mirror of
https://git.in.rschanz.org/ryan77627/guix.git
synced 2025-01-12 14:16:55 -05:00
520bac7ed0
This addresses a potential security issue, where a compromised service could trick the activation code in changing the permissions, owner and group of arbitrary files. However, this patch is currently only a partial fix, due to a TOCTTOU (time-of-check to time-of-use) race, which can be fixed once guile has bindings to openat and friends. Fixes: <https://lists.gnu.org/archive/html/guix-devel/2021-01/msg00388.html> * gnu/build/activation.scm: new procedure 'mkdir-p/perms'. * gnu/services/authentication.scm (%nslcd-activation, nslcd-service-type): use new procedure. * gnu/services/cups.scm (%cups-activation): likewise. * gnu/services/dbus.scm (dbus-activation): likewise. * gnu/services/dns.scm (knot-activation): likewise. Signed-off-by: Ludovic Courtès <ludo@gnu.org> |
||
|---|---|---|
| .. | ||
| accounts.scm | ||
| activation.scm | ||
| bootloader.scm | ||
| chromium-extension.scm | ||
| cross-toolchain.scm | ||
| file-systems.scm | ||
| hurd-boot.scm | ||
| image.scm | ||
| install.scm | ||
| linux-boot.scm | ||
| linux-container.scm | ||
| linux-initrd.scm | ||
| linux-modules.scm | ||
| locale.scm | ||
| marionette.scm | ||
| secret-service.scm | ||
| shepherd.scm | ||
| svg.scm | ||
| vm.scm | ||