guix/gnu/build at 520bac7ed00a949a0391ad680de65a1498105c2b - guix

mirror of https://git.savannah.gnu.org/git/guix.git synced 2026-04-06 21:20:33 +02:00

Files

Maxime Devos 520bac7ed0 services: Prevent following symlinks during activation.

This addresses a potential security issue, where a compromised
service could trick the activation code in changing the permissions,
owner and group of arbitrary files.  However, this patch is
currently only a partial fix, due to a TOCTTOU (time-of-check to
time-of-use) race, which can be fixed once guile has bindings
to openat and friends.

Fixes: <https://lists.gnu.org/archive/html/guix-devel/2021-01/msg00388.html>

* gnu/build/activation.scm: new procedure 'mkdir-p/perms'.
* gnu/services/authentication.scm
  (%nslcd-activation, nslcd-service-type): use new procedure.
* gnu/services/cups.scm (%cups-activation): likewise.
* gnu/services/dbus.scm (dbus-activation): likewise.
* gnu/services/dns.scm (knot-activation): likewise.

Signed-off-by: Ludovic Courtès <ludo@gnu.org>

2021-03-10 18:01:47 +01:00

accounts.scm

accounts: Delete duplicate entries.

2019-08-28 00:27:14 +02:00

activation.scm

services: Prevent following symlinks during activation.

2021-03-10 18:01:47 +01:00

bootloader.scm

system: reconfigure: Use the disk-installer if provided.

2020-11-03 07:59:59 +01:00

chromium-extension.scm

Add (gnu build chromium-extension).