bug#28751: GuixSD setuid-programs handling creates setuid binaries in the store

[Ludovic Courtès]

Leo Famulari <address@hidden> skribis:

> On Sun, Oct 08, 2017 at 09:54:22PM +0200, Ludovic Courtès wrote:
>> address@hidden (Ludovic Courtès) skribis:
>> > address@hidden (Ludovic Courtès) skribis:
>> >
>> >> On GuixSD, ‘activate-setuid-programs’ in (gnu build activation) would
>> >> create setuid-root binaries under /gnu/store for all the programs listed
>> >> under ‘setuid-programs’ in the ‘operating-system’ declaration.
>> >
>> > Fixed by
>> > <https://git.savannah.gnu.org/cgit/guix.git/commit/?id=5e66574a128937e7f2fcf146d146225703ccfd5d>.
>> 
>> Detailed announcement at:
>> 
>>   https://lists.gnu.org/archive/html/guix-devel/2017-10/msg00090.html
>
> FYI, this was assigned CVE-2017-1000455.
>
> I just received this JSON from the Distributed Weakness Filing project
> (DWF) in response to my CVE application:
>
> {"data_version": "4.0","references": {"reference_data": [{"url": 
> "https://lists.gnu.org/archive/html/guix-devel/2017-10/msg00090.html"}]},"description":
>  {"description_data": [{"lang": "eng","value": "GuixSD prior to Git commit 
> 5e66574a128937e7f2fcf146d146225703ccfd5d used POSIX hard links incorrectly, 
> leading the creation of setuid executables in \"the store\", violating a 
> fundamental security assumption of GNU Guix."}]},"data_type": 
> "CVE","affects": {"vendor": {"vendor_data": [{"product": {"product_data": 
> [{"version": {"version_data": [{"version_value": "All versions of GuixSD 
> prior to Git commit 
> 5e66574a128937e7f2fcf146d146225703ccfd5d"}]},"product_name": 
> "GuixSD"}]},"vendor_name": "GNU Guix"}]}},"CVE_data_meta": {"DATE_ASSIGNED": 
> "2017-12-29","ID": "CVE-2017-1000455","ASSIGNER": 
> "address@hidden","REQUESTER": "address@hidden"},"data_format": 
> "MITRE","problemtype": {"problemtype_data": [{"description": [{"lang": 
> "eng","value": "Insecure Permissions"}]}]}}
>
> I assume it will show up in the regular places (MITRE etc) eventually.

Great, thanks for following up!

Ludo’.