Commits on Aug 3, 2018

1. Fix symlink leak in restricted eval mode …

   In EvalState::checkSourcePath, the path is checked against the list of
   allowed paths first and later it's checked again *after* resolving
   symlinks.
   
   The resolving of the symlinks is done via canonPath, which also strips
   out "../" and "./". However after the canonicalisation the error message
   pointing out that the path is not allowed prints the symlink target in
   the error message.
   
   Even if we'd suppress the message, symlink targets could still be leaked
   if the symlink target doesn't exist (in this case the error is thrown in
   canonPath).
   
   So instead, we now do canonPath() without symlink resolving first before
   even checking against the list of allowed paths and then later do the
   symlink resolving and checking the allowed paths again.
   
   The first call to canonPath() should get rid of all the "../" and "./",
   so in theory the only way to leak a symlink if the attacker is able to
   put a symlink in one of the paths allowed by restricted evaluation mode.
   
   For the latter I don't think this is part of the threat model, because
   if the attacker can write to that path, the attack vector is even
   larger.
   
   Signed-off-by: aszlig <aszlig@nix.build>

   

   aszlig committed Aug 3, 2018
   Copy the full SHA

   43e28a1 View commit details

   Browse the repository at this point in the history

2. Merge pull request #2326 from aszlig/fix-symlink-leak …

   Fix symlink leak in restricted eval mode

   

   edolstra committed Aug 3, 2018
   Copy the full SHA

   bc65e02 View commit details

   Browse the repository at this point in the history