movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 21:50:33 +03:00
Code Activity

nixos/security/wrappers: stop using .real files

Browse source 
Before this change it was crucial that nonprivileged users are unable to
create hardlinks to SUID wrappers, lest they be able to provide a
different `.real` file alongside. That was ensured by not providing a
location writable to them in the /run/wrappers tmpfs, (unless
disabled) by the fs.protected_hardlinks=1 sysctl, and by the explicit
own-path check in the wrapper. After this change, ensuring
that property is no longer important, and the check is most likely
redundant.

The simplification of expectations of the wrapper will make it
easier to remove some of the assertions in the wrapper (which currently
cause the wrapper to fail in no_new_privs environments, instead of
executing the target with non-elevated privileges).

Note that wrappers had to be copied (not symlinked) into /run/wrappers
due to the SUID/capability bits, and they couldn't be hard/softlinks of
each other due to those bits potentially differing. Thus, this change
doesn't increase the amount of memory used by /run/wrappers.

This change removes part of the test that is obsoleted by the removal of
`.real` files.
This commit is contained in:
Robert Obryk 2022-11-05 00:09:32 +01:00
parent 44fde723be
commit 1bdbc0b0fe
4 changed files with 16 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

7
nixos/tests/wrappers.nix
View file

@ -92,13 +92,6 @@ in
machine.succeed(cmd_as_regular('/run/wrappers/bin/capsh_with_chown --has-p=CAP_CHOWN'))
machine.fail(cmd_as_regular('/run/wrappers/bin/capsh_with_chown --has-p=CAP_SYS_ADMIN'))
# test a few "attacks" against which the wrapper protects itself
machine.succeed("cp /run/wrappers/bin/suid_root_busybox{,.real} /tmp/")
machine.fail(cmd_as_regular("/tmp/suid_root_busybox id -u"))
machine.succeed("chmod u+s,a+w /run/wrappers/bin/suid_root_busybox")
machine.fail(cmd_as_regular("/run/wrappers/bin/suid_root_busybox id -u"))
# Test that the only user of apparmor policy includes generated by
# wrappers works. Ideally this'd be located in a test for the module that
# actually makes the apparmor policy for ping, but there's no convenient