#47229 - Local privilege escalation via guix-daemon and ‘--keep-failed’

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #25 received at 47229@debbugs.gnu.org (full text, mbox, reply):

Received: (at 47229) by debbugs.gnu.org; 18 Mar 2021 21:10:59 +0000
From debbugs-submit-bounces@debbugs.gnu.org Thu Mar 18 17:10:59 2021
Received: from localhost ([127.0.0.1]:48214 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1lMzv1-0001MW-CN
	for submit@debbugs.gnu.org; Thu, 18 Mar 2021 17:10:59 -0400
Received: from wout4-smtp.messagingengine.com ([64.147.123.20]:44155)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <leo@famulari.name>) id 1lMzuz-0001MJ-Ok
 for 47229@debbugs.gnu.org; Thu, 18 Mar 2021 17:10:58 -0400
Received: from compute3.internal (compute3.nyi.internal [10.202.2.43])
 by mailout.west.internal (Postfix) with ESMTP id DFFEC1032;
 Thu, 18 Mar 2021 17:10:51 -0400 (EDT)
Received: from mailfrontend1 ([10.202.2.162])
 by compute3.internal (MEProxy); Thu, 18 Mar 2021 17:10:52 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name;
 h=date:from:to:cc:subject:message-id:references:mime-version
 :content-type:in-reply-to; s=mesmtp; bh=8TLljeB3SoeHAoBN+XuZKK0D
 8txlXCK4cAEQbusTF/c=; b=RkAwBBAjbcjeGbkd4Ml5sdtYTxIP6XjMnSZG7Wmk
 uIKFSOQgY9Zt+msrh6yWQcFBxzQM+Lk4CUlTQdT65fWDgjxfgTn3hnkiaFUhOqnc
 LeVUVRjHalXKGLwmIBReeDo6mwbUDuljt+uhosHTm9liZjBSGkyEkq6kqXF31T2N
 5xo=
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=
 messagingengine.com; h=cc:content-type:date:from:in-reply-to
 :message-id:mime-version:references:subject:to:x-me-proxy
 :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=8TLlje
 B3SoeHAoBN+XuZKK0D8txlXCK4cAEQbusTF/c=; b=QeVYIT7H732MtS+4jgh5jw
 rKimPuCwx02hmihDSF5h/ozmGdsEKh7BwZoAhBcXn0twamGllc9Lv7I6V2bB5RQL
 pXsqWsZpN0EIyQK/vy+/5uRkhxNqI3kfj7gnZkk53/8QC8KJp4G+h5YGkmgjS3Tk
 ZehMBrjmmuRQ+Nm+KxaF5j2yiuOUfqIJKrljRfgWilE5FdKWEBhF4KQg2mGKGQCi
 mya6XTIFy75YybLi9vtldUq12moOLP/dEgrhhV/pNUtCabXtk7JwlOEX1HQX62Su
 vyliRw74de6wF5s2ksA3tG7dYKFVqwE72e0m9PcI35OtPehauCFl8JVqrarI1iYw
 ==
X-ME-Sender: <xms:28FTYIeCXtMGASei9ukkzsPvKCrpUS8O9JFaLWSxFXkRzYtkB684BQ>
 <xme:28FTYKP57JbfWxnorRQxlWCy830zW1htpntxSPMk5xKMud5b_5Q_RIp6Z8c2VyABU
 t5NNXW1WOmdJhe1QA>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduledrudefiedgudegkecutefuodetggdotefrod
 ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh
 necuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd
 enucfjughrpeffhffvuffkfhggtggujgesghdtreertddtjeenucfhrhhomhepnfgvohcu
 hfgrmhhulhgrrhhiuceolhgvohesfhgrmhhulhgrrhhirdhnrghmvgeqnecuggftrfgrth
 htvghrnhephfekvdduieehfedttdduledvgfehleevleejheettddvffevgeejgeetueff
 keetnecuffhomhgrihhnpehgnhhurdhorhhgnecukfhppedutddtrdduuddrudeiledrud
 dukeenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpehl
 vghosehfrghmuhhlrghrihdrnhgrmhgv
X-ME-Proxy: <xmx:28FTYJgU054H3yJDhMXvYqkE8LB9ZBDroMdP7g11-oKO5sA9i3x25g>
 <xmx:28FTYN_AY1V0o28jBvKYAA4x3Nad_oS8CSXZgwOGZy7fU_7nY2Oi-Q>
 <xmx:28FTYEs9mWbyoNnfOH5Qc_30eRm2AmrkvxQC20vNiJI1JK-i5TFIpw>
 <xmx:28FTYN6d62Q0pL8vCpSTipHmanXT5OCw5HWlfFcWl86Pji4yTrWEyQ>
Received: from localhost (pool-100-11-169-118.phlapa.fios.verizon.net
 [100.11.169.118])
 by mail.messagingengine.com (Postfix) with ESMTPA id 31B7B24005D;
 Thu, 18 Mar 2021 17:10:51 -0400 (EDT)
Date: Thu, 18 Mar 2021 17:10:49 -0400
From: Leo Famulari <leo@famulari.name>
To: Ludovic Courtès <ludo@gnu.org>
Subject: Re: bug#47229: Local privilege escalation via guix-daemon and ‘--keep-failed’
Message-ID: <YFPB2RTVkRxx8sfk@jasmine.lan>
References: <87lfaksock.fsf@gnu.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature"; boundary="dzF1svFDk/IQH/JI"
Content-Disposition: inline
In-Reply-To: <87lfaksock.fsf@gnu.org>
X-Spam-Score: -0.7 (/)
X-Debbugs-Envelope-To: 47229
Cc: 47229@debbugs.gnu.org
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -1.7 (-)

[Message part 1 (text/plain, inline)]

On Thu, Mar 18, 2021 at 12:17:15PM +0100, Ludovic Courtès wrote:
> It does not affect multi-user setups where ‘guix-daemon’ runs on a
> separate machine and is accessed over the network, via
> ‘GUIX_DAEMON_SOCKET’, as is customary on cluster setups.  Machines where
> the Linux “protected hardlink”[*] feature is enabled, which is common,
> are also unaffected—this is the case when the contents of
> /proc/sys/fs/protected_hardlinks are 1.

After publishing the advisory, we received a clarification about the
impact of "protected hardlinks".

When using a guix-daemon that does not include the fix [0] for the bug
reported here, it is still possible for rogue build scripts to escape
the build environment, even when protected hardlinks are enabled.

Protected hardlinks do make exploitation significantly more difficult,
but not impossible.

For this reason, we continue to recommend that all Guix users upgrade
their guix-daemons, as described in the original advisory.

[0]
https://git.savannah.gnu.org/cgit/guix.git/commit/?id=ec7fb669945bfb47c5e1fdf7de3a5d07f7002ccf

[signature.asc (application/pgp-signature, inline)]

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Thu Jan 2 17:40:45 2025; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#47229 Local privilege escalation via guix-daemon and ‘--keep-failed’