Secure flake sources before privileged updates

astaranix commented

2026-08-09 00:14:16 -04:00

Owner

Defaults nixos-updater.secured to true, migrates the configured source tree to root ownership, rejects unsafe ownership, writable permissions or ACLs, symlink targets, and local lock-file inputs before privileged updates, and preserves an explicit secured=false compatibility mode. Includes module and runtime regression coverage plus migration documentation.

astaranix added 1 commit

2026-08-09 00:14:16 -04:00

Harden privileged flake source handling 009af07817

Default nixos-updater.secured to true and migrate the configured source tree to root ownership during activation.

Before invoking Nix, secured services now reject unsafe source ownership, writable modes or ACLs, symlink targets, and local lock-file inputs. secured=false retains compatibility with user-owned development checkouts.

Add module and shell regression coverage and document the migration behavior.

astaranix added 1 commit

2026-08-09 00:46:54 -04:00

Close secured source validation races 663631dc67

Migrate user-owned source trees through an atomic copy/exchange so retained descriptors cannot mutate the configured source.

Validate raw symlink chains and normalized paths, reject control-character lock fields, and validate secured apply candidates before atomically installing them. Keep unsecured apply behavior unchanged and add focused migration/apply regressions.

astaranix added 1 commit

2026-08-09 00:59:35 -04:00

Fail closed on secured update bookkeeping c7c0e0b893

Propagate symlink-enumeration failures, normalize raw symlink targets, and create the pending-rebuild marker before installing a validated lock.

Use the option schema default without a competing policy definition so downstream mkDefault false compositions remain valid. Add regressions for each review finding.

astaranix added 1 commit

2026-08-09 01:29:43 -04:00

Constrain secured migration and persist rebuild state 814af69625

Require explicit migration opt-in for custom flake paths while retaining automatic /etc/nixos migration, and reject migration targets without flake.nix.

Synchronize pending-rebuild state before installing a validated lock so power loss across filesystems cannot leave an unapplied lock with no retry marker. Add regression coverage and update the security documentation.

astaranix merged commit 700117c180 into main

2026-08-11 10:13:16 -04:00

astaranix referenced this pull request from a commit

2026-08-11 10:13:17 -04:00

Merge pull request 'Secure flake sources before privileged updates' (#1) from jom/secure-flake-source into main

Rows
Columns

Secure flake sources before privileged updates #1