Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

nobody/nogroup shouldn't be used #55370

Open
50 of 89 tasks
peterhoeg opened this issue Feb 7, 2019 · 16 comments · Fixed by #80998
Open
50 of 89 tasks

nobody/nogroup shouldn't be used #55370

peterhoeg opened this issue Feb 7, 2019 · 16 comments · Fixed by #80998
Assignees
@peterhoeg
Labels
1.severity: security Issues which raise a security issue, or PRs that fix one 3.skill: sprintable A larger issue which is split into distinct actionable tasks 5. scope: tracking Long-lived issue tracking long-term fixes or multiple sub-problems 6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS

Comments

@peterhoeg
Copy link
Member

peterhoeg commented Feb 7, 2019 •
edited by srhb
Loading

Issue description

The problem with nobody/nogroup is that people expect them to be nobody while in fact they are somebody named nobody. And that somebody is then shared among all services using it.

Their only legitimate purpose is for NFS.

Here are all the files mentioning either - let's get them knocked off!

  • lib/systems/parse.nix
  • nixos/doc/manual/development/writing-nixos-tests.section.md
  • nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml
  • nixos/doc/manual/from_md/release-notes/rl-1909.section.xml
  • nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
  • nixos/doc/manual/release-notes/rl-1909.section.md
  • nixos/doc/manual/release-notes/rl-2111.section.md
  • nixos/modules/config/users-groups.nix
  • nixos/modules/misc/ids.nix
  • nixos/modules/misc/locate.nix
  • nixos/modules/programs/ccache.nix
  • nixos/modules/programs/mosh.nix
  • nixos/modules/security/google_oslogin.nix
  • nixos/modules/security/tpm2.nix
  • nixos/modules/security/wrappers/default.nix
  • nixos/modules/services/audio/icecast.nix
  • nixos/modules/services/audio/ympd.nix
  • nixos/modules/services/backup/mysql-backup.nix
  • nixos/modules/services/cluster/kubernetes/default.nix
  • nixos/modules/services/development/hoogle.nix
  • nixos/modules/services/hardware/triggerhappy.nix
  • nixos/modules/services/logging/heartbeat.nix
  • nixos/modules/services/mail/freepops.nix
  • nixos/modules/services/mail/mailman.nix
  • nixos/modules/services/mail/opensmtpd.nix
  • nixos/modules/services/mail/postfix.nix
  • nixos/modules/services/misc/cpuminer-cryptonight.nix
  • nixos/modules/services/misc/mwlib.nix
  • nixos/modules/services/misc/sssd.nix
  • nixos/modules/services/misc/tautulli.nix
  • nixos/modules/services/network-filesystems/diod.nix
  • nixos/modules/services/network-filesystems/rsyncd.nix
  • nixos/modules/services/network-filesystems/samba.nix
  • nixos/modules/services/network-filesystems/u9fs.nix
  • nixos/modules/services/network-filesystems/yandex-disk.nix
  • nixos/modules/services/networking/atftpd.nix
  • nixos/modules/services/networking/cjdns.nix
  • nixos/modules/services/networking/dhcpd.nix
  • nixos/modules/services/networking/firewall.nix
  • nixos/modules/services/networking/htpdate.nix
  • nixos/modules/services/networking/hylafax/default.nix
  • nixos/modules/services/networking/ircd-hybrid/ircd.conf
  • nixos/modules/services/networking/nix-serve.nix
  • nixos/modules/services/networking/ntopng.nix
  • nixos/modules/services/networking/ntp/ntpd.nix
  • nixos/modules/services/networking/ocserv.nix
  • nixos/modules/services/networking/oidentd.nix
  • nixos/modules/services/networking/powerdns.nix
  • nixos/modules/services/networking/quicktun.nix
  • nixos/modules/services/networking/rpcbind.nix
  • nixos/modules/services/networking/shadowsocks.nix
  • nixos/modules/services/networking/smokeping.nix
  • nixos/modules/services/networking/ssh/sshd.nix
  • nixos/modules/services/networking/stunnel.nix
  • nixos/modules/services/networking/syncplay.nix
  • nixos/modules/services/networking/unbound.nix
  • nixos/modules/services/networking/xinetd.nix
  • nixos/modules/services/web-apps/mattermost.nix
  • nixos/modules/services/web-servers/jboss/default.nix
  • nixos/modules/services/web-servers/mighttpd2.nix
  • nixos/modules/services/web-servers/shellinabox.nix
  • nixos/modules/services/x11/desktop-managers/cde.nix
  • nixos/modules/services/x11/display-managers/default.nix
  • nixos/modules/tasks/filesystems/nfs.nix
  • nixos/modules/virtualisation/oci-containers.nix
  • nixos/tests/buildbot.nix
  • nixos/tests/gitolite.nix
  • nixos/tests/hardened.nix
  • nixos/tests/shadowsocks/common.nix
  • pkgs/applications/misc/ikiwiki/default.nix
  • pkgs/applications/misc/rofi/default.nix
  • pkgs/applications/networking/sync/rsync/default.nix
  • pkgs/applications/version-management/git-up/default.nix
  • pkgs/applications/video/vlc/default.nix
  • pkgs/applications/virtualization/crosvm/update.py
  • pkgs/build-support/docker/default.nix
  • pkgs/build-support/docker/examples.nix
  • pkgs/build-support/fetchfossil/builder.sh
  • pkgs/development/tools/build-managers/bazel/bazel_0_29/default.nix
  • pkgs/development/tools/build-managers/bazel/bazel_1/default.nix
  • pkgs/development/tools/build-managers/bazel/bazel_3/default.nix
  • pkgs/misc/vim-plugins/overrides.nix
  • pkgs/os-specific/linux/syslinux/default.nix
  • pkgs/servers/http/couchdb/2.0.0.nix
  • pkgs/servers/hylafaxplus/post-patch.sh
  • pkgs/servers/mail/exim/default.nix
  • pkgs/servers/news/leafnode/default.nix
  • pkgs/tools/graphics/povray/default.nix
  • pkgs/tools/misc/moreutils/default.nix

Generated as follows:

grep -E --recursive --files-with-matches -e nobody -e nogroup | sort -u | sed -E -e 's/(.*)/- \[ \] \1/g'
@jabranham
Copy link
Contributor

See #31990 for syncthing

@peterhoeg peterhoeg self-assigned this Feb 9, 2019
@aanderse aanderse mentioned this issue Mar 6, 2019
Merged
10 tasks
@arianvp arianvp mentioned this issue Apr 10, 2019
Merged
10 tasks
@basvandijk basvandijk mentioned this issue Apr 10, 2019
Merged
10 tasks
basvandijk added a commit to basvandijk/nixpkgs that referenced this issue Apr 10, 2019
@basvandijk
nixos/prometheus/alertmanager: use DynamicUser instead of nobody
cd4486e 
See issue NixOS#55370
@aanderse aanderse mentioned this issue May 23, 2019
Merged
10 tasks
aanderse added a commit to aanderse/nixpkgs that referenced this issue May 25, 2019
@aanderse
nixos/nagios: change group from nogroup to nagios
609c158 
see NixOS#55370
This was referenced May 25, 2019
Merged
Merged
@matthewbauer matthewbauer added this to the 19.09 milestone May 27, 2019
This was referenced Jul 5, 2019
Open
Merged
@danbst
Copy link
Contributor

danbst commented Jul 23, 2019

Can nixos tests be excluded from this list? Also, the command-fu to regerate this list would be appreciated.

@aanderse
Copy link
Member

Also worth mentioning that this list isn't exhaustive as when a group isn't specified in some cases nogroup will be used which obviously makes it harder to track them all down.

@peterhoeg
Copy link
Member Author

Can nixos tests be excluded from this list?

If we look at nixos/test/certmgr.nix, those tests should definitely be changed as their use of nobody/nogroup is not correct. That being said, nixos/tests/buildbot.nix is a false positive.

Also, the command-fu to regerate this list would be appreciated.

I have updated the original post with the grep invocation.

@peterhoeg
Copy link
Member Author

Also worth mentioning that this list isn't exhaustive as when a group isn't specified in some cases nogroup will be used which obviously makes it harder to track them all down.

Correct, something like will help:

sudo grep ' 65534 ' --files-with-matches /proc/**/gid_map

@WilliButz WilliButz mentioned this issue Aug 2, 2019
Merged
10 tasks
@FRidh FRidh added the 6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS label Sep 9, 2019
@WilliButz WilliButz mentioned this issue Nov 24, 2019
Merged
10 tasks
@mmilata mmilata mentioned this issue Feb 25, 2020
Merged
10 tasks
@peterhoeg
Copy link
Member Author

I guess this was closed in error @Mic92?

@peterhoeg peterhoeg reopened this Feb 25, 2020
@Mic92
Copy link
Member

Mic92 commented Feb 25, 2020

@peterhoeg yes, it was closed by a merged pull request.

@mmilata mmilata mentioned this issue Feb 25, 2020
Merged
10 tasks
@aanderse aanderse mentioned this issue Oct 15, 2020
Merged
10 tasks
@aanderse
Copy link
Member

aanderse commented Oct 29, 2020 •
edited
Loading

Sounds like murmur also needs to be fixed.

@pstn pstn mentioned this issue Oct 29, 2020
Merged
10 tasks
@Taneb Taneb mentioned this issue Oct 29, 2020
Merged
10 tasks
@aanderse aanderse mentioned this issue Mar 7, 2021
Merged
10 tasks
@aanderse aanderse mentioned this issue Apr 1, 2021
Open
10 tasks
@Mic92
Copy link
Member

Mic92 commented Apr 16, 2021

More instances: #119559

@Mic92
Copy link
Member

Mic92 commented Apr 16, 2021

I think there are potentially even more instances.. If a service has a user without a group it also runs as nogroup.

@veprbl veprbl removed this from the 19.09 milestone May 31, 2021
@rnhmjoj rnhmjoj added the 1.severity: security Issues which raise a security issue, or PRs that fix one label Jun 12, 2021
@rnhmjoj rnhmjoj mentioned this issue Jun 12, 2021
Closed
@bjornfor bjornfor mentioned this issue Jul 23, 2021
Closed
11 tasks
@austinbutler austinbutler mentioned this issue Sep 20, 2021
Merged
12 tasks
@rnhmjoj
Copy link
Contributor

rnhmjoj commented Sep 21, 2021 •
edited
Loading

I updated the list. After #126289 and #133166 a bunch of (old) offenders have been unmasked, so the count went up a bit.
Meanwhile some modules have been fixed, but we're still halfway through.

Most of these modules should be fixed by switching to systemd DynamicUser, the remaining just need to add a users.group.something = {};. Similarly, some setgid/setuid wrappers should simply use root.

I think we should consider adding an annoying warning (learning from my systemd-udev-settle experience) for programs running as nobody/nogroup. I'm not sure how to implement it, though.

@Mic92
Copy link
Member

Mic92 commented Sep 21, 2021

One does now actually get a warning on master if a user is missing a group. I think this should solve this issue here as modules no longer evaluate otherwise.

@Mic92 Mic92 closed this as completed Sep 21, 2021
@rnhmjoj
Copy link
Contributor

rnhmjoj commented Sep 22, 2021

One does now actually get a warning on master if a user is missing a group. I think this should solve this issue here as modules no longer evaluate otherwise.

There are more way more cases than a system user missing a group:

  1. chowning to nobody
  2. running/dropping privileges as nobody:nogroup
  3. creating nobody:nogroup files

This should not be closed, yet.

@Mic92 Mic92 reopened this Sep 22, 2021
This was referenced Sep 29, 2021
Merged
Merged
@aanderse aanderse mentioned this issue Nov 30, 2021
Closed
13 tasks
oxzi added a commit to oxzi/nixpkgs that referenced this issue Jan 14, 2023
@oxzi
nixos/ympd: Unit hardening
218de01 
Next to some systemd unit hardening, the nobody user isn't used anymore,
as suggested in NixOS#55370.
@oxzi oxzi mentioned this issue Jan 14, 2023
Merged
13 tasks
Mindavi pushed a commit that referenced this issue Feb 9, 2023
@oxzi @Mindavi
nixos/ympd: Unit hardening
63dd9fb 
Next to some systemd unit hardening, the nobody user isn't used anymore,
as suggested in #55370.
gador pushed a commit to gador/nixpkgs that referenced this issue Feb 13, 2023
@oxzi @gador
nixos/ympd: Unit hardening
b0f7820 
Next to some systemd unit hardening, the nobody user isn't used anymore,
as suggested in NixOS#55370.
@benaryorg benaryorg mentioned this issue Apr 17, 2023
Closed
@benaryorg benaryorg mentioned this issue May 11, 2023
Merged
12 tasks
@samueldr samueldr added the 5. scope: tracking Long-lived issue tracking long-term fixes or multiple sub-problems label Apr 23, 2024
@PedroRegisPOAR PedroRegisPOAR mentioned this issue Jun 22, 2024
Merged
13 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@peterhoeg peterhoeg

Labels
1.severity: security Issues which raise a security issue, or PRs that fix one 3.skill: sprintable A larger issue which is split into distinct actionable tasks 5. scope: tracking Long-lived issue tracking long-term fixes or multiple sub-problems 6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

nixos/parsoid: fix service by reinstating nodePackages.parsoid mmilata/nixpkgs