From d27c247715578f3f048866a00ccb7023202f3b48 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Wed, 26 Mar 2025 01:07:47 +0100 Subject: [PATCH] libstore: ensure that `passAsFile` is created in the original temp dir This ensures that `passAsFile` data is created inside the expected temporary build directory by `openat()` from the parent directory file descriptor. Fixes CVE-2025-52993. Change-Id: Ie5273446c4a19403088d0389ae8e3f473af8879a Signed-off-by: Raito Bezarius --- src/libstore/build/local-derivation-goal.cc | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc index ff414e215..97de3e80a 100644 --- a/src/libstore/build/local-derivation-goal.cc +++ b/src/libstore/build/local-derivation-goal.cc @@ -831,8 +831,13 @@ void LocalDerivationGoal::initTmpDir() { auto hash = hashString(HashType::SHA256, i.first); std::string fn = ".attr-" + hash.to_string(Base::Base32, false); Path p = tmpDir + "/" + fn; - writeFile(p, rewriteStrings(i.second, inputRewrites)); - chownToBuilder(p); + /* TODO(jade): we should have BorrowedFD instead of OwnedFD. */ + AutoCloseFD passAsFileFd{openat(tmpDirFd.get(), fn.c_str(), O_WRONLY | O_TRUNC | O_CREAT | O_CLOEXEC | O_EXCL | O_NOFOLLOW, 0666)}; + if (!passAsFileFd) { + throw SysError("opening `passAsFile` file in the sandbox '%1%'", p); + } + writeFile(passAsFileFd, rewriteStrings(i.second, inputRewrites)); + chownToBuilder(passAsFileFd); env[i.first + "Path"] = tmpDirInSandbox + "/" + fn; } }