3 ms·
It seems like a binary cache can already get root on your system - it is serving you binaries to run, often as root. Don't authorize a binary cache you don't tr
by andrewchambers 2y ago
It seems like a binary cache can already get root on your system - it is serving you binaries to run, often as root. Don't authorize a binary cache you don't trust.
- ElvishJerricco 2y agoThe problem is that arbitrary users can cause nix to unpack arbitrary nars and edit arbitrary files that user shouldn't have permissions for. The system doesn't have to be configured to trust any particular binary cache. This is just straight up persistent privilege escalation, plain and simple.
- otabdeveloper4 2y ago> It seems like a binary cache can already get root on your system No, rootless Nix is pretty well supported.
- forgotpwd16 2y agoWondering how vulnerability applies outside NixOS. Does Nix outside NixOS also has such access over the system?