Message ID | 20210703165127.12316-3-brice@waegenei.re |
---|---|
State | Accepted |
Headers | show |
Series | services: setuid: More configurable setuid support. | expand |
Context | Check | Description |
---|---|---|
cbaines/comparison | success | View comparision |
cbaines/git branch | success | View Git branch |
cbaines/applying patch | success | View Laminar job |
cbaines/issue | success | View issue |
Brice Waegeneire writes: > * gnu/services/dbus.scm (dbus-setuid-programs, polkit-setuid-programs): > Return setuid-programs. > * gnu/services/desktop.scm (enlightenment-setuid-programs): Return > setuid-programs. > (%desktop-services)[mount-setuid-helpers]: Use setuid-programs. > * gnu/services/docker.scm (singularity-setuid-programs): Return > setuid-programs. > * gnu/services/xorg.scm(screen-locker-setuid-programs): Return > setuid-programs. Again, probably want to indent consistently here. I think two spaces. (However I guess this kind of indentation is not actually considered standard for GNU changelog style, but Guix folks including myself tend to do it...) > * gnu/system.scm (%setuid-programs): Return setuid-programs. > --- > gnu/services/dbus.scm | 13 +++++++++---- > gnu/services/desktop.scm | 26 ++++++++++++++++---------- > gnu/services/docker.scm | 9 ++++++--- > gnu/services/xorg.scm | 4 +++- > gnu/system.scm | 31 ++++++++++++++++--------------- > 5 files changed, 50 insertions(+), 33 deletions(-) > > diff --git a/gnu/services/dbus.scm b/gnu/services/dbus.scm > index af1a1e4c3a..e7b3dac166 100644 > --- a/gnu/services/dbus.scm > +++ b/gnu/services/dbus.scm > @@ -2,6 +2,7 @@ > ;;; Copyright © 2013, 2014, 2015, 2016, 2017, 2019, 2020 Ludovic Courtès <ludo@gnu.org> > ;;; Copyright © 2015 Sou Bunnbu <iyzsong@gmail.com> > ;;; Copyright © 2021 Maxime Devos <maximedevos@telenet.be> > +;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re> > ;;; > ;;; This file is part of GNU Guix. > ;;; > @@ -21,6 +22,7 @@ > (define-module (gnu services dbus) > #:use-module (gnu services) > #:use-module (gnu services shepherd) > + #:use-module (gnu system setuid) > #:use-module (gnu system shadow) > #:use-module (gnu system pam) > #:use-module ((gnu packages glib) #:select (dbus)) > @@ -156,10 +158,12 @@ includes the @code{etc/dbus-1/system.d} directories of each package listed in > (shell (file-append shadow "/sbin/nologin"))))) > > (define dbus-setuid-programs > - ;; Return the file name of the setuid program that we need. > + ;; Return a list of <setuid-program> for the program that we need. > (match-lambda > (($ <dbus-configuration> dbus services) > - (list (file-append dbus "/libexec/dbus-daemon-launch-helper"))))) > + (list (setuid-program > + (program (file-append > + dbus "/libexec/dbus-daemon-launch-helper"))))))) Ooh, nice job updating all these other places to use the <setuid-program> record also! > (define (dbus-activation config) > "Return an activation gexp for D-Bus using @var{config}." > @@ -335,8 +339,9 @@ tuples, are all set as environment variables when the bus daemon launches it." > (define polkit-setuid-programs > (match-lambda > (($ <polkit-configuration> polkit) > - (list (file-append polkit "/lib/polkit-1/polkit-agent-helper-1") > - (file-append polkit "/bin/pkexec"))))) > + (map file-like->setuid-program > + (list (file-append polkit "/lib/polkit-1/polkit-agent-helper-1") > + (file-append polkit "/bin/pkexec")))))) > > (define polkit-service-type > (service-type (name 'polkit) > diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm > index cd800fcc2b..6297b8eb0b 100644 > --- a/gnu/services/desktop.scm > +++ b/gnu/services/desktop.scm > @@ -12,6 +12,7 @@ > ;;; Copyright © 2019 David Wilson <david@daviwil.com> > ;;; Copyright © 2020 Tobias Geerinckx-Rice <me@tobias.gr> > ;;; Copyright © 2020 Reza Alizadeh Majd <r.majd@pantherx.org> > +;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re> > ;;; > ;;; This file is part of GNU Guix. > ;;; > @@ -40,6 +41,7 @@ > #:use-module ((gnu system file-systems) > #:select (%elogind-file-systems file-system)) > #:use-module (gnu system) > + #:use-module (gnu system setuid) > #:use-module (gnu system shadow) > #:use-module (gnu system pam) > #:use-module (gnu packages glib) > @@ -1034,14 +1036,15 @@ rules." > > (define (enlightenment-setuid-programs enlightenment-desktop-configuration) > (match-record enlightenment-desktop-configuration > - <enlightenment-desktop-configuration> > - (enlightenment) > - (list (file-append enlightenment > - "/lib/enlightenment/utils/enlightenment_sys") > - (file-append enlightenment > - "/lib/enlightenment/utils/enlightenment_system") > - (file-append enlightenment > - "/lib/enlightenment/utils/enlightenment_ckpasswd")))) > + <enlightenment-desktop-configuration> > + (enlightenment) > + (map file-like->setuid-program > + (list (file-append enlightenment > + "/lib/enlightenment/utils/enlightenment_sys") > + (file-append enlightenment > + "/lib/enlightenment/utils/enlightenment_system") > + (file-append enlightenment > + "/lib/enlightenment/utils/enlightenment_ckpasswd"))))) > > (define enlightenment-desktop-service-type > (service-type > @@ -1204,8 +1207,11 @@ or setting its password with passwd."))) > ;; Allow desktop users to also mount NTFS and NFS file systems > ;; without root. > (simple-service 'mount-setuid-helpers setuid-program-service-type > - (list (file-append nfs-utils "/sbin/mount.nfs") > - (file-append ntfs-3g "/sbin/mount.ntfs-3g"))) > + (map (lambda (program) > + (setuid-program > + (program program))) > + (list (file-append nfs-utils "/sbin/mount.nfs") > + (file-append ntfs-3g "/sbin/mount.ntfs-3g")))) > > ;; The global fontconfig cache directory can sometimes contain > ;; stale entries, possibly referencing fonts that have been GC'd, > diff --git a/gnu/services/docker.scm b/gnu/services/docker.scm > index be85316180..ef551480aa 100644 > --- a/gnu/services/docker.scm > +++ b/gnu/services/docker.scm > @@ -4,6 +4,7 @@ > ;;; Copyright © 2020, 2021 Maxim Cournoyer <maxim.cournoyer@gmail.com> > ;;; Copyright © 2020 Efraim Flashner <efraim@flashner.co.il> > ;;; Copyright © 2020 Jesse Dowell <jessedowell@gmail.com> > +;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re> > ;;; > ;;; This file is part of GNU Guix. > ;;; > @@ -26,6 +27,7 @@ > #:use-module (gnu services base) > #:use-module (gnu services dbus) > #:use-module (gnu services shepherd) > + #:use-module (gnu system setuid) > #:use-module (gnu system shadow) > #:use-module (gnu packages docker) > #:use-module (gnu packages linux) ;singularity > @@ -195,9 +197,10 @@ bundles in Docker containers.") > "-helper"))) > '("action" "mount" "start"))))) > > - (list (file-append helpers "/singularity-action-helper") > - (file-append helpers "/singularity-mount-helper") > - (file-append helpers "/singularity-start-helper"))) > + (map file-like->setuid-program > + (list (file-append helpers "/singularity-action-helper") > + (file-append helpers "/singularity-mount-helper") > + (file-append helpers "/singularity-start-helper")))) > > (define singularity-service-type > (service-type (name 'singularity) > diff --git a/gnu/services/xorg.scm b/gnu/services/xorg.scm > index 8ffea3b9dd..d95f8beb7a 100644 > --- a/gnu/services/xorg.scm > +++ b/gnu/services/xorg.scm > @@ -8,6 +8,7 @@ > ;;; Copyright © 2020 shtwzrd <shtwzrd@protonmail.com> > ;;; Copyright © 2020 Jakub Kądziołka <kuba@kadziolka.net> > ;;; Copyright © 2020 Alex Griffin <a@ajgrf.com> > +;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re> > ;;; > ;;; This file is part of GNU Guix. > ;;; > @@ -29,6 +30,7 @@ > #:use-module (gnu services) > #:use-module (gnu services shepherd) > #:use-module (gnu system pam) > + #:use-module (gnu system setuid) > #:use-module (gnu system keyboard) > #:use-module (gnu services base) > #:use-module (gnu services dbus) > @@ -681,7 +683,7 @@ reboot_cmd " shepherd "/sbin/reboot\n" > #:allow-empty-passwords? empty?))))) > > (define screen-locker-setuid-programs > - (compose list screen-locker-program)) > + (compose list file-like->setuid-program screen-locker-program)) > > (define screen-locker-service-type > (service-type (name 'screen-locker) > diff --git a/gnu/system.scm b/gnu/system.scm > index 96b45ede96..8a70f86457 100644 > --- a/gnu/system.scm > +++ b/gnu/system.scm > @@ -1074,22 +1074,23 @@ use 'plain-file' instead~%") > (define %setuid-programs > ;; Default set of setuid-root programs. > (let ((shadow (@ (gnu packages admin) shadow))) > - (list (file-append shadow "/bin/passwd") > - (file-append shadow "/bin/sg") > - (file-append shadow "/bin/su") > - (file-append shadow "/bin/newgrp") > - (file-append shadow "/bin/newuidmap") > - (file-append shadow "/bin/newgidmap") > - (file-append inetutils "/bin/ping") > - (file-append inetutils "/bin/ping6") > - (file-append sudo "/bin/sudo") > - (file-append sudo "/bin/sudoedit") > - (file-append fuse "/bin/fusermount") > + (map file-like->setuid-program > + (list (file-append shadow "/bin/passwd") > + (file-append shadow "/bin/sg") > + (file-append shadow "/bin/su") > + (file-append shadow "/bin/newgrp") > + (file-append shadow "/bin/newuidmap") > + (file-append shadow "/bin/newgidmap") > + (file-append inetutils "/bin/ping") > + (file-append inetutils "/bin/ping6") > + (file-append sudo "/bin/sudo") > + (file-append sudo "/bin/sudoedit") > + (file-append fuse "/bin/fusermount") > > - ;; To allow mounts with the "user" option, "mount" and "umount" must > - ;; be setuid-root. > - (file-append util-linux "/bin/mount") > - (file-append util-linux "/bin/umount")))) > + ;; To allow mounts with the "user" option, "mount" and "umount" must > + ;; be setuid-root. > + (file-append util-linux "/bin/mount") > + (file-append util-linux "/bin/umount"))))) > > (define %sudoers-specification > ;; Default /etc/sudoers contents: 'root' and all members of the 'wheel' This looks very good. The comments I made were minor (my name, some indentation stuff). Otherwise else I think it looks good to merge. With those changes (indentation stuff, and then my name change) I think it's good to push! This will be a great thing to get in... then hopefully postfix can come next!
I have changed Chris name, identend the commit message. And documented that new record. Brice Waegeneire (1): services: Migrate to <setuid-program>. Chris Lemmer-Webber (1): services: setuid: More configurable setuid support. doc/guix.texi | 43 ++++++++++++++++++++++++------ gnu/build/activation.scm | 38 ++++++++++++++++++++------- gnu/services.scm | 45 ++++++++++++++++++++++++++++--- gnu/services/dbus.scm | 13 ++++++--- gnu/services/desktop.scm | 26 +++++++++++------- gnu/services/docker.scm | 9 ++++--- gnu/services/xorg.scm | 4 ++- gnu/system.scm | 45 +++++++++++++++++-------------- gnu/system/setuid.scm | 57 ++++++++++++++++++++++++++++++++++++++++ 9 files changed, 221 insertions(+), 59 deletions(-) create mode 100644 gnu/system/setuid.scm
diff --git a/gnu/services/dbus.scm b/gnu/services/dbus.scm index af1a1e4c3a..e7b3dac166 100644 --- a/gnu/services/dbus.scm +++ b/gnu/services/dbus.scm @@ -2,6 +2,7 @@ ;;; Copyright © 2013, 2014, 2015, 2016, 2017, 2019, 2020 Ludovic Courtès <ludo@gnu.org> ;;; Copyright © 2015 Sou Bunnbu <iyzsong@gmail.com> ;;; Copyright © 2021 Maxime Devos <maximedevos@telenet.be> +;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re> ;;; ;;; This file is part of GNU Guix. ;;; @@ -21,6 +22,7 @@ (define-module (gnu services dbus) #:use-module (gnu services) #:use-module (gnu services shepherd) + #:use-module (gnu system setuid) #:use-module (gnu system shadow) #:use-module (gnu system pam) #:use-module ((gnu packages glib) #:select (dbus)) @@ -156,10 +158,12 @@ includes the @code{etc/dbus-1/system.d} directories of each package listed in (shell (file-append shadow "/sbin/nologin"))))) (define dbus-setuid-programs - ;; Return the file name of the setuid program that we need. + ;; Return a list of <setuid-program> for the program that we need. (match-lambda (($ <dbus-configuration> dbus services) - (list (file-append dbus "/libexec/dbus-daemon-launch-helper"))))) + (list (setuid-program + (program (file-append + dbus "/libexec/dbus-daemon-launch-helper"))))))) (define (dbus-activation config) "Return an activation gexp for D-Bus using @var{config}." @@ -335,8 +339,9 @@ tuples, are all set as environment variables when the bus daemon launches it." (define polkit-setuid-programs (match-lambda (($ <polkit-configuration> polkit) - (list (file-append polkit "/lib/polkit-1/polkit-agent-helper-1") - (file-append polkit "/bin/pkexec"))))) + (map file-like->setuid-program + (list (file-append polkit "/lib/polkit-1/polkit-agent-helper-1") + (file-append polkit "/bin/pkexec")))))) (define polkit-service-type (service-type (name 'polkit) diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm index cd800fcc2b..6297b8eb0b 100644 --- a/gnu/services/desktop.scm +++ b/gnu/services/desktop.scm @@ -12,6 +12,7 @@ ;;; Copyright © 2019 David Wilson <david@daviwil.com> ;;; Copyright © 2020 Tobias Geerinckx-Rice <me@tobias.gr> ;;; Copyright © 2020 Reza Alizadeh Majd <r.majd@pantherx.org> +;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re> ;;; ;;; This file is part of GNU Guix. ;;; @@ -40,6 +41,7 @@ #:use-module ((gnu system file-systems) #:select (%elogind-file-systems file-system)) #:use-module (gnu system) + #:use-module (gnu system setuid) #:use-module (gnu system shadow) #:use-module (gnu system pam) #:use-module (gnu packages glib) @@ -1034,14 +1036,15 @@ rules." (define (enlightenment-setuid-programs enlightenment-desktop-configuration) (match-record enlightenment-desktop-configuration - <enlightenment-desktop-configuration> - (enlightenment) - (list (file-append enlightenment - "/lib/enlightenment/utils/enlightenment_sys") - (file-append enlightenment - "/lib/enlightenment/utils/enlightenment_system") - (file-append enlightenment - "/lib/enlightenment/utils/enlightenment_ckpasswd")))) + <enlightenment-desktop-configuration> + (enlightenment) + (map file-like->setuid-program + (list (file-append enlightenment + "/lib/enlightenment/utils/enlightenment_sys") + (file-append enlightenment + "/lib/enlightenment/utils/enlightenment_system") + (file-append enlightenment + "/lib/enlightenment/utils/enlightenment_ckpasswd"))))) (define enlightenment-desktop-service-type (service-type @@ -1204,8 +1207,11 @@ or setting its password with passwd."))) ;; Allow desktop users to also mount NTFS and NFS file systems ;; without root. (simple-service 'mount-setuid-helpers setuid-program-service-type - (list (file-append nfs-utils "/sbin/mount.nfs") - (file-append ntfs-3g "/sbin/mount.ntfs-3g"))) + (map (lambda (program) + (setuid-program + (program program))) + (list (file-append nfs-utils "/sbin/mount.nfs") + (file-append ntfs-3g "/sbin/mount.ntfs-3g")))) ;; The global fontconfig cache directory can sometimes contain ;; stale entries, possibly referencing fonts that have been GC'd, diff --git a/gnu/services/docker.scm b/gnu/services/docker.scm index be85316180..ef551480aa 100644 --- a/gnu/services/docker.scm +++ b/gnu/services/docker.scm @@ -4,6 +4,7 @@ ;;; Copyright © 2020, 2021 Maxim Cournoyer <maxim.cournoyer@gmail.com> ;;; Copyright © 2020 Efraim Flashner <efraim@flashner.co.il> ;;; Copyright © 2020 Jesse Dowell <jessedowell@gmail.com> +;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re> ;;; ;;; This file is part of GNU Guix. ;;; @@ -26,6 +27,7 @@ #:use-module (gnu services base) #:use-module (gnu services dbus) #:use-module (gnu services shepherd) + #:use-module (gnu system setuid) #:use-module (gnu system shadow) #:use-module (gnu packages docker) #:use-module (gnu packages linux) ;singularity @@ -195,9 +197,10 @@ bundles in Docker containers.") "-helper"))) '("action" "mount" "start"))))) - (list (file-append helpers "/singularity-action-helper") - (file-append helpers "/singularity-mount-helper") - (file-append helpers "/singularity-start-helper"))) + (map file-like->setuid-program + (list (file-append helpers "/singularity-action-helper") + (file-append helpers "/singularity-mount-helper") + (file-append helpers "/singularity-start-helper")))) (define singularity-service-type (service-type (name 'singularity) diff --git a/gnu/services/xorg.scm b/gnu/services/xorg.scm index 8ffea3b9dd..d95f8beb7a 100644 --- a/gnu/services/xorg.scm +++ b/gnu/services/xorg.scm @@ -8,6 +8,7 @@ ;;; Copyright © 2020 shtwzrd <shtwzrd@protonmail.com> ;;; Copyright © 2020 Jakub Kądziołka <kuba@kadziolka.net> ;;; Copyright © 2020 Alex Griffin <a@ajgrf.com> +;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re> ;;; ;;; This file is part of GNU Guix. ;;; @@ -29,6 +30,7 @@ #:use-module (gnu services) #:use-module (gnu services shepherd) #:use-module (gnu system pam) + #:use-module (gnu system setuid) #:use-module (gnu system keyboard) #:use-module (gnu services base) #:use-module (gnu services dbus) @@ -681,7 +683,7 @@ reboot_cmd " shepherd "/sbin/reboot\n" #:allow-empty-passwords? empty?))))) (define screen-locker-setuid-programs - (compose list screen-locker-program)) + (compose list file-like->setuid-program screen-locker-program)) (define screen-locker-service-type (service-type (name 'screen-locker) diff --git a/gnu/system.scm b/gnu/system.scm index 96b45ede96..8a70f86457 100644 --- a/gnu/system.scm +++ b/gnu/system.scm @@ -1074,22 +1074,23 @@ use 'plain-file' instead~%") (define %setuid-programs ;; Default set of setuid-root programs. (let ((shadow (@ (gnu packages admin) shadow))) - (list (file-append shadow "/bin/passwd") - (file-append shadow "/bin/sg") - (file-append shadow "/bin/su") - (file-append shadow "/bin/newgrp") - (file-append shadow "/bin/newuidmap") - (file-append shadow "/bin/newgidmap") - (file-append inetutils "/bin/ping") - (file-append inetutils "/bin/ping6") - (file-append sudo "/bin/sudo") - (file-append sudo "/bin/sudoedit") - (file-append fuse "/bin/fusermount") + (map file-like->setuid-program + (list (file-append shadow "/bin/passwd") + (file-append shadow "/bin/sg") + (file-append shadow "/bin/su") + (file-append shadow "/bin/newgrp") + (file-append shadow "/bin/newuidmap") + (file-append shadow "/bin/newgidmap") + (file-append inetutils "/bin/ping") + (file-append inetutils "/bin/ping6") + (file-append sudo "/bin/sudo") + (file-append sudo "/bin/sudoedit") + (file-append fuse "/bin/fusermount") - ;; To allow mounts with the "user" option, "mount" and "umount" must - ;; be setuid-root. - (file-append util-linux "/bin/mount") - (file-append util-linux "/bin/umount")))) + ;; To allow mounts with the "user" option, "mount" and "umount" must + ;; be setuid-root. + (file-append util-linux "/bin/mount") + (file-append util-linux "/bin/umount"))))) (define %sudoers-specification ;; Default /etc/sudoers contents: 'root' and all members of the 'wheel'