Raito Bezarius
1f08eaeb55
As we saw actual users running into them throughout the debugging of #920 and #1014. It's best to document and point end users to this so they can take measures for themselves. Change-Id: I7d08407f4354055bf65fc6dd7d1624c5a9304402 Signed-off-by: Raito Bezarius <raito@lix.systems>
1.4 KiB
1.4 KiB
Pasta: a network sandbox for fixed-output derivations
Introduction
This section only applies to Linux systems as Pasta is a Linux-only measure.
Since CVE-2025-46416, the Lix project decided to adopt Pasta for all fixed-output derivations, protecting against various attack vectors such as UNIX abstract domain sockets or more manipulation at the network layer from a malicious fixed-output derivation code.
Pasta acts as a translation layer between a layer-2 network interface and layer-4 sockets (TCP, UDP, ICMP/ICMPv6 echo) on the host. It requires no special privileges and can serve as a alternative to SLiRP which was used by Guix to mitigate the same problem.
How to disable Pasta?
It's sufficient to pass pasta-path = "" in your /etc/nix/nix.conf or on the command line --pasta-path "" of a Lix invocation.
Known issues surrounding Pasta
- Only the first DNS server in
/etc/resolv.confis considered: failover is not possible. - Reduced feature set compared to the Linux kernel
- Performance overhead in multi-gigabits contexts and IMIX MTUs