nordic-dev.net/nix
nordic-dev.net/nix
2
0
Fork 0
mirror of https://github.com/NixOS/nix.git synced 2024-11-25 16:23:02 +00:00
Code Issues Packages Projects Releases Wiki Activity
b767987942
nix/doc/manual/source/release-notes/rl-1.11.10.md
John Ericson eb7d7780b1 Rename doc/manual{src -> source} 
This is needed to avoid this
https://github.com/mesonbuild/meson/issues/13774 when we go back to
making our subproject directory `src`.
2024-10-14 11:21:24 -04:00

1.1 KiB
Raw Blame History

Release 1.11.10 (2017-06-12)

This release fixes a security bug in Nix’s “build user” build isolation mechanism. Previously, Nix builders had the ability to create setuid binaries owned by a nixbld user. Such a binary could then be used by an attacker to assume a nixbld identity and interfere with subsequent builds running under the same UID.

To prevent this issue, Nix now disallows builders to create setuid and setgid binaries. On Linux, this is done using a seccomp BPF filter. Note that this imposes a small performance penalty (e.g. 1% when building GNU Hello). Using seccomp, we now also prevent the creation of extended attributes and POSIX ACLs since these cannot be represented in the NAR format and (in the case of POSIX ACLs) allow bypassing regular Nix store permissions. On macOS, the restriction is implemented using the existing sandbox mechanism, which now uses a minimal “allow all except the creation of setuid/setgid binaries” profile when regular sandboxing is disabled. On other platforms, the “build user” mechanism is now disabled.

Thanks go to Linus Heckemann for discovering and reporting this bug.