df184b6e06 lnd: don't pass the admin macaroon in `curl` argv (Jonas Nick)
Pull request description:
Top commit has no ACKs.
Tree-SHA512: d18fa7176c59f33a38222a2d3d44320769ac83e091104594a9572e44ce38205d341767ea598da1b5500208c1e9f6645ed5c3b9390438d95912e44d1c5f3a4752
f51460749a ci: disable the nixos-search test (Jonas Nick)
3b798f5ebf test: increase VM memory to 4 GiB (Jonas Nick)
17f0d98c22 update nixpkgs (Jonas Nick)
Pull request description:
Top commit has no ACKs.
Tree-SHA512: 0e40353d9d7937dd7a80c05416360c30ada7ee231d6263883072d60a707443e765d35f6a393e718ed1ef66f2e2cdbd1deadd6cd720dccb5c5e18711159cda38a
34a18f92ee netns-isolation: fix netns-exec being executable by all normal users (Jonas Nick)
Pull request description:
Top commit has no ACKs.
Tree-SHA512: 3aa359bb61967b76299918b893b85f5d92909029237cba892b367f94c82643268dceaf2928157b47d4973a8af81e5e9ef29651bc45db0e3b149966b16c41bc8b
`lnd-create-macaroons` interpolated the hex-encoded admin macaroon into
`curl`'s argv, where any local user could read it from world-readable
`/proc/<pid>/cmdline`. The unit's `ProtectProc=invisible` doesn't apply,
because `nbLib.rootScript`'s `+` prefix disables sandboxing for the
process. Pass the header on a file descriptor instead, so the credential
never enters any argv (`printf` is a bash builtin); the request sent to
lnd is unchanged. Only configurations with a non-empty
`services.lnd.macaroons` were affected, which `services.charge-lnd` and
`services.btcpayserver` with `lightningBackend = "lnd"` set automatically.
The `netns-exec` wrapper was created with `group = ""`, which makes the
`security.wrappers` activation run `chown ${allowedUser}:`. GNU chown
resolves the trailing colon to the owner's login group, and because the
operator is defined with `isNormalUser = true`, that group is the shared
group `users`. Together with mode 550, this made the wrapper executable
by every normal user on the host instead of only by `allowedUser`.
The wrapper carries `cap_sys_admin=ep` and the NixOS security wrapper
performs no owner check, so any normal user could enter `nb-joinmarket`,
the only netns that `netns-exec` permits. This exposes joinmarketd's
unauthenticated control port on 127.0.0.1 inside that netns and allows
sending packets from the joinmarket netns address. This can only ever become a
problem if there's a second, normal user on the host.
Use mode 500 so that only `allowedUser` can execute the wrapper. Also
set the group to `root`, so that `users` doesn't silently become an
authorized group again if the mode is ever loosened.
The netns-isolation test asserted this property with
`runuser -u clightning -- netns-exec nb-bitcoind ip a`, which fails
regardless of the file mode, because `clightning` is a system user with
its own group and `nb-bitcoind` is not in netns-exec's allowlist.
Replace it with a check that a normal user is denied by the exec
permissions, and assert the reason for each failure instead of only the
exit status.
5f286763b0 update nixpkgs (Jonas Nick)
Pull request description:
Top commit has no ACKs.
Tree-SHA512: 7bbe7d73ea890c4cd315e1158c0e4e75095a0c16d563f463a892445313c07b547353be957d7899396d7ecc3681f1bbddc720cf62c34668b6b4f3b914f52bfc2f
d0bd5b2874 update nixpkgs (Jonas Nick)
Pull request description:
Top commit has no ACKs.
Tree-SHA512: f304e064caaf2ba4128fc699bcfa07670ff5f16663f408458f142ae641c7c7606c4fa7b475d884370c4b07bde55d4d4261165c41ee93cfad4de32ef9f7c8d48c
bitcoin: 30.2 -> 31.0
bitcoind: 30.2 -> 31.0
clboss: 0.15.1 -> 0.16.0
clightning: 25.12.1 -> 26.04.1
elementsd: 23.3.2 -> 23.3.3
lightning-loop: 0.31.5-beta -> 0.33.0-beta
lightning-loop 0.31.7+ blocks until lnd's chain notifier is ready
(lightninglabs/loop@bde49d7a), so the workaround sleep added in the
previous commit is no longer needed for lightning-loop. The
lightning-pool workaround stays — pool has no equivalent fix and
isn't actively maintained.
Note: nbxplorer test fails (presumed incompatibility with bitcoin 31).
bitcoin: 30.0 -> 30.2
bitcoind: 30.0 -> 30.2
bitcoind-knots: 29.2.knots20251110 -> 29.3.knots20260210
btcpayserver: 2.2.1 -> 2.3.4
clightning: 25.09.2 -> 25.12.1
elementsd: 23.2.4 -> 23.3.2
lnd: 0.19.3-beta -> 0.20.1-beta
lnd 0.20 makes its chain notifier subsystem ready later in startup
than its RPC server. lightning-loop and lightning-pool both subscribe
to chain notifications right after dialing lnd, which fails before
the notifier is up and crashes the daemon. Add a 5s ExecStartPre
sleep to both services as a temporary workaround.
Even when an identity file (i.e. a private key) is specified, SSH
tries all keys loaded by the SSH agent first for authentication
(if an agent is running).
When the agent returns many keys this can lead to a "Too Many Failures"
auth error, because none of the agent keys are accepted by the VM SSH
server.
Fix this by only using the provided key.
Since version 257 (NixOS 25.05), systemd-nspawn automatically creates a
/dev/fuse node in the container when the host's FUSE node is accessible
to the nspawn process:
https://github.com/systemd/systemd/pull/34067
bitcoind 29.x is required for joinmarket.
nixos-25.05 is at 29.0, which is a regression from 29.1.
nixos-unstable is at 30.0, which is incompatible.
Adapted from nixpkgs `96ff46705a694219cefa5155ba52203d9d32e65e`, with
minor modifications to make it compatible with nixos 25.05.
Jonas Nick