From c945723356c17f0570217dedefac645721d6fb70 Mon Sep 17 00:00:00 2001 From: rnhmjoj Date: Fri, 8 Sep 2023 08:58:31 +0200 Subject: [PATCH] buildFHSEnv: disable security features by default The implicit contract of buildFHSUserEnv was that it allows to run software built for a typical GNU/Linux distribution (not NixOS) without patching it (patchelf, autoPatchelfHook, etc.). Note that this does not inherently imply running untrusted programs. buildFHSUserEnv was implemented by using chroot and assembling a standard-compliant FHS environment in the new root. As expected, this did not provide any kind of isolation between the system and the programs. However, when it was later reimplemented using bubblewrap (PR #225748), which *is* a security tool, several isolation features involving detaches Linux namespaces were turned on by default. This decision has introduced a number of breakages that are very difficult to debug and trace back to this change. For example: `unshareIPC` breaks software audio mixing in programs using ALSA (dmix) and `unsharePID` breaks gdb, Since: 1. the security features were enable without any clear threat model; 2. `buildFHSEnvBubblewrap` is supposed to be a drop-in replacement of `buildFHSEnvChrootenv` (see the release notes for NixOS 23.05); 3. the change is breaking in several common cases (security does not come for free); 4. the contract was not changed, or at least communicated in a clear way to the users; all security features should be turned off by default. P.S. It would be useful to create a variant of buildFHSEnv that does provide some isolation. This could unshare some namespaces and mount only limited parts of the filesystem. Note that buildFHSEnv mounts every directory in / under the new root, so again, very little is gained by unsharing alone. --- pkgs/build-support/build-fhsenv-bubblewrap/default.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix index 6c9b71624c2b..5e8894d7cb33 100644 --- a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix +++ b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix @@ -17,12 +17,12 @@ , meta ? {} , passthru ? {} , extraBwrapArgs ? [] -, unshareUser ? true -, unshareIpc ? true -, unsharePid ? true +, unshareUser ? false +, unshareIpc ? false +, unsharePid ? false , unshareNet ? false -, unshareUts ? true -, unshareCgroup ? true +, unshareUts ? false +, unshareCgroup ? false , dieWithParent ? true , ... } @ args: