Re: Handling ‘file’ CVE

[Ludovic Courtès]

Mark H Weaver <address@hidden> skribis:

> FWIW, I think it would be better for 'file' to be bound to the fixed
> package, and to add a 'file/fixed' that points to the old buggy one.
> Then 'file/fixed' could be used in some selected places.
>
> 'file' is used as a plain input (as opposed to native-input) in several
> places that make me a bit nervous, e.g. the 'transmission' bittorrent
> client (is 'file' being used at runtime on downloaded files?), and also
> 'aegis', 'quilt', and 'cmake'.

This script helps determine this:

(use-modules (guix) (gnu)
             (gnu packages file)
             (ice-9 match)
             (srfi srfi-1)
             (srfi srfi-26))

(define (file-input? inputs)
  (find (match-lambda
         ((label (? package? p) . _)
          (eq? p file))
         (_ #f))
        inputs))

(define (packages-using-file)
  (fold-packages (lambda (package result)
                   (if (or (file-input? (package-inputs package))
                           (file-input? (package-propagated-inputs package)))
                       (cons package result)
                       result))
                 '()))

(define (has-runtime-dependency-on-file? package)
  (with-store store
    (let* ((file (package-full-name file))
           (drv  (package-derivation store package))
           (outs (map cdr (derivation->output-paths drv)))
           (info (substitutable-path-info store outs)))
      (find (lambda (info)
              (find (cut string-suffix? file <>)
                    (substitutable-references info)))
            info))))

(define (packages-with-runtime-dependency-on-file)
  (filter has-runtime-dependency-on-file?
          (packages-using-file)))

The result is:

--8<---------------cut here---------------start------------->8---
scheme@(guile-user)> (packages-with-runtime-dependency-on-file)
$8 = (#<package quilt-0.61 gnu/packages/patchutils.scm:85 41f5240> #<package 
aegis-4.24 gnu/packages/version-control.scm:491 383c240>)
--8<---------------cut here---------------end--------------->8---

These two packages are leaves, so it’s fine to change them to use the
fixed ‘file’.  Done in 351d690.

> Finally, 'file' is a propagated-input for 'intltool', which means that
> if anyone installs 'intltool' in their profile, they will have the buggy
> 'file' in their PATH.

This one is more problematic.  We can try to apply Eric’s patch, but
that’s a lot of rebuild.

Thanks for the analysis,
Ludo’.