Skip to content

fix: do not override system shadow utilities#402

Merged
picnoir merged 1 commit intomainfrom
security-wrappers-shadow
Mar 13, 2026
Merged

fix: do not override system shadow utilities#402
picnoir merged 1 commit intomainfrom
security-wrappers-shadow

Conversation

@jfroche
Copy link
Member

@jfroche jfroche commented Mar 12, 2026

Previously, the shadow binaries would be available in system-manager path but without the correct setuid permissions, which could lead to security issues and functionality problems.

This change ensures that the shadow binaries are not deployed in system-manager path.

@jfroche jfroche marked this pull request as draft March 12, 2026 17:51
@jfroche jfroche force-pushed the security-wrappers-shadow branch from 331e328 to ffb63ca Compare March 12, 2026 18:05
@jfroche jfroche changed the title fix: add missing shadow wrappers to system-manager fix: do not override system shadow utilities Mar 12, 2026
@jfroche jfroche force-pushed the security-wrappers-shadow branch from ffb63ca to c079374 Compare March 12, 2026 18:27
@jfroche jfroche linked an issue Mar 12, 2026 that may be closed by this pull request
Previously, the shadow binaries would be available in system-manager
path but without the correct setuid permissions, which could lead to
security issues and functionality problems.

This change ensures that the shadow binaries are not deployed in system-manager
path.
@jfroche jfroche force-pushed the security-wrappers-shadow branch from c079374 to 7fb2265 Compare March 12, 2026 18:33
@jfroche jfroche marked this pull request as ready for review March 12, 2026 18:34
@picnoir
Copy link
Member

picnoir commented Mar 13, 2026

This issue is a symptom of #404

This is more a band-aid than a proper fix. But I guess it's better than nothing. Merging.

@picnoir picnoir merged commit 1272183 into main Mar 13, 2026
4 checks passed
@picnoir picnoir deleted the security-wrappers-shadow branch March 13, 2026 10:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Non-functioning setuid binaries from pkgs.shadow installed by default

2 participants