| 9 Aug 2022 |
 Winter (she/her) | * so yeah we can totally switch over | 20:16:11 |
| Winter (she/her) | ouch | 20:16:27 |
| Winter (she/her) | when do you run into that; do you use x86 systems? | 20:16:39 |
 @andreas.schraegle:helsinki-systems.de | x86 libs, which are needed for some software, building on x86_64 on xfs | 20:17:41 |
| @andreas.schraegle:helsinki-systems.de | haven't seen it again in quite a while though | 20:17:51 |
 @pennae:matrix.eno.space | how has this been a problem for eight years and still not fixed | 21:12:13 |
 vcunat | I had thought about trying these defines nixpkgs-wide (on i686 at least), but overall i686 is low on my priorities so I never got there. | 21:15:08 |
| vcunat | * I had thought about trying these defines to enable LFS nixpkgs-wide (on i686 at least), but overall i686 is low on my priorities so I never got there. | 21:15:43 |
 hexa | quick feedback: I love how much more attention we're paying to security issues compared to like a year ago | 21:52:59 |
| hexa | having a room where interested people can come together does wonders | 21:53:15 |
| hexa | there was #nixos-security on freenode before then, but in my memory it was much less active fwiw | 22:01:33 |
| @pennae:matrix.eno.space | having the space with its room listing is very useful for discoverability | 22:03:11 |
 @v0id:nltrix.net | so I have q regarding late sudo,pkexec vulns. The vulns itself are fixed in nixpkgs. How about the old binaries in nix store? Are there a mechanism to gc those vulnerable stuff? | 22:03:17 |
| @v0id:nltrix.net | I mean other than random nix-garbage-colled --delete-older-than xxd, how can I be sure they are gc'd? | 22:03:41 |
| @v0id:nltrix.net | Im interested in those with suid. | 22:03:51 |
| @pennae:matrix.eno.space | basically, not. but nothing in the store has suid/sgid, that's only per system activation. deleting old system generations will make old stuff lose its suidability forever | 22:04:39 |
| @v0id:nltrix.net | In reply to @pennae:matrix.eno.space
basically, not. but nothing in the store has suid/sgid, that's only per system activation. deleting old system generations will make old stuff lose its suidability forever is it possible to update the old gens with a "Vuln" mark so that we know they have something to gc? | 22:05:18 |
| @v0id:nltrix.net | Like gen 52 is vulnerable please remove me etc. | 22:05:36 |
| @pennae:matrix.eno.space | each generation embeds its git hash, you could check that in a separate scan | 22:06:00 |
| @v0id:nltrix.net | so when an old gen is not active, is it possible to reach that suid an dexec or they are just lying around as normal bins? | 22:06:57 |
| @v0id:nltrix.net | If that's the case I guess there is nothing to worry about. | 22:07:10 |
| @pennae:matrix.eno.space | the suids are all in /run/wrappers and generated by the activation script. only that which corresponds to the active system is ever suid-able | 22:07:55 |
| @v0id:nltrix.net | That's great to hear, how about booted-system vs current-system? say booted one has a vuln one and current does not? | 22:09:17 |
| @pennae:matrix.eno.space | you can get those back by activating booted-system, but the suids aren't kept around | 22:11:17 |
| @pennae:matrix.eno.space | https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/modules/security/wrappers/default.nix#L250 is the activation fragment that actually generates them, activating a generation removes wrappers from the previous. you can keep them around if activation fails though | 22:11:53 |
| @v0id:nltrix.net | thnx for clarification. | 22:11:56 |
| @v0id:nltrix.net | * thnx for clarifications. | 22:13:35 |
| hexa | https://github.com/NixOS/nixpkgs/pull/156822 | 22:15:48 |
| hexa | this one was also fun | 22:15:51 |
| hexa | it was in the aftermath of the pkexec issue that we fixed our suid wrapper from running into similar issues | 22:16:18 |
