ryan77627/guix
1
0
Fork 0
mirror of https://git.in.rschanz.org/ryan77627/guix.git synced 2025-01-11 13:49:23 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

activation: Do not dereference symlinks during home directory creation.

Browse source 
Fixes <https://bugs.gnu.org/47584>.

* gnu/build/activation.scm (copy-account-skeletons): Do not chown the
home directory; leave this to 'activate-user-home'.
(activate-user-home): Only chown the home directory after the account
skeletons have been copied.

Co-authored-by: Ludovic Courtès <ludo@gnu.org>.
This commit is contained in:
Maxime Devos 2021-03-30 22:36:14 +02:00 committed by Ludovic Courtès
parent 222fff253c
commit 2161820ebb
No known key found for this signature in database
GPG key ID: 090B11993D9AEBB5
1 changed files with 9 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
gnu/build/activation.scm
View file

@ -107,7 +107,8 @@ (define* (copy-account-skeletons home
(directory %skeleton-directory)
uid gid)
"Copy the account skeletons from DIRECTORY to HOME. When UID is an integer,
make it the owner of all the files created; likewise for GID."
make it the owner of all the files created except the home directory; likewise
for GID."
(define (set-owner file)
(when (or uid gid)
(chown file (or uid -1) (or gid -1))))
@ -115,7 +116,6 @@ (define (set-owner file)
(let ((files (scandir directory (negate dot-or-dot-dot?)
string<?)))
(mkdir-p home)
(set-owner home)
(for-each (lambda (file)
(let ((target (string-append home "/" file)))
(copy-recursively (string-append directory "/" file)
@ -215,10 +215,15 @@ (define ensure-user-home
(uid (passwd:uid pw))
(gid (passwd:gid pw)))
(mkdir-p home)
(chown home uid gid)
(chmod home #o700)
(copy-account-skeletons home
#:uid uid #:gid gid))))))
#:uid uid #:gid gid)
;; It is important 'chown' be called after
;; 'copy-account-skeletons'. Otherwise, a malicious user with
;; good timing could create a symlink in HOME that would be
;; dereferenced by 'copy-account-skeletons'.
(chown home uid gid))))))
(for-each ensure-user-home users))