mirror of
https://codeberg.org/guix/guix.git
synced 2026-01-25 12:05:19 -06:00
9202921e81
"guix perform-download" is used to implement the daemon's "download" and "git-download" builtin builders. Because these are builtins, it runs without any additional isolation beyond merely running as a build user. In such a context, allowing arbitrary user-supplied code to be evaluated will easily lead to the build user being taken over, which can then be used to corrupt future builds, enable exploitation of certain vulnerabilities, and in the case of the rootless daemon completely take over guix-daemon. Use (ice-9 sandbox) to ensure that only safe bindings are available during the evaluation of the content-addressed-mirrors file. * guix/perform-download.scm (%safe-bindings, %sandbox-module): new variables. (syntax-noop): new syntax. (eval-content-addressed-mirrors, assert-store-file, call-with-input-file/no-symlinks): new procedures. (perform-download): use assert-store-file to ensure files are in the store before being read. Use call-with-input-file/no-symlinks for opening untrusted files. Use eval-content-addressed-mirrors to evaluate the content-addressed-mirrors file. Change-Id: I8ed27a95d84dbcc7d72d0d75f172d113f8be6c79 Signed-off-by: Ludovic Courtès <ludo@gnu.org> |
||
|---|---|---|
| .. | ||
| build | ||
| build-system | ||
| import | ||
| platforms | ||
| scripts | ||
| store | ||
| tests | ||
| android-repo-download.scm | ||
| avahi.scm | ||
| base16.scm | ||
| base32.scm | ||
| base64.scm | ||
| build-system.scm | ||
| bzr-download.scm | ||
| cache.scm | ||
| channels.scm | ||
| ci.scm | ||
| colors.scm | ||
| combinators.scm | ||
| config.scm.in | ||
| cpio.scm | ||
| cpu.scm | ||
| cve.scm | ||
| cvs-download.scm | ||
| d3.v3.js | ||
| deprecation.scm | ||
| derivations.scm | ||
| describe.scm | ||
| diagnostics.scm | ||
| discovery.scm | ||
| docker.scm | ||
| download.scm | ||
| elf.scm | ||
| ftp-client.scm | ||
| gexp.scm | ||
| git-authenticate.scm | ||
| git-download.scm | ||
| git.scm | ||
| glob.scm | ||
| gnu-maintenance.scm | ||
| gnupg.scm | ||
| grafts.scm | ||
| graph.js | ||
| graph.scm | ||
| hash.scm | ||
| hg-download.scm | ||
| http-client.scm | ||
| i18n.scm | ||
| inferior.scm | ||
| ipfs.scm | ||
| least-authority.scm | ||
| licenses.scm | ||
| lint.scm | ||
| man-db.scm | ||
| memoization.scm | ||
| modules.scm | ||
| monad-repl.scm | ||
| monads.scm | ||
| nar.scm | ||
| narinfo.scm | ||
| openpgp.scm | ||
| packages.scm | ||
| pki.scm | ||
| platform.scm | ||
| profiles.scm | ||
| profiling.scm | ||
| progress.scm | ||
| quirks.scm | ||
| read-print.scm | ||
| records.scm | ||
| remote.scm | ||
| repl.scm | ||
| rpm.scm | ||
| scripts.scm | ||
| search-paths.scm | ||
| self.scm | ||
| serialization.scm | ||
| sets.scm | ||
| ssh.scm | ||
| status.scm | ||
| store.scm | ||
| substitutes.scm | ||
| svn-download.scm | ||
| swh.scm | ||
| tests.scm | ||
| transformations.scm | ||
| ui.scm | ||
| upstream.scm | ||
| utils.scm | ||
| workers.scm | ||