From 731917a800aaf7acbd8d20a0c45ac30d35204f32 Mon Sep 17 00:00:00 2001 From: Jörg Thalheim Date: Wed, 10 May 2017 09:52:11 +0100 Subject: cups: mount private /tmp printer driver and wrapper are often not written with security in mind. While reviewing https://github.com/NixOS/nixpkgs/pull/25654 I found a symlink-race vulnerability within the wrapper code, when writing unique files in /tmp. I expect this script to be reused in other models as well as similar vulnerabilities in the code of other vendors. Therefore I propose to make /tmp of cups.service private so that only processes with the same privileges are able to access these files. --- nixos/modules/services/printing/cupsd.nix | 2 ++ 1 file changed, 2 insertions(+) (limited to 'nixos/modules/services') diff --git a/nixos/modules/services/printing/cupsd.nix b/nixos/modules/services/printing/cupsd.nix index 7ce2ae38fb36..ba9f99e6a8fb 100644 --- a/nixos/modules/services/printing/cupsd.nix +++ b/nixos/modules/services/printing/cupsd.nix @@ -324,6 +324,8 @@ in fi ''} ''; + + serviceConfig.PrivateTmp = true; }; systemd.services.cups-browsed = mkIf avahiEnabled -- cgit 1.4.1