[bug#54997,12/12] services: quassel: Use 'least-authority-wrapper'.
Commit Message
* gnu/services/messaging.scm (quassel-shepherd-service): Use
'least-authority-wrapper' instead of
'make-forkexec-constructor/container'.
---
gnu/services/messaging.scm | 42 ++++++++++++++++++++------------------
1 file changed, 22 insertions(+), 20 deletions(-)
Comments
Ludovic Courtès schreef op zo 17-04-2022 om 23:04 [+0200]:
> + ;; XXX: The daemon needs to live in the main user
> + ;; namespace, as root, so it can access /var/lib/quassel
> + ;; owned by "quasselcore".
The previous code did not have this comment, was the old code broken or
is this a limitation of least-authority-wrapper?
Greetings,
Maxime.
Hi Maxime,
Maxime Devos <maximedevos@telenet.be> skribis:
> Ludovic Courtès schreef op zo 17-04-2022 om 23:04 [+0200]:
>> + ;; XXX: The daemon needs to live in the main user
>> + ;; namespace, as root, so it can access /var/lib/quassel
>> + ;; owned by "quasselcore".
>
> The previous code did not have this comment, was the old code broken or
> is this a limitation of least-authority-wrapper?
It’s just that ‘make-forkexec-constructor/container’ does it by default:
--8<---------------cut here---------------start------------->8---
(define (default-namespaces args)
;; Most daemons are here to talk to the network, and most of them expect to
;; run under a non-zero UID.
(fold delq %namespaces '(net user)))
--8<---------------cut here---------------end--------------->8---
‘least-authority-wrapper’ is stricter by defaulting to ‘%namespaces’.
Ludo’.
@@ -939,29 +939,31 @@ (define-record-type* <quassel-configuration>
(define quassel-shepherd-service
(match-lambda
(($ <quassel-configuration> quassel interface port loglevel)
- (with-imported-modules (source-module-closure
- '((gnu build shepherd)
- (gnu system file-systems)))
+ (let ((quassel (least-authority-wrapper
+ (file-append quassel "/bin/quasselcore")
+ #:name "quasselcore"
+ #:mappings (list (file-system-mapping
+ (source "/var/lib/quassel")
+ (target source)
+ (writable? #t))
+ (file-system-mapping
+ (source "/var/log/quassel")
+ (target source)
+ (writable? #t)))
+ ;; XXX: The daemon needs to live in the main user
+ ;; namespace, as root, so it can access /var/lib/quassel
+ ;; owned by "quasselcore".
+ #:namespaces (fold delq %namespaces '(net user)))))
(list (shepherd-service
(provision '(quassel))
(requirement '(user-processes networking))
- (modules '((gnu build shepherd)
- (gnu system file-systems)))
- (start #~(make-forkexec-constructor/container
- (list #$(file-append quassel "/bin/quasselcore")
- "--configdir=/var/lib/quassel"
- "--logfile=/var/log/quassel/core.log"
- (string-append "--loglevel=" #$loglevel)
- (string-append "--port=" (number->string #$port))
- (string-append "--listen=" #$interface))
- #:mappings (list (file-system-mapping
- (source "/var/lib/quassel")
- (target source)
- (writable? #t))
- (file-system-mapping
- (source "/var/log/quassel")
- (target source)
- (writable? #t)))))
+ (start #~(make-forkexec-constructor
+ (list #$quassel
+ "--configdir=/var/lib/quassel"
+ "--logfile=/var/log/quassel/core.log"
+ (string-append "--loglevel=" #$loglevel)
+ (string-append "--port=" (number->string #$port))
+ (string-append "--listen=" #$interface))))
(stop #~(make-kill-destructor))))))))
(define %quassel-account