N\u00eb menaxherin e paketave Guix jan\u00eb zbuluar dob\u00ebsi (nuk jan\u00eb caktuar CVE) n\u00eb implementimin e komand\u00ebs s\u00eb brendshme \u201eguix substitute\u201c, e cila thirret automatikisht nga procesi i prapambetur guix-daemon gjat\u00eb kryerjes s\u00eb operacioneve t\u00eb instalimit t\u00eb paketave. Komanda p\u00ebrdoret p\u00ebr t\u00eb shkarkuar paketat binare t\u00eb mbledhura tashm\u00eb nga server\u00ebt e jasht\u00ebm duke verifikuar integritetin e tyre me an\u00eb t\u00eb n\u00ebnshkrimit dixhital. Dob\u00ebsia m\u00eb e rrezikshme lejon ekzekutimin e kodit n\u00eb m\u00ebnyr\u00eb t\u00eb distancuar n\u00eb sistemin e p\u00ebrdoruesit me t\u00eb drejtat n\u00ebn t\u00eb cilat ekzekutohet procesi i prapambetur guix-daemon. <\/p>\n
Problemi ndikon t\u00eb gjitha konfigurimet me procesin guix-daemon, pa marr\u00eb parasysh n\u00ebse ai ekzekutohet me privilegje root apo n\u00ebn nj\u00eb p\u00ebrdorues jo t\u00eb privilegjuar. P\u00ebr t\u00eb shfryt\u00ebzuar vulnerabilitetin, mjafton \u00e7do p\u00ebrpjekje p\u00ebr t\u00eb shkarkuar paketa binar\u00eb t\u00eb gatshme nga server<\/a>, n\u00ebn kontrollin e sulmuesit. N\u00eb k\u00ebt\u00eb rast, malware server<\/a> nuk \u00ebsht\u00eb e domosdoshme t\u00eb zgjidhet ose t\u00eb p\u00ebrmendet qartazi n\u00eb cil\u00ebsimet e p\u00ebrdoruesit \u2013 ai mund t\u00eb p\u00ebrcaktohet me an\u00eb t\u00eb opsionit \u201e--discover\u201c, i cili lejon z\u00ebvend\u00ebsimin e serverit gjat\u00eb nj\u00eb sulmi MITM. N\u00eb konfigurimet ku guix-daemon \u00ebsht\u00eb aktivizuar me privilegje t\u00eb rritura, nj\u00eb p\u00ebrdorues lokal mund t\u00eb kryej\u00eb nj\u00eb sulm n\u00ebse ka mund\u00ebsi lidhjeje me procesin e prapambetur p\u00ebrmes Unix-socket (n\u00eb m\u00ebnyr\u00eb t\u00eb paracaktuar i disponuesh\u00ebm p\u00ebr t\u00eb gjith\u00eb p\u00ebrdoruesit). <\/p>\n Dob\u00ebsia \u00ebsht\u00eb e pranishme n\u00eb trajtuesin \u201erestore-file\u201c, i cili p\u00ebrdoret p\u00ebr t\u00eb shp\u00ebrb\u00ebr\u00eb paketat gjat\u00eb ngarkimit, pa pritur p\u00ebr ngarkimin dhe verifikimin e plot\u00eb t\u00eb arkivit t\u00eb ngarkuar me n\u00ebnshkrimin dixhital. Problemi shkaktohet nga mungesa e verifikimit t\u00eb pranis\u00eb s\u00eb simboleve \u201e.\u201c , \u201e\/\u201c dhe \u201e..\u201c n\u00eb shkurtimet e vendeve t\u00eb skedareve t\u00eb vendosura n\u00eb arkiv. P\u00ebrmes z\u00ebvend\u00ebsimit t\u00eb emrave t\u00eb skedar\u00ebve t\u00eb pap\u00ebrshtatsh\u00ebm n\u00eb arkiv, sulmuesi mund t\u00eb arrij\u00eb t\u00eb shkruaj\u00eb nj\u00eb skedar t\u00eb rast\u00ebsish\u00ebm n\u00eb \u00e7do pjes\u00eb t\u00eb sistemit t\u00eb skedarit, p\u00ebr aq sa lejojn\u00eb t\u00eb drejtat n\u00ebn t\u00eb cilat ekzekutohet procesi i prapambetur guix-daemon. <\/p>\n P\u00ebr t\u00eb organizuar ekzekutimin e kodit t\u00eb tij n\u00eb sistem, p\u00ebr shembull, mund t\u00eb shtoj\u00eb nj\u00eb skenar q\u00eb startohet automatikisht, si \u201e~\/.bashrc\u201c ose \u201e~\/.profile\u201c, ose t\u00eb ndryshoj\u00eb skedarin \u201e~\/.ssh\/authorized_keys\u201c me \u00e7el\u00ebsat SSH. N\u00ebse n\u00eb nj\u00eb sistem me shum\u00eb p\u00ebrdorues, guix-daemon ekzekutohet n\u00ebn p\u00ebrdoruesin root, sulmuesi mund t\u00eb rishkruaj\u00eb skedarin me fjal\u00ebkalimet ose skenar\u00ebt sistemik\u00eb. <\/p>\n Mund\u00ebsia p\u00ebr t\u00eb krijuar server\u00eb t\u00eb rrem\u00eb p\u00ebr shp\u00ebrndarjen e paketave t\u00eb d\u00ebmshme \u00ebsht\u00eb shkaktuar nga fakti q\u00eb procedura e shkarkimit t\u00eb metadatat (narinfo) p\u00ebr paketat binare t\u00eb disponueshme (fetch-narinfos) nuk kryente verifikimin e certifikat\u00ebs s\u00eb serverit, duke u mb\u00ebshtetur n\u00eb at\u00eb q\u00eb shumica e metadatave kishte nj\u00eb n\u00ebnshkrim digjital. Si\u00e7 u zbulua, n\u00ebnshkrimi nuk p\u00ebrfshinte URL-n\u00eb p\u00ebr shkarkimin e paket\u00ebs, duke lejuar nd\u00ebrrimin e saj pa shkelur integritetin e metadatave. N\u00eb fund, paketa e rreme do t\u00eb refuzohej p\u00ebr shkak t\u00eb d\u00ebshtimit n\u00eb verifikimin e p\u00ebrmbajtjes s\u00eb saj sipas hash-it t\u00eb n\u00ebnshkruar digjtalisht, por kjo verifikim b\u00ebhej pas faz\u00ebs s\u00eb \u00e7paketimit, n\u00eb t\u00eb cil\u00ebn shfaqej problemi me karakteret speciale n\u00eb emrat e skedar\u00ebve. <\/p>\n P\u00ebrve\u00e7 komand\u00ebs «guix substitute», p\u00ebrpunuesi i preksh\u00ebm «restore-file» p\u00ebrdoret gjithashtu n\u00eb komandat «guix offload», «guix archive —extract» dhe «guix challenge», p\u00ebrmes t\u00eb cilave gjithashtu mund t\u00eb shfryt\u00ebzohet ndjeshm\u00ebria. Si nj\u00eb m\u00ebnyr\u00eb p\u00ebr t\u00eb bllokuar ndjeshm\u00ebrin\u00eb, rekomandohet q\u00eb t\u00eb specifikohet qart\u00eb opsioni «—no-substitutes» n\u00eb t\u00eb gjitha komandat guix. Korrigjimi i ndjeshm\u00ebris\u00eb \u00ebsht\u00eb pranuar n\u00eb kodin baz\u00eb t\u00eb Guix. P\u00ebrdoruesit inkurajohen t\u00eb instalojn\u00eb menj\u00ebher\u00eb p\u00ebrdit\u00ebsimet e nd\u00ebrtuara nga zhvilluesit p\u00ebr guix dhe guix-daemon. <\/p>\n P\u00ebrve\u00e7 problemit t\u00eb p\u00ebrmendur n\u00eb Guix, jan\u00eb eliminuar gjithashtu tri cenueshm\u00ebri t\u00eb tjera: <\/p>\n\n