Commit eb65b00f authored by Steven Allen's avatar Steven Allen
Browse files

nixos/captive-browser: remove the udhcpc setcap wrapper fallback 

Remove the udhcpc setcap wrapper fallback as it allows any user to
execute arbitrary commands with the `cap_net_raw` capability.

Fixes CVE-2026-25740

https://github.com/NixOS/nixpkgs/security/advisories/GHSA-wc3r-c66x-8xmc
parent 542def18

doc/release-notes/rl-2605.section.md

+2 −0
Original line number Diff line number Diff line
@@ -101,6 +101,8 @@ 
- `jetbrains.plugins.addPlugins` no longer supports plugin names or ID strings.

  You can still use `addPlugins` with plugin derivations, such as plugins packaged outside of Nixpkgs.



- The `programs.captive-browser` module no longer falls back on a setcap wrapper around udhcpc to discover your network's DNS server due to [GHSA-wc3r-c66x-8xmc](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-wc3r-c66x-8xmc) (CVE-2026-25740). If you're using this module, you must either configure `programs.captive-browser.dhcp-dns` manually or enable one of NetworkManager, dhcpcd, or systemd-networkd.



- The `services.yggdrasil` module has been refactored with the following breaking changes:

  - The `services.yggdrasil.configFile` option has been removed. Configuration should now be specified directly via `services.yggdrasil.settings`.

  - The `services.yggdrasil.persistentKeys` option has been removed. To maintain persistent keys and IPv6 addresses across reboots, use `services.yggdrasil.settings.PrivateKeyPath` to securely load your private key from a file via systemd credentials. The private key must be in PEM format (PKCS #8).

nixos/modules/programs/captive-browser.nix

+1 −12
Original line number Diff line number Diff line
@@ -142,20 +142,9 @@ in 
        else if config.networking.useNetworkd then

          "${cfg.package}/bin/systemd-networkd-dns ${iface [ ]}"

        else

          "${config.security.wrapperDir}/udhcpc --quit --now -f ${iface [ "-i" ]} -O dns --script ${pkgs.writeShellScript "udhcp-script" ''

            if [ "$1" = bound ]; then

              echo "$dns"

            fi

          ''}"

          throw "programs.captive-browser.dhcp-dns must be set"

      );



    security.wrappers.udhcpc = {

      owner = "root";

      group = "root";

      capabilities = "cap_net_raw+p";

      source = "${pkgs.busybox}/bin/udhcpc";

    };



    security.wrappers.captive-browser = mkIf requiresSetcapWrapper {

      owner = "root";

      group = "root";