 Apr 2014 15:39:15 -0400 Received: from hera.aquilenet.fr ([2a01:474::1]:58329) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WVnTh-00066U-A7 for guix-devel@gnu.org; Thu, 03 Apr 2014 15:39:09 -0400 In-Reply-To: <87zjk2gsoc.fsf@yeeloong.lan> (Mark H. Weaver's message of "Thu, 03 Apr 2014 14:43:31 -0400") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: Mark H Weaver Cc: guix-devel@gnu.org Mark H Weaver skribis: > I was thinking about the security implications of giving out shell > access to one of my systems running Guix. > > When I ask guix-daemon to build package 'foo', it will use as an input > the source for package 'foo', usually a tarball. If the tarball is > already in the store, it won't download it again, because it is > effectively cached in the store. > > It is possible for another user on the same system to corrupt the cache, > but manually adding a bad tarball for 'foo' to the store, in such a way > that it would be used to build 'foo' when I ask for it? No. Tarballs are fixed-output derivations, so the hash of the tarball is known in advance. Thus, when building a package, you=E2=80=99re sure to us= e the tarball whose hash is in the recipe. Ludo=E2=80=99.