Permitted Insecure Packages: How can I continuously have permitted packages updated without having to change versions?

Help
1

I use my NixOS drive through an external M.2, and so I use it on various devices. When I use it on a Macbook Pro, the WiFi card needs me to enable broadcom-sta-6.30.223.271-59-7.1.1 drivers, so I have it written in my configuration as a permitted package.

However, because these drivers tend to change/update to newer versions, I usually meet this error every month:

error: Refusing to evaluate package 'broadcom-sta-6.30.223.271-59-7.1.1' in /nix/store/kyxkqg6wydr9c3g87503spqa1mbr7q70-nixos-26.05/nixos/pkgs/os-specific/linux/broadcom-sta/default.nix:106 because it is marked as insecure

       Known issues:
        - CVE-2019-9501: heap buffer overflow, potentially allowing remote code execution by sending specially-crafted WiFi packets
        - CVE-2019-9502: heap buffer overflow, potentially allowing remote code execution by sending specially-crafted WiFi packets
        - The Broadcom STA wireless driver is not maintained and is incompatible with Linux kernel security mitigations. It is heavily recommended to replace the hardware and remove the driver. Proceed at your own risk!

       You can install it anyway by allowing this package, using the
       following methods:

       a) To temporarily allow all insecure packages, you can use an environment
          variable for a single invocation of the nix tools:

            $ export NIXPKGS_ALLOW_INSECURE=1

          Note: When using `nix shell`, `nix build`, `nix develop`, etc with a flake,
                then pass `--impure` in order to allow use of environment variables.

       b) for `nixos-rebuild` you can add ‘broadcom-sta-6.30.223.271-59-7.1.1’ to
          `nixpkgs.config.permittedInsecurePackages` in the configuration.nix,
          like so:

            {
              nixpkgs.config.permittedInsecurePackages = [
                "broadcom-sta-6.30.223.271-59-7.1.1"
              ];
            }

       c) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
          ‘broadcom-sta-6.30.223.271-59-7.1.1’ to `permittedInsecurePackages` in
          ~/.config/nixpkgs/config.nix, like so:

            {
              permittedInsecurePackages = [
                "broadcom-sta-6.30.223.271-59-7.1.1"
              ];
            }
Command 'nix-build '<nixpkgs/nixos>' --attr config.system.build.toplevel --no-out-link' returned non-zero exit status 1.

I’ve though of writing the permitted package with an *, as a way to include any future releases, such as by inputting:

permittedInsecurePackages = [
                "broadcom-sta-6.30.223.271-59-7.1.*"

But that doesn’t work.

Is there something I can write that will continue to have a package update, regardless of its version?

Would broadcom-sta work on its own, without a version number?

2

No, it matches exact strings, and there’s no predicate function.

You could override the package when you use it in your config to remove that insecure flag.

3

Thanks for chiming in!

Would it be better or more convenient than what I have in my config? Also, how do I write an override?

nixpkgs.config.permittedInsecurePackages = [
				"broadcom-sta-6.30.223.271-59-7.1.1"
];
4

Where do you use the package? I’m not talking about permittedInsecurePackages, I’m talking about the pkgs.whatever that you added to your config that is insecure.

5

I have it in:

boot.extraModulePackages = with config.boot.kernelPackages; [
broadcom_sta
];
6

There is a predicate, though. In the nixpkgs manual it details allowInsecurePredicate which allows using a predicate to choose packages to allow.

4 Likes
7

Oh, okay, maybe I confused it with another nixpkgs config attr.

In that case @nPrevail you could probably adapt the manual’s example (untested):

nixpkgs.allowInsecurePredicate = pkg: builtins.elem (lib.getName pkg) [ "broadcom-sta" ];

Do note that you cannot use nixpkgs.permittedInsecurePackages as a result, and all insecure packages will need to use this predicate. You also cannot define the predicate in multiple places, as it won’t merge correctly afaik.

2 Likes
8

You can also still do:

{
  boot.extraModulePackages = let
    broadcom_sta' = config.boot.kernelPackages.broadcom_sta.overrideAttrs (old: {
      meta = old.meta // { knownVulnerabilities = [ ]; };
    });
  in [
    broadcom_sta'
  ];
}

Bit of a hack tho, if you build an SBOM of your system or such it will not highlight this vulnerability. Using the predicate is definitely better.

1 Like