In Nix, glibc libraries lack rpath entries pointing to themselves,
so libc.so.6 and ld-linux-*.so.* can never be resolved through rpath
alone during initrd generation. They are always present in the initrd
through other paths (the ELF interpreter and other binaries' rpath
entries).
The scripted initrd builder (stage-1.nix findLibs) already skips
ld*.so.? for the same reason. This brings make-initrd-ng in line
with that precedent.
Also removes two unused imports (PermissionsExt, Command) and moves
the remaining warning output from stdout to stderr.
Closes#463894Closes#282145Closes#399281
We want to strip the write bit from files after we copied them.
XOR is not the right operator for this, since if the bit is 0 in both
the actual permissions and the mask, then the result will be a 1.
So in practice, we were assigning write permissions for group and others
to all files and we were only stripping the write permissions of the
owner (since the owner had write permissions, and so the result of the
XOR is 0).
The correct thing to do is to AND with the maximum permissions that we
want to maintain (which is the inverse of what we want to strip), so
that only those bits are preserved and the others are always set to 0.
Previously, all initrd ELFs would be made *world-writable*.
This commit sets the write bit for the file owner exclusively, and
removes it when done. It also sets the umask so that files don't
implicitly become writable for other users by mistake.
Fixes: https://github.com/NixOS/nixpkgs/security/advisories/GHSA-m7pq-h9p4-8rr4
Reported-By: sudoBash418 <sudobash418@gmail.com>
The current error message is hard to debug because the error is in the
nix store:
> Error: failed to parse JSON in
"/build/.attr-1s42g1c76fxb77skzq0b4wdhcrg8jmzb54czmxvh1qm7psgsbcni"
>
> Caused by:
> missing field `source` at line 1 column 102
>
> Location:
> src/main.rs:329:10
It's extremely frustrating seeing "Error: Os { code: 13, kind:
PermissionDenied, message: "Permission denied" }" without any hint as to
where exactly that occurred.
This commit fixes that by adding context to most errors.
Now the tool will only strip binaries if a strip executable is passed
via the STRIP environment variable. This is exposed via the strip
option for makeInitrdNG and the NixOS option boot.initrd.systemd.strip.
