From e531520ddcd54903bbea0f3ce08dfbed830f40aa Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Tue, 2 Jun 2015 02:21:54 +0200 Subject: [PATCH] Don't let unprivileged users repair paths --- nix/nix-daemon/nix-daemon.cc | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/nix/nix-daemon/nix-daemon.cc b/nix/nix-daemon/nix-daemon.cc index 96a4e4b773..2b89190dbe 100644 --- a/nix/nix-daemon/nix-daemon.cc +++ b/nix/nix-daemon/nix-daemon.cc @@ -648,13 +648,15 @@ static void performOp(bool trusted, unsigned int clientVersion, break; case wopVerifyStore: { - bool checkContents = readInt(from) != 0; - bool repair = readInt(from) != 0; - startWork(); - bool errors = store->verifyStore(checkContents, repair); - stopWork(); - writeInt(errors, to); - break; + bool checkContents = readInt(from) != 0; + bool repair = readInt(from) != 0; + startWork(); + if (repair && !trusted) + throw Error("you are not privileged to repair paths"); + bool errors = store->verifyStore(checkContents, repair); + stopWork(); + writeInt(errors, to); + break; } default: