eldritch horrorsandRaito Bezarius
469cb4218d
if a build directory is accessible to other users it is possible to smuggle data in and out of build directories. usually this ins only a build purity problem, but in combination with other issues it can be used to break out of a build sandbox. to prevent this we default to using a subdirectory of nixStateDir (which is more restrictive). Fixes CVE-2025-52991. Change-Id: Iacfc9b50534de158618c815f9fb99d7dae1be4d0
30 lines
816 B
Bash
30 lines
816 B
Bash
source common.sh
|
|
|
|
enableFeatures "daemon-trust-override"
|
|
|
|
restartDaemon
|
|
|
|
requireSandboxSupport
|
|
[[ $busybox =~ busybox ]] || skipTest "no busybox"
|
|
|
|
unset NIX_STORE_DIR
|
|
|
|
# We first build a dependency of the derivation we eventually want to
|
|
# build.
|
|
nix-build build-hook.nix -A passthru.input2 \
|
|
-o "$TEST_ROOT/input2" \
|
|
--arg busybox "$busybox" \
|
|
--store "$TEST_ROOT/local" \
|
|
--option system-features bar
|
|
|
|
# Now when we go to build that downstream derivation, Lix will try to
|
|
# copy our already-build `input2` to the remote store. That store object
|
|
# is input-addressed, so this will fail.
|
|
|
|
file=build-hook.nix
|
|
prog=$(readlink -e ./nix-daemon-untrusting.sh)
|
|
proto=ssh-ng
|
|
|
|
expectStderr 1 source build-remote-trustless.sh \
|
|
| grepQuiet "cannot add path '[^ ]*' because it lacks a signature by a trusted key"
|