From 016d0193407d3089110f6a15a7fb270b01e316de Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Mon, 30 Jun 2025 00:21:41 +0200 Subject: [PATCH] release: release notes for 2.93.2 Release created with releng/create_release.xsh Change-Id: I643d70eaf19440325b2f66ec5f976f7ed4362949 --- doc/manual/rl-next/failed-cve-mitigation.md | 35 ------------ doc/manual/rl-next/infallible-build-dirs.md | 25 --------- doc/manual/src/release-notes/rl-2.93.md | 60 +++++++++++++++++++++ 3 files changed, 60 insertions(+), 60 deletions(-) delete mode 100644 doc/manual/rl-next/failed-cve-mitigation.md delete mode 100644 doc/manual/rl-next/infallible-build-dirs.md diff --git a/doc/manual/rl-next/failed-cve-mitigation.md b/doc/manual/rl-next/failed-cve-mitigation.md deleted file mode 100644 index 4d848ff1c..000000000 --- a/doc/manual/rl-next/failed-cve-mitigation.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -synopsis: "Revert CVE-2025-52992 failed mitigation" -issues: [fj#883, fj#887] -cls: [3444, 3528] -category: "Fixes" -credits: ["raito", "horrors"] ---- - -Following the initial mitigation of **CVE-2025-52992** in `cl/3444`, we -received reports of **unexpected deletion of in-use store paths**. - -Upon investigation, we found that the patch did **not correctly cancel all -automatic deleters**, resulting in potentially critical path loss during normal -operation. - -Given the severity and time-sensitive nature of the situation ([see incident -report](https://lix.systems/blog/2025-06-27-lix-critical-bug/)), we evaluated -possible options to repair the behavior safely. However, we concluded that a -rushed fix would either - -* **Overdelete**, i.e. breaking running systems, or, -* **Underdelete**, effectively **reopening CVE-2025-52992** while leaving - orphaned paths behind. - -As **CVE-2025-52992 has no known exploit vector**, and correctness is critical -in the Lix project, we have **fully reverted the previous mitigations**. - -The affected patches (`cl/3444`) have been rolled back for the time being. - -Moving forward, the Lix team will rework this code path in a **long-term, -correctness-first fix** on the main branch. We will explore backporting it to -stable channels once its safety is assured. - -We are deeply sorry for the stability incident and the Lix team remain -available for assisting you in recovering your systems. diff --git a/doc/manual/rl-next/infallible-build-dirs.md b/doc/manual/rl-next/infallible-build-dirs.md deleted file mode 100644 index 563d4fcde..000000000 --- a/doc/manual/rl-next/infallible-build-dirs.md +++ /dev/null @@ -1,25 +0,0 @@ ---- -synopsis: "Fallback to safe temp dir when build-dir is unwritable" -issues: [fj#876] -cls: [3501] -category: "Fixes" -credits: ["raito", "horrors"] ---- - -Non-daemon builds started failing with a permission error after introducing the `build-dir` option: - -``` -$ nix build --store ~/scratch nixpkgs#hello --rebuild -error: creating directory '/nix/var/nix/builds/nix-build-hello-2.12.2.drv-0': Permission denied -``` - -This happens because: - -1. These builds are not run via the daemon, which owns `/nix/var/nix/builds`. -2. The user lacks permissions for that path. - -We considered making `build-dir` a store-level option and defaulting it to `/nix/var/nix/builds` for chroot stores, but opted instead for a fallback: if the default fails, Nix now creates a safe build directory under `/tmp`. - -To avoid CVE-2025-52991, the fallback uses an extra path component between `/tmp` and the build dir. - -**Note**: this fallback clutters `/tmp` with build directories that are not cleaned up. To prevent this, explicitly set `build-dir` to a path managed by Lix, even for local workloads. diff --git a/doc/manual/src/release-notes/rl-2.93.md b/doc/manual/src/release-notes/rl-2.93.md index 2c86f2a3e..b78b0a150 100644 --- a/doc/manual/src/release-notes/rl-2.93.md +++ b/doc/manual/src/release-notes/rl-2.93.md @@ -1,4 +1,64 @@ # Lix 2.93 "Bici Bici" (2025-05-09) +# Lix 2.93.2 (2025-06-30) +## Fixes + +- Revert CVE-2025-52992 failed mitigation [fj#883](https://git.lix.systems/lix-project/lix/issues/883) [fj#887](https://git.lix.systems/lix-project/lix/issues/887) [cl/3444](https://gerrit.lix.systems/c/lix/+/3444) [cl/3528](https://gerrit.lix.systems/c/lix/+/3528) + + Following the initial mitigation of **CVE-2025-52992** in `cl/3444`, we + received reports of **unexpected deletion of in-use store paths**. + + Upon investigation, we found that the patch did **not correctly cancel all + automatic deleters**, resulting in potentially critical path loss during normal + operation. + + Given the severity and time-sensitive nature of the situation ([see incident + report](https://lix.systems/blog/2025-06-27-lix-critical-bug/)), we evaluated + possible options to repair the behavior safely. However, we concluded that a + rushed fix would either + + * **Overdelete**, i.e. breaking running systems, or, + * **Underdelete**, effectively **reopening CVE-2025-52992** while leaving + orphaned paths behind. + + As **CVE-2025-52992 has no known exploit vector**, and correctness is critical + in the Lix project, we have **fully reverted the previous mitigations**. + + The affected patches (`cl/3444`) have been rolled back for the time being. + + Moving forward, the Lix team will rework this code path in a **long-term, + correctness-first fix** on the main branch. We will explore backporting it to + stable channels once its safety is assured. + + We are deeply sorry for the stability incident and the Lix team remain + available for assisting you in recovering your systems. + + Many thanks to [Raito Bezarius](https://git.lix.systems/raito) and [eldritch horrors](https://git.lix.systems/pennae) for this. + +- Fallback to safe temp dir when build-dir is unwritable [fj#876](https://git.lix.systems/lix-project/lix/issues/876) [cl/3501](https://gerrit.lix.systems/c/lix/+/3501) + + Non-daemon builds started failing with a permission error after introducing the `build-dir` option: + + ``` + $ nix build --store ~/scratch nixpkgs#hello --rebuild + error: creating directory '/nix/var/nix/builds/nix-build-hello-2.12.2.drv-0': Permission denied + ``` + + This happens because: + + 1. These builds are not run via the daemon, which owns `/nix/var/nix/builds`. + 2. The user lacks permissions for that path. + + We considered making `build-dir` a store-level option and defaulting it to `/nix/var/nix/builds` for chroot stores, but opted instead for a fallback: if the default fails, Nix now creates a safe build directory under `/tmp`. + + To avoid CVE-2025-52991, the fallback uses an extra path component between `/tmp` and the build dir. + + **Note**: this fallback clutters `/tmp` with build directories that are not cleaned up. To prevent this, explicitly set `build-dir` to a path managed by Lix, even for local workloads. + + Many thanks to [Raito Bezarius](https://git.lix.systems/raito) and [eldritch horrors](https://git.lix.systems/pennae) for this. + + + + # Lix 2.93.1 (2025-06-23) ## Breaking Changes