Skip to content

Commit

Permalink
Prevent accidental recursive Nix
Browse files Browse the repository at this point in the history
  • Loading branch information
@edolstra
edolstra committed Feb 7, 2018
1 parent 48c192c commit 88b5d0c
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/nix-daemon/nix-daemon.cc
View file
Expand Up @@ -994,7 +994,7 @@ static void daemonLoop(char * * argv)
if (matchUser(user, group, trustedUsers))
trusted = true;

if (!trusted && !matchUser(user, group, allowedUsers))
if ((!trusted && !matchUser(user, group, allowedUsers)) || group == "nixbld")
throw Error(format("user '%1%' is not allowed to connect to the Nix daemon") % user);

printInfo(format((string) "accepted connection from pid %1%, user %2%" + (trusted ? " (trusted)" : ""))
Expand Down

6 comments on commit 88b5d0c

@shlevy
Copy link
Member

@shlevy shlevy commented on 88b5d0c Feb 7, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

😅

@dtzWill
Copy link
Member

@dtzWill dtzWill commented on 88b5d0c Feb 7, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds like an important fix, but unfortunately breaks tests. Don't see on hydra yet, but breaks tests FWIW: http://ix.io/Frd .

@shlevy
Copy link
Member

@shlevy shlevy commented on 88b5d0c Feb 7, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dtzWill Beautiful.

@shlevy
Copy link
Member

@shlevy shlevy commented on 88b5d0c Feb 7, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@edolstra Also shouldn't this use settings.buildUsersGroup?

@shlevy
Copy link
Member

@shlevy shlevy commented on 88b5d0c Feb 7, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That would lets us fix the testsuite...

@dtzWill
Copy link
Member

@dtzWill dtzWill commented on 88b5d0c Feb 7, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Was gonna ask same re:build-users-group, hehe...

Please sign in to comment.