rekahsoft/guix
1
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

build: Restrict access to daemon socket in tests.

Browse Source 
With the weak isolation available to the test daemon, it is essential to
disallow untrusted access to it, as otherwise another local user can gain our
user's credentials easily.

* build-aux/test-env.in: ensure the daemon-socket directory is freshly-created
  with 0700 permissions.

Change-Id: I742f70fc6fc28e5b4dc88d590eef3daf1b964670
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
This commit is contained in:
Reepca Russelstein 2024-10-19 20:48:29 -05:00 committed by Ludovic Courtès
parent c78f8f64ce
commit f125143d64
No known key found for this signature in database
GPG Key ID: 090B11993D9AEBB5
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
build-aux/test-env.in
View File

@ -97,6 +97,11 @@ then
GUIX_ALLOW_UNAUTHENTICATED_SUBSTITUTES \
GUIX_CONFIGURATION_DIRECTORY XDG_CACHE_HOME
# Create a fresh directory with restrictive permissions so that our test
# daemon's weak isolation can't be exploited by other users
rm -rf "$GUIX_STATE_DIRECTORY/daemon-socket"
mkdir -m 0700 "$GUIX_STATE_DIRECTORY/daemon-socket"
# Launch the daemon without chroot support because is may be
# unavailable, for instance if we're not running as root.
"@abs_top_builddir@/pre-inst-env" \