scripts: substitute: restrict where "file://" URIs can be used [security fix].

There are two potential places where file:// URIs could be used in 'guix
substitute':
1. The substitute urls, which are used for fetching narinfos.  These can come
   from the daemon, via daemon option "substitute-urls", from the client, via
   daemon option "untrusted-substitute-urls", or from 'guix discover'.  The
   latter two must not be allowed to provide file:// URIs, since that could be
   used to cause the daemon to read private files, files in /proc or /dev,
   etc, and various parts of those files may show up in the backtrace from
   'guix substitute'.

2. The narinfos themselves, which may offer arbitrarily many URIs to download
   the nar of the store item in question.  These URIs do not need to be
   in the signed portion of the narinfo, so they may be attacker-controlled.
   These should also not be allowed to provide file:// URIs, with the sole
   exception being in the case of the test suite for the sake of simplifying
   the tests.

To accomplish this, we error out of 'guix substitute' if
"untrusted-substitute-urls" includes a file:// URI, and we filter out all
file:// URIs from those provided by 'guix discover'.  We also ignore all
narinfos containing file:// URIs unless '%allow-unsafe-substitute-uris?' is #t.

* guix/scripts/substitute.scm (%allow-unsafe-substitute-uris?,
  %allow-unsafe-narinfo-uris?): new parameters.
  (process-substitution, process-substitution/fallback): honor
  '%allow-unsafe-substitute-uris?'.
  (uri-safe?, narinfo-uris-safe?, assert-safe-uris): new procedures.
  (%default-substitute-urls): use assert-safe-uris for the
  "untrusted-substitute-urls" daemon option.
  (%local-substitute-urls): filter out file:// URIs.
* tests/substitute.scm ("file:// URI prohibited by default"): new test.  Set
  '%allow-unsafe-substitute-uris?' to #t after it finishes.

Change-Id: I34d7e58b5a01c7cc61b52fcd61b547bba2ce4300
Signed-off-by: Ludovic Courtès <ludo@gnu.org>

1 files changed, 20 insertions, 0 deletions

diff --git a/tests/substitute.scm b/tests/substitute.scm
index cd75d56b981..10b74db084e 100644
--- a/tests/substitute.scm
+++ b/tests/substitute.scm
@@ -206,6 +206,26 @@ a file for NARINFO."
 ;; daemon.
 (%reply-file-descriptor #f)
 
+(test-equal "file:// URI prohibited by default"
+  "not-found\n"
+  (with-output-to-string
+    (lambda ()
+      (%allow-unsafe-substitute-uris? #f)
+      (let ((narinfo %narinfo))
+        (with-narinfo (string-append narinfo "Signature: "
+                                     (signature-field narinfo) "\n")
+          (call-with-temporary-directory
+           (lambda (directory)
+             (with-input-from-string (string-append
+                                      "substitute " (%store-prefix)
+                                      "/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-foo "
+                                      directory "/shouldnotbewritten\n")
+               (lambda ()
+                 (guix-substitute "--substitute"))))))))))
+
+;; Allow these for ease of testing for the rest of the tests
+(%allow-unsafe-substitute-uris? #t)
+
 
 (test-equal "query narinfo without signature"
   ""                                              ; not substitutable