eldritch horrorsandRaito Bezarius
749afbbe99
if a build directory is accessible to other users it is possible to smuggle data in and out of build directories. usually this ins only a build purity problem, but in combination with other issues it can be used to break out of a build sandbox. to prevent this we default to using a subdirectory of nixStateDir (which is more restrictive). Fixes CVE-2025-52991. Change-Id: Iacfc9b50534de158618c815f9fb99d7dae1be4d0
525 B
525 B
synopsis, cls, category, credits
| synopsis | cls | category | credits | ||
|---|---|---|---|---|---|
| `build-dir` no longer defaults to `temp-dir` |
|
Fixes |
|
The directory in which temporary build directories are created no longer defaults
to the value of the temp-dir setting to avoid builders making their directories
world-accessible. This behavior has been used to escape the build sandbox and can
cause build impurities even when not used maliciously. We now default to builds
in NIX_STATE_DIR (which is /nix/var/nix/builds in the default configuration).