search

NixOS / nixpkgs

Nix Packages collection & NixOS
MIT License
18.16k stars 14.19k forks source link

nobody/nogroup shouldn't be used #55370

Open peterhoeg opened 5 years ago

peterhoeg commented 5 years ago

Issue description

The problem with nobody/nogroup is that people expect them to be nobody while in fact they are somebody named nobody. And that somebody is then shared among all services using it.

Their only legitimate purpose is for NFS.

Here are all the files mentioning either - let's get them knocked off!

Generated as follows:

grep -E --recursive --files-with-matches -e nobody -e nogroup | sort -u | sed -E -e 's/(.*)/- \[ \] \1/g'
jabranham commented 5 years ago

See #31990 for syncthing

danbst commented 5 years ago

Can nixos tests be excluded from this list? Also, the command-fu to regerate this list would be appreciated.

aanderse commented 5 years ago

Also worth mentioning that this list isn't exhaustive as when a group isn't specified in some cases nogroup will be used which obviously makes it harder to track them all down.

peterhoeg commented 5 years ago

Can nixos tests be excluded from this list?

If we look at nixos/test/certmgr.nix, those tests should definitely be changed as their use of nobody/nogroup is not correct. That being said, nixos/tests/buildbot.nix is a false positive.

Also, the command-fu to regerate this list would be appreciated.

I have updated the original post with the grep invocation.

peterhoeg commented 5 years ago

Also worth mentioning that this list isn't exhaustive as when a group isn't specified in some cases nogroup will be used which obviously makes it harder to track them all down.

Correct, something like will help: 

sudo grep ' 65534 ' --files-with-matches /proc/**/gid_map
peterhoeg commented 4 years ago

I guess this was closed in error @Mic92?

Mic92 commented 4 years ago

@peterhoeg yes, it was closed by a merged pull request.

Mic92 commented 4 years ago

It would be better if instead of grep this would be an actual checklist.

peterhoeg commented 4 years ago

Sure, here you go.

Mic92 commented 4 years ago

I filtered out a few false-positive i.e. nobody was used in a comment/different context or its usage was legitimate.

aanderse commented 4 years ago

Sounds like murmur also needs to be fixed.

Mic92 commented 3 years ago

More instances: https://github.com/NixOS/nixpkgs/pull/119559

Mic92 commented 3 years ago

I think there are potentially even more instances.. If a service has a user without a group it also runs as nogroup.

rnhmjoj commented 3 years ago

I updated the list. After #126289 and #133166 a bunch of (old) offenders have been unmasked, so the count went up a bit. Meanwhile some modules have been fixed, but we're still halfway through.

Most of these modules should be fixed by switching to systemd DynamicUser, the remaining just need to add a users.group.something = {};. Similarly, some setgid/setuid wrappers should simply use root.

I think we should consider adding an annoying warning (learning from my systemd-udev-settle experience) for programs running as nobody/nogroup. I'm not sure how to implement it, though.

Mic92 commented 3 years ago

One does now actually get a warning on master if a user is missing a group. I think this should solve this issue here as modules no longer evaluate otherwise.

rnhmjoj commented 3 years ago

One does now actually get a warning on master if a user is missing a group. I think this should solve this issue here as modules no longer evaluate otherwise.

There are more way more cases than a system user missing a group:

  1. chowning to nobody
  2. running/dropping privileges as nobody:nogroup
  3. creating nobody:nogroup files

This should not be closed, yet.