From fc9f7096d36ce38f6e849128bf49bc377f36676f Mon Sep 17 00:00:00 2001 From: eldritch horrors Date: Sun, 20 Jul 2025 13:53:41 +0200 Subject: [PATCH] libstore: weaken tmpdir root access mode libarchive *should* not break with 0710 on the tmpdir root on darwin, just like it doesn't break on linux, but for some reason it does. the restriction to 0710 can be weakened to 0750 with causing any trouble. fixes #921 Change-Id: Ia9fc2f8eb9695fc19cefae9857368d5a4e58c8b9 --- src/libstore/build/local-derivation-goal.cc | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc index 523fe701b..8dae6e7aa 100644 --- a/src/libstore/build/local-derivation-goal.cc +++ b/src/libstore/build/local-derivation-goal.cc @@ -528,8 +528,12 @@ void LocalDerivationGoal::startBuilder() // also need the intermediate level to be inaccessible to others. build // processes must be able to at least traverse to the directory though, // without being able to chmod. this means either mode 0750 or 0710. we - // use 0710 just to be extra safe; if we ever add more directories they - // will not be enumerable to other processes in the builder user group. + // cannot use 0710 because the libarchive we link with is compiled with + // an old apple sdk that does not have O_SEARCH, which makes libarchive + // try to open tmpDirRoot for *read* and fail because g+r is not set. a + // future update to nixpkgs may fix this. until then we do not lose any + // security by setting mode 0750 because we use only a single subdir in + // tmpDirRoot, so being able to list its parent doesn't break anything. // // use a short name to not increase the path length too much on darwin. // darwin has a severe sockaddr_un path length limitation, so this does @@ -548,7 +552,7 @@ void LocalDerivationGoal::startBuilder() if (fchown(tmpDirRootFd.get(), -1, buildUser->getGID()) == -1) { throw SysError("cannot change ownership of '%1%'", tmpDirRoot); } - if (fchmod(tmpDirRootFd.get(), 0710) == -1) { + if (fchmod(tmpDirRootFd.get(), 0750) == -1) { throw SysError("cannot change mode of '%1%'", tmpDirRoot); } }