Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Document macOS sandbox security implications and __darwinAllowLocalNetworking #11488

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Document macOS sandbox security implications and __darwinAllowLocalNetworking #11488

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
34dd70d
Document __darwinAllowLocalNetworking sandbox exception
amarshall Sep 11, 2024
9492a64
Document that the macOS sandbox is not a security boundary
amarshall Sep 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 14 additions & 5 deletions src/libstore/globals.hh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -613,11 +613,20 @@ public:
`/dev`, `/dev/shm` and `/dev/pts` (on Linux), and the paths
configured with the `sandbox-paths` option. This is useful to
prevent undeclared dependencies on files in directories such as
`/usr/bin`. In addition, on Linux, builds run in private PID,
mount, network, IPC and UTS namespaces to isolate them from other
processes in the system (except that fixed-output derivations do
not run in private network namespace to ensure they can access the
network).
`/usr/bin`.

In addition, on Linux, builds run in private PID, mount, network,
IPC and UTS namespaces to isolate them from other processes in the
system (except that fixed-output derivations do not run in private
network namespace to ensure they can access the network).

On macOS, local port binding is disabled by default when the
sandbox is enabled. Derivations that have the
`__darwinAllowLocalNetworking` attribute set to `true` will have a
sandbox exception added to allow it.

The macOS sandbox has known limitations, and should not be
considered a strong security boundary.
Comment on lines +628 to +629
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To be honest I think this applies to the Linux one too. (The recent sandbox escape vulnerability worked on Linux but not macOS, even.)

Copy link
Member Author

@amarshall amarshall Sep 11, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the difference is in what we strive for. We know the macOS sandbox is deficient today, and has known sandbox escape vectors. But fixing them is either extremely difficult or impossible due to OS API limitations. Compared to Linux where we give it a CVE and (I think) generally expect to be able to fix it and do so with some urgency.

Nevertheless, I do think it is important to clarify the project’s stance on whether the Linux sandbox should be and is generally believed to be (barring unknown bugs) a security boundary.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess it depends on what you consider an escape. Information exfiltration or communication with a cooperating process outside the sandbox, yeah, but I don’t think there’s a known way to escalate out of the macOS sandbox to increase privileges?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that’s true.

However, part of my concern with the macOS sandbox in particular is that there are, afaik, zero tests for it (whereas the Linux sandbox has at least some). The macOS sandbox APIs provided by the OS are also notoriously under-documented, so what we think is okay today might not be with a future update or OS version—and there’s no tests to assure that. That outbound network requests were inadvertently allowed for so long is a big canary. So I think that, compared to the Linux sandbox, we shouldn’t “guarantee” so much.


Currently, sandboxing only work on Linux and macOS. The use of a
sandbox requires that Nix is run as root (so you should use the
Expand Down
Loading