From patchwork Mon Jun 15 16:18:41 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Brice Waegeneire X-Patchwork-Id: 22733 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id DFB3027BBE3; Mon, 15 Jun 2020 17:20:11 +0100 (BST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-2.9 required=5.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.2 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTP id E371027BBE1 for ; Mon, 15 Jun 2020 17:20:10 +0100 (BST) Received: from localhost ([::1]:49746 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jkrqD-0000Wa-Vg for patchwork@mira.cbaines.net; Mon, 15 Jun 2020 12:20:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:53282) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jkrq6-0000V7-Sx for guix-patches@gnu.org; Mon, 15 Jun 2020 12:20:02 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:35725) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1jkrq6-0004Rz-IO for guix-patches@gnu.org; Mon, 15 Jun 2020 12:20:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1jkrq6-0000i2-DS for guix-patches@gnu.org; Mon, 15 Jun 2020 12:20:02 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#41874] [PATCH] gnu: wireshark: Lookup 'dumpcap' in PATH. Resent-From: Brice Waegeneire Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Mon, 15 Jun 2020 16:20:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 41874 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 41874@debbugs.gnu.org X-Debbugs-Original-To: guix-patches@gnu.org Received: via spool by submit@debbugs.gnu.org id=B.15922379562660 (code B ref -1); Mon, 15 Jun 2020 16:20:02 +0000 Received: (at submit) by debbugs.gnu.org; 15 Jun 2020 16:19:16 +0000 Received: from localhost ([127.0.0.1]:47271 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1jkrpI-0000gi-HI for submit@debbugs.gnu.org; Mon, 15 Jun 2020 12:19:16 -0400 Received: from lists.gnu.org ([209.51.188.17]:50276) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1jkrpD-0000gX-Ow for submit@debbugs.gnu.org; Mon, 15 Jun 2020 12:19:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:53036) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jkrpD-00089M-Ip for guix-patches@gnu.org; Mon, 15 Jun 2020 12:19:07 -0400 Received: from relay12.mail.gandi.net ([217.70.178.232]:34791) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jkrp8-0004Gh-NU for guix-patches@gnu.org; Mon, 15 Jun 2020 12:19:07 -0400 Received: from localhost (luy13-1-78-237-113-178.fbx.proxad.net [78.237.113.178]) (Authenticated sender: brice@waegenei.re) by relay12.mail.gandi.net (Postfix) with ESMTPSA id 5F308200002 for ; Mon, 15 Jun 2020 16:18:56 +0000 (UTC) From: Brice Waegeneire Date: Mon, 15 Jun 2020 18:18:41 +0200 Message-Id: <20200615161841.24337-1-brice@waegenei.re> X-Mailer: git-send-email 2.26.2 MIME-Version: 1.0 Received-SPF: pass client-ip=217.70.178.232; envelope-from=brice@waegenei.re; helo=relay12.mail.gandi.net X-detected-operating-system: by eggs.gnu.org: First seen = 2020/06/15 12:18:57 X-ACL-Warn: Detected OS = Linux 3.11 and newer X-Spam_score_int: -25 X-Spam_score: -2.6 X-Spam_bar: -- X-Spam_report: (-2.6 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001 autolearn=_AUTOLEARN X-Spam_action: no action X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: "Guix-patches" X-getmail-retrieved-from-mailbox: Patches * gnu/packages/patches/wireshark-lookup-dumpcap-in-path.patch: New file … * gnu/local.mk: … add it … * gnu/packages/networking.scm (wireshark)[origin]: … use it. --- Together with https://issues.guix.info/41763 this patch allow to use wireshark as a non-root user be adding the following to your “oeprating-system-services“ field: --8<---------------cut here---------------start------------->8--- (simple-service 'wireshark-group account-service-type (list (user-group (name "wireshark") (system? #t)))) (simple-service 'wireshark-dumpcap setuid-program-service-type (list (list (file-append wireshark "/bin/dumpcap") "root" "wireshark"))) --8<---------------cut here---------------end--------------->8--- Such feature was asked on the mailing list years ago[0]. [0]: https://lists.gnu.org/archive/html/help-guix/2016-11/msg00043.html gnu/local.mk | 1 + gnu/packages/networking.scm | 1 + .../wireshark-lookup-dumpcap-in-path.patch | 66 +++++++++++++++++++ 3 files changed, 68 insertions(+) create mode 100644 gnu/packages/patches/wireshark-lookup-dumpcap-in-path.patch diff --git a/gnu/local.mk b/gnu/local.mk index 79bdfe9be8..3b07aa248c 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -1595,6 +1595,7 @@ dist_patch_DATA = \ %D%/packages/patches/wicd-get-selected-profile-fix.patch \ %D%/packages/patches/wicd-urwid-1.3.patch \ %D%/packages/patches/wicd-wpa2-ttls.patch \ + %D%/packages/patches/wireshark-lookup-dumpcap-in-path.patch \ %D%/packages/patches/wmctrl-64-fix.patch \ %D%/packages/patches/wmfire-update-for-new-gdk-versions.patch \ %D%/packages/patches/wordnet-CVE-2008-2149.patch \ diff --git a/gnu/packages/networking.scm b/gnu/packages/networking.scm index e8f398e521..216e5072a4 100644 --- a/gnu/packages/networking.scm +++ b/gnu/packages/networking.scm @@ -873,6 +873,7 @@ of the same name.") (method url-fetch) (uri (string-append "https://www.wireshark.org/download/src/wireshark-" version ".tar.xz")) + (patches (search-patches "wireshark-lookup-dumpcap-in-path.patch")) (sha256 (base32 "1amqgn94g6h6cfnsccm2zb4c73pfv1qmzi1i6h1hnbcyhhg4czfi")))) (build-system cmake-build-system) diff --git a/gnu/packages/patches/wireshark-lookup-dumpcap-in-path.patch b/gnu/packages/patches/wireshark-lookup-dumpcap-in-path.patch new file mode 100644 index 0000000000..4c000c23a1 --- /dev/null +++ b/gnu/packages/patches/wireshark-lookup-dumpcap-in-path.patch @@ -0,0 +1,66 @@ +Taken from Nixpkgs: + + +From 5bef9deeff8a2e4401de0f45c9701cd6f98f29d8 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Bj=C3=B8rn=20Forsman?= +Date: Thu, 26 Nov 2015 21:03:35 +0100 +Subject: [PATCH] Lookup dumpcap in PATH + +NixOS patch: Look for dumpcap in PATH first, because there may be a +dumpcap wrapper that we want to use instead of the default +non-setuid dumpcap binary. + +Also change execv() to execvp() because we've set argv[0] to "dumpcap" +and have to enable PATH lookup. Wireshark is not a setuid program, so +looking in PATH is not a security issue. + +Signed-off-by: Franz Pletz +--- + capchild/capture_sync.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/capchild/capture_sync.c b/capchild/capture_sync.c +index 970688e..49914d5 100644 +--- a/capchild/capture_sync.c ++++ b/capchild/capture_sync.c +@@ -332,7 +332,18 @@ init_pipe_args(int *argc) { + #ifdef _WIN32 + exename = g_strdup_printf("%s\\dumpcap.exe", progfile_dir); + #else +- exename = g_strdup_printf("%s/dumpcap", progfile_dir); ++ /* ++ * NixOS patch: Look for dumpcap in PATH first, because there may be a ++ * dumpcap wrapper that we want to use instead of the default ++ * non-setuid dumpcap binary. ++ */ ++ if (system("command -v dumpcap >/dev/null") == 0) { ++ /* Found working dumpcap */ ++ exename = g_strdup_printf("dumpcap"); ++ } else { ++ /* take Wireshark's absolute program path and replace "Wireshark" with "dumpcap" */ ++ exename = g_strdup_printf("%s/dumpcap", progfile_dir); ++ } + #endif + + /* Make that the first argument in the argument list (argv[0]). */ +@@ -729,7 +740,7 @@ sync_pipe_start(capture_options *capture_opts, capture_session *cap_session, voi + */ + dup2(sync_pipe[PIPE_WRITE], 2); + ws_close(sync_pipe[PIPE_READ]); +- execv(argv[0], argv); ++ execvp(argv[0], argv); + g_snprintf(errmsg, sizeof errmsg, "Couldn't run %s in child process: %s", + argv[0], g_strerror(errno)); + sync_pipe_errmsg_to_parent(2, errmsg, ""); +@@ -997,7 +1008,7 @@ sync_pipe_open_command(char** argv, int *data_read_fd, + dup2(sync_pipe[PIPE_WRITE], 2); + ws_close(sync_pipe[PIPE_READ]); + ws_close(sync_pipe[PIPE_WRITE]); +- execv(argv[0], argv); ++ execvp(argv[0], argv); + g_snprintf(errmsg, sizeof errmsg, "Couldn't run %s in child process: %s", + argv[0], g_strerror(errno)); + sync_pipe_errmsg_to_parent(2, errmsg, ""); +-- +2.6.3 +