Something went wrong. Try again.
What happens if I push all of nixpkgs
Something went wrong. Try again.
8.7 kB · 181 lines
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182diff --git a/include/iprt/mangling.h b/include/iprt/mangling.hindex 991dd9e..defc781 100644--- a/include/iprt/mangling.h+++ b/include/iprt/mangling.h@@ -1802,6 +1802,7 @@ # define RTPathStripSuffix RT_MANGLER(RTPathStripSuffix) # define RTPathStripFilename RT_MANGLER(RTPathStripFilename) # define RTPathStripTrailingSlash RT_MANGLER(RTPathStripTrailingSlash)+# define RTPathSuidDir RT_MANGLER(RTPathSuidDir) # define RTPathTemp RT_MANGLER(RTPathTemp) # define RTPathTraverseList RT_MANGLER(RTPathTraverseList) # define RTPathUnlink RT_MANGLER(RTPathUnlink)@@ -1842,6 +1843,7 @@ # define RTProcGetAffinityMask RT_MANGLER(RTProcGetAffinityMask) # define RTProcGetExecutablePath RT_MANGLER(RTProcGetExecutablePath) # define RTProcGetPriority RT_MANGLER(RTProcGetPriority)+# define RTProcGetSuidPath RT_MANGLER(RTProcGetSuidPath) # define RTProcIsRunningByName RT_MANGLER(RTProcIsRunningByName) # define RTProcQueryParent RT_MANGLER(RTProcQueryParent) # define RTProcQueryUsername RT_MANGLER(RTProcQueryUsername)diff --git a/include/iprt/path.h b/include/iprt/path.hindex 89bf8f6..5caa578 100644--- a/include/iprt/path.h+++ b/include/iprt/path.h@@ -1235,6 +1235,15 @@ RTDECL(int) RTPathCalcRelative(char *pszPathDst, size_t cbPathDst, const char *p */ RTDECL(int) RTPathExecDir(char *pszPath, size_t cchPath); +/**+ * Gets the path to the NixOS setuid wrappers directory.+ *+ * @returns iprt status code.+ * @param pszPath Buffer where to store the path.+ * @param cchPath Buffer size in bytes.+ */+RTDECL(int) RTPathSuidDir(char *pszPath, size_t cchPath);+ /** * Gets the user home directory. *diff --git a/include/iprt/process.h b/include/iprt/process.hindex 4ca981e..058ae7a 100644--- a/include/iprt/process.h+++ b/include/iprt/process.h@@ -384,6 +384,16 @@ RTR3DECL(const char *) RTProcExecutablePath(void); */ RTR3DECL(char *) RTProcGetExecutablePath(char *pszExecPath, size_t cbExecPath); +/**+ * Gets the path to the NixOS setuid wrappers directory.+ *+ * @returns pszExecPath on success. NULL on buffer overflow or other errors.+ *+ * @param pszExecPath Where to store the path.+ * @param cbExecPath The size of the buffer.+ */+RTR3DECL(char *) RTProcGetSuidPath(char *pszExecPath, size_t cbExecPath);+ /** * Daemonize the current process, making it a background process. *diff --git a/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp b/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cppindex e78a397..ff5b541 100644--- a/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp+++ b/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp@@ -1541,9 +1541,9 @@ static int supR3HardenedVerifyFsObject(PCSUPR3HARDENEDFSOBJSTATE pFsObjState, bo bool fBad = !fRelaxed || pFsObjState->Stat.st_gid != 2 /*bin*/ || suplibHardenedStrCmp(pszPath, "/usr/lib/iconv"); # else NOREF(fRelaxed);- bool fBad = true;+ bool fBad = !(fDir && pFsObjState->Stat.st_mode & S_ISVTX && !suplibHardenedStrCmp(pszPath, "/nix/store")); # endif- if (fBad)+ if (fBad && suplibHardenedStrCmp(pszPath, "/nix/store")) return supR3HardenedSetError3(VERR_SUPLIB_WRITE_NON_SYS_GROUP, pErrInfo, "An unknown (and thus untrusted) group has write access to '", pszPath, "' and we therefore cannot trust the directory content or that of any subdirectory");diff --git a/src/VBox/Main/src-all/MachineLaunchVMCommonWorker.cpp b/src/VBox/Main/src-all/MachineLaunchVMCommonWorker.cppindex 01d7a9f..e52a291 100644--- a/src/VBox/Main/src-all/MachineLaunchVMCommonWorker.cpp+++ b/src/VBox/Main/src-all/MachineLaunchVMCommonWorker.cpp@@ -100,7 +100,7 @@ int MachineLaunchVMCommonWorker(const Utf8Str &aNameOrId, /* Get the path to the executable directory w/ trailing slash: */ char szPath[RTPATH_MAX];- int vrc = RTPathAppPrivateArch(szPath, sizeof(szPath));+ int vrc = RTStrCopy(szPath, sizeof(szPath) - 1, "/run/wrappers/bin"); AssertRCReturn(vrc, vrc); size_t cbBufLeft = RTPathEnsureTrailingSeparator(szPath, sizeof(szPath)); AssertReturn(cbBufLeft > 0, VERR_FILENAME_TOO_LONG);diff --git a/src/VBox/Main/src-server/NetworkServiceRunner.cpp b/src/VBox/Main/src-server/NetworkServiceRunner.cppindex 773d27f..874ec2d 100644--- a/src/VBox/Main/src-server/NetworkServiceRunner.cpp+++ b/src/VBox/Main/src-server/NetworkServiceRunner.cpp@@ -198,7 +198,7 @@ int NetworkServiceRunner::start(bool aKillProcessOnStop) * ASSUME it is relative to the directory that holds VBoxSVC. */ char szExePath[RTPATH_MAX];- AssertReturn(RTProcGetExecutablePath(szExePath, RTPATH_MAX), VERR_FILENAME_TOO_LONG);+ AssertReturn(RTProcGetSuidPath(szExePath, RTPATH_MAX), VERR_FILENAME_TOO_LONG); RTPathStripFilename(szExePath); int vrc = RTPathAppend(szExePath, sizeof(szExePath), m->pszProcName); AssertLogRelRCReturn(vrc, vrc);diff --git a/src/VBox/Main/src-server/generic/NetIf-generic.cpp b/src/VBox/Main/src-server/generic/NetIf-generic.cppindex 1e2eb61..893344c 100644--- a/src/VBox/Main/src-server/generic/NetIf-generic.cpp+++ b/src/VBox/Main/src-server/generic/NetIf-generic.cpp@@ -62,7 +62,7 @@ static int NetIfAdpCtl(const char * pcszIfName, const char *pszAddr, const char const char *args[] = { NULL, pcszIfName, pszAddr, pszOption, pszMask, NULL }; char szAdpCtl[RTPATH_MAX];- int vrc = RTPathExecDir(szAdpCtl, sizeof(szAdpCtl) - sizeof("/" VBOXNETADPCTL_NAME));+ int vrc = RTPathSuidDir(szAdpCtl, sizeof(szAdpCtl) - sizeof("/" VBOXNETADPCTL_NAME)); if (RT_FAILURE(vrc)) { LogRel(("NetIfAdpCtl: failed to get program path, vrc=%Rrc.\n", vrc));@@ -109,7 +109,7 @@ static int NetIfAdpCtl(HostNetworkInterface * pIf, const char *pszAddr, const ch int NetIfAdpCtlOut(const char * pcszName, const char * pcszCmd, char *pszBuffer, size_t cBufSize) { char szAdpCtl[RTPATH_MAX];- int vrc = RTPathExecDir(szAdpCtl, sizeof(szAdpCtl) - sizeof("/" VBOXNETADPCTL_NAME " ") - strlen(pcszCmd));+ int vrc = RTPathSuidDir(szAdpCtl, sizeof(szAdpCtl) - sizeof("/" VBOXNETADPCTL_NAME " ") - strlen(pcszCmd)); if (RT_FAILURE(vrc)) { LogRel(("NetIfAdpCtlOut: Failed to get program path, vrc=%Rrc\n", vrc));@@ -224,7 +224,7 @@ int NetIfCreateHostOnlyNetworkInterface(VirtualBox *pVirtualBox, progress.queryInterfaceTo(aProgress); char szAdpCtl[RTPATH_MAX];- vrc = RTPathExecDir(szAdpCtl, sizeof(szAdpCtl) - sizeof("/" VBOXNETADPCTL_NAME " add"));+ vrc = RTPathSuidDir(szAdpCtl, sizeof(szAdpCtl) - sizeof("/" VBOXNETADPCTL_NAME " add")); if (RT_FAILURE(vrc)) { progress->i_notifyComplete(E_FAIL,diff --git a/src/VBox/Runtime/r3/path.cpp b/src/VBox/Runtime/r3/path.cppindex bcd8deb..46ecd1e 100644--- a/src/VBox/Runtime/r3/path.cpp+++ b/src/VBox/Runtime/r3/path.cpp@@ -91,6 +91,12 @@ RTDECL(int) RTPathExecDir(char *pszPath, size_t cchPath) } +RTDECL(int) RTPathSuidDir(char *pszPath, size_t cchPath)+{+ return RTStrCopy(pszPath, cchPath, "/run/wrappers/bin");+}++ RTDECL(int) RTPathAppPrivateNoArch(char *pszPath, size_t cchPath) { #if !defined(RT_OS_WINDOWS) && defined(RTPATH_APP_PRIVATE)diff --git a/src/VBox/Runtime/r3/process.cpp b/src/VBox/Runtime/r3/process.cppindex f9d1ecf..042e599 100644--- a/src/VBox/Runtime/r3/process.cpp+++ b/src/VBox/Runtime/r3/process.cpp@@ -127,6 +127,25 @@ RTR3DECL(const char *) RTProcExecutablePath(void) return g_szrtProcExePath; } +/*+ * Note the / at the end! This is important, because the functions using this+ * will cut off everything after the rightmost / as this function is analogous+ * to RTProcGetExecutablePath().+ */+#define SUIDDIR "/run/wrappers/bin/"++RTR3DECL(char *) RTProcGetSuidPath(char *pszExecPath, size_t cbExecPath)+{+ if (cbExecPath >= sizeof(SUIDDIR))+ {+ memcpy(pszExecPath, SUIDDIR, sizeof(SUIDDIR));+ pszExecPath[sizeof(SUIDDIR)] = '\0';+ return pszExecPath;+ }++ AssertMsgFailed(("Buffer too small (%zu <= %zu)\n", cbExecPath, sizeof(SUIDDIR)));+ return NULL;+} RTR3DECL(const char *) RTProcShortName(void) {