Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

wireguard module: generatePrivateKeyFile: Fix chmod security race #121294

Merged
merged 2 commits into from
May 3, 2021
Merged

wireguard module: generatePrivateKeyFile: Fix chmod security race #121294

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0dc08b4
wireguard module: generatePrivateKeyFile: Fix chmod security race. Fi…
nh2 Apr 30, 2021
a874a8a
release notes: Mention wireguard `generatePrivateKeyFile` permission …
nh2 Apr 30, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions nixos/doc/manual/release-notes/rl-2105.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -333,6 +333,17 @@
<literal>vim</literal> switched to Python 3, dropping all Python 2 support.
</para>
</listitem>
<listitem>
<para>
<link linkend="opt-networking.wireguard.interfaces">networking.wireguard.interfaces.&lt;name&gt;.generatePrivateKeyFile</link>,
which is off by default, had a <literal>chmod</literal> race condition
fixed. As an aside, the parent directory's permissions were widened,
and the key files were made owner-writable.
This only affects newly created keys.
However, if the exact permissions are important for your setup, read
<link xlink:href="https://github.com/NixOS/nixpkgs/pull/121294">#121294</link>.
</para>
</listitem>
<listitem>
<para>
<link linkend="opt-boot.zfs.forceImportAll">boot.zfs.forceImportAll</link>
Expand Down
13 changes: 8 additions & 5 deletions nixos/modules/services/networking/wireguard.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -246,12 +246,15 @@ let
};

script = ''
mkdir --mode 0644 -p "${dirOf values.privateKeyFile}"
set -e
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is automatic:

nixpkgs/nixos/modules/system/boot/systemd.nix

Line 213 in c709fd4

#!${pkgs.runtimeShell} -e

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, but who knows if it will stay that way forever; thus especially for the more sensitive stuff, it may be good to be explicit.

(Also evidently a ton of shell users don't know about set -e, that it's off by default, and on-by-default in some NixOS scripts, so they may get surprises when copying scripts from one place to the other.)


# If the parent dir does not already exist, create it.
# Otherwise, does nothing, keeping existing permisions intact.
mkdir -p --mode 0755 "${dirOf values.privateKeyFile}"

if [ ! -f "${values.privateKeyFile}" ]; then
touch "${values.privateKeyFile}"
chmod 0600 "${values.privateKeyFile}"
wg genkey > "${values.privateKeyFile}"
chmod 0400 "${values.privateKeyFile}"
# Write private key file with atomically-correct permissions.
(set -e; umask 077; wg genkey > "${values.privateKeyFile}")
fi
'';
};
Expand Down