{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/47860","repository_url":"https://api.github.com/repos/NixOS/nixpkgs","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/47860/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/47860/comments","events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/47860/events","html_url":"https://github.com/NixOS/nixpkgs/issues/47860","id":366699770,"node_id":"MDU6SXNzdWUzNjY2OTk3NzA=","number":47860,"title":"security concerns of nix store paths in grub.cfg","user":{"login":"volth","id":508305,"node_id":"MDQ6VXNlcjUwODMwNQ==","avatar_url":"https://avatars3.githubusercontent.com/u/508305?v=4","gravatar_id":"","url":"https://api.github.com/users/volth","html_url":"https://github.com/volth","followers_url":"https://api.github.com/users/volth/followers","following_url":"https://api.github.com/users/volth/following{/other_user}","gists_url":"https://api.github.com/users/volth/gists{/gist_id}","starred_url":"https://api.github.com/users/volth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/volth/subscriptions","organizations_url":"https://api.github.com/users/volth/orgs","repos_url":"https://api.github.com/users/volth/repos","events_url":"https://api.github.com/users/volth/events{/privacy}","received_events_url":"https://api.github.com/users/volth/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":12,"created_at":"2018-10-04T09:29:15Z","updated_at":"2018-10-05T14:52:34Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"## Issue description\r\n\r\nEven if LUKS encrypted volumes is used, unencrypted ```/boot/grub/grub.cfg``` has nix store paths:\r\n\r\n```\r\nmenuentry \"NixOS - Default\" {\r\nsearch --set=drive1 --fs-uuid 11111111-2222-3333-4444-555555555555\r\n  linux ($drive1)//kernels/11111111111111111111111111111111-linux-4.9.130-bzImage systemConfig=/nix/store/33333333333333333333333333333333-nixos-system-x220-19.03.1699 init=/nix/store/33333333333333333333333333333333-nixos-system-x220aj-19.03.1699 boot.shell_on_fail noibrs noibpb nopti noretpoline nospectre_v2 loglevel=4\r\n  initrd ($drive1)//kernels/22222222222222222222222222222222-initrd-initrd\r\n}\r\n```\r\n\r\nKnowing the hash of nix closure (```33333333333333333333333333333333``` in this example) allows the attacker to query nix caches (http-servers like ```cache.nixos.org``` or ```Cachix```; private ones can be found using ```Shodan.io```) and download the whole closure, which might contain sensitive information such as credentials to other resources (database servers, etc), SSL certificates, ...\r\n\r\nThis makes the hash of the system closure as well sensitive and it should not be left in the unencrypted area."},"comment":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/comments/427393040","html_url":"https://github.com/NixOS/nixpkgs/issues/47860#issuecomment-427393040","issue_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/47860","id":427393040,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNzM5MzA0MA==","user":{"login":"Ekleog","id":411447,"node_id":"MDQ6VXNlcjQxMTQ0Nw==","avatar_url":"https://avatars1.githubusercontent.com/u/411447?v=4","gravatar_id":"","url":"https://api.github.com/users/Ekleog","html_url":"https://github.com/Ekleog","followers_url":"https://api.github.com/users/Ekleog/followers","following_url":"https://api.github.com/users/Ekleog/following{/other_user}","gists_url":"https://api.github.com/users/Ekleog/gists{/gist_id}","starred_url":"https://api.github.com/users/Ekleog/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Ekleog/subscriptions","organizations_url":"https://api.github.com/users/Ekleog/orgs","repos_url":"https://api.github.com/users/Ekleog/repos","events_url":"https://api.github.com/users/Ekleog/events{/privacy}","received_events_url":"https://api.github.com/users/Ekleog/received_events","type":"User","site_admin":false},"created_at":"2018-10-05T14:52:34Z","updated_at":"2018-10-05T14:52:34Z","author_association":"CONTRIBUTOR","body":"@volth Hmm… that is a good point. Maybe you could open a RFC for having an encrypted binary cache protocol? Now, the only use case I could see is your having to serve your configuration to the whole internet for `nix-infect` (not sure exactly which nix-infect you're talking about, would you have a link?), as otherwise you could just use a private cache (eg. in a VPN). Maybe it'd be possible to fix `nix-infect` instead?"}}
{"actor":{"display_login":"Ekleog"}}