22/27: Tighten permissions on chroot directories

[Ludovic Courtès]

civodul pushed a commit to branch nix
in repository guix.

commit 1f595ba474d8112e73df1ef7578014e59ebfccd0
Author: Eelco Dolstra <address@hidden>
Date:   Tue Mar 24 11:35:53 2015 +0100

    Tighten permissions on chroot directories
---
 nix/libstore/build.cc |   14 ++++++++++++--
 1 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/nix/libstore/build.cc b/nix/libstore/build.cc
index 7153c85..9a69a79 100644
--- a/nix/libstore/build.cc
+++ b/nix/libstore/build.cc
@@ -1768,6 +1768,12 @@ void DerivationGoal::startBuilder()
 
         printMsg(lvlChatty, format("setting up chroot environment in `%1%'") % 
chrootRootDir);
 
+        if (mkdir(chrootRootDir.c_str(), 0750) == -1)
+            throw SysError(format("cannot create ‘%1%’") % chrootRootDir);
+
+        if (chown(chrootRootDir.c_str(), 0, buildUser.getGID()) == -1)
+            throw SysError(format("cannot change ownership of ‘%1%’") % 
chrootRootDir);
+
         /* Create a writable /tmp in the chroot.  Many builders need
            this.  (Of course they should really respect $TMPDIR
            instead.) */
@@ -1818,8 +1824,12 @@ void DerivationGoal::startBuilder()
            can be bind-mounted).  !!! As an extra security
            precaution, make the fake Nix store only writable by the
            build user. */
-        createDirs(chrootRootDir + settings.nixStore);
-        chmod_(chrootRootDir + settings.nixStore, 01777);
+        Path chrootStoreDir = chrootRootDir + settings.nixStore;
+        createDirs(chrootStoreDir);
+        chmod_(chrootStoreDir, 0730);
+
+        if (chown(chrootStoreDir.c_str(), 0, buildUser.getGID()) == -1)
+            throw SysError(format("cannot change ownership of ‘%1%’") % 
chrootStoreDir);
 
         foreach (PathSet::iterator, i, inputPaths) {
             struct stat st;