From patchwork Sat Jul 15 23:59:52 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Tobias Geerinckx-Rice X-Patchwork-Id: 51874 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id C1F6827BBE9; Thu, 20 Jul 2023 21:43:51 +0100 (BST) X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-3.7 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS, URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.6 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id 4F78B27BBE2 for ; Thu, 20 Jul 2023 21:43:49 +0100 (BST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qMaUK-0007PI-Ma; Thu, 20 Jul 2023 16:43:04 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qMaUJ-0007OG-A9 for guix-patches@gnu.org; Thu, 20 Jul 2023 16:43:03 -0400 Received: from debbugs.gnu.org ([2001:470:142:5::43]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1qMaUJ-0007D9-2g for guix-patches@gnu.org; Thu, 20 Jul 2023 16:43:03 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1qMaUI-0000Yg-Ur for guix-patches@gnu.org; Thu, 20 Jul 2023 16:43:02 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#61462] [PATCH v2 02/10] services: setuid-program: Populate /run/privileged/bin. Resent-From: Tobias Geerinckx-Rice Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Thu, 20 Jul 2023 20:43:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 61462 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 61462@debbugs.gnu.org Received: via spool by 61462-submit@debbugs.gnu.org id=B61462.16898857342010 (code B ref 61462); Thu, 20 Jul 2023 20:43:02 +0000 Received: (at 61462) by debbugs.gnu.org; 20 Jul 2023 20:42:14 +0000 Received: from localhost ([127.0.0.1]:60046 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1qMaTV-0000WF-Bt for submit@debbugs.gnu.org; Thu, 20 Jul 2023 16:42:13 -0400 Received: from tobias.gr ([2a02:c205:2020:6054::1]:51548) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1qMaTO-0000V6-08 for 61462@debbugs.gnu.org; Thu, 20 Jul 2023 16:42:07 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=2018; bh=zQ7n98Zu4iZJf qQlpyjTH+lcrgZkw69P+WJewcLh18w=; h=references:in-reply-to:date: subject:to:from; d=tobias.gr; b=Zyrp39uUeQ/YOuXezxhyoUNkxsByX55MvRrMlg ajU9az75w2iv9rQo3ENpPt4WWvcWIbGAlgrUTo+0+tteFG8JtasBoWZdwk97GeANZyS+kU PpfwpQIJ9TxHw8odKVkBKce+oiGIK5fSxNiL+iS+uoy05/QvjSaTSxJ0jeGbNb657yfCkc e8z61ODgLrlc8fALoYQ9NvFxC1qtzi8y2mZwmGKzlUdgsxUljlLQy2pBA8f9sD8EixKF6X THl9dtPIQBdv3Ggu9EeChi929mVvzmglzhbhFV8o2Gl4pCgJ8f26etqMeV3xjlgTrx4W8E pHv9LppW/W3zH/8r3SKGBXOA== Received: by submission.tobias.gr (OpenSMTPD) with ESMTPSA id c653cf7c (TLSv1.3:TLS_AES_256_GCM_SHA384:256:NO) for <61462@debbugs.gnu.org>; Thu, 20 Jul 2023 20:41:48 +0000 (UTC) Date: Sun, 16 Jul 2023 01:59:52 +0200 Message-ID: <482841db32bd1baf69af0a09705bd387ed04e346.1689465600.git.me@tobias.gr> X-Mailer: git-send-email 2.41.0 In-Reply-To: <129e8d298556f6a159fcb704ed3df4bf0709ddd3.1689465600.git.me@tobias.gr> References: <129e8d298556f6a159fcb704ed3df4bf0709ddd3.1689465600.git.me@tobias.gr> MIME-Version: 1.0 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-to: Tobias Geerinckx-Rice X-ACL-Warn: , Tobias Geerinckx-Rice via Guix-patches X-Patchwork-Original-From: Tobias Geerinckx-Rice via Guix-patches via From: Tobias Geerinckx-Rice Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org X-getmail-retrieved-from-mailbox: Patches Create /run/setuid-programs compatibility symlinks so that we can migrate all users (both package and human) piecemeal at our leisure. Apart from being symlinks, this should be a user-invisible change. * gnu/build/activation.scm (%privileged-program-directory): New variable. [activate-setuid-programs]: Put privileged copies in %PRIVILEGED-PROGRAM-DIRECTORY, with compatibility symlinks to each in %SETUID-DIRECTORY. * gnu/services.scm (setuid-program-service-type): Update docstring. * doc/guix.texi (Setuid Programs): Update @file{} name accordingly. --- doc/guix.texi | 2 +- gnu/build/activation.scm | 54 ++++++++++++++++++++++++++-------------- gnu/services.scm | 9 +++++-- 3 files changed, 44 insertions(+), 21 deletions(-) diff --git a/doc/guix.texi b/doc/guix.texi index 1d8ebcd72f..9426c72e1e 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -39383,7 +39383,7 @@ Setuid Programs @end defvar Under the hood, the actual setuid programs are created in the -@file{/run/setuid-programs} directory at system activation time. The +@file{/run/privileged/bin} directory at system activation time. The files in this directory refer to the ``real'' binaries, which are in the store. diff --git a/gnu/build/activation.scm b/gnu/build/activation.scm index eea2233563..7f4800bba1 100644 --- a/gnu/build/activation.scm +++ b/gnu/build/activation.scm @@ -8,6 +8,7 @@ ;;; Copyright © 2021 Maxime Devos ;;; Copyright © 2020 Christine Lemmer-Webber ;;; Copyright © 2021 Brice Waegeneire +;;; Copyright © 2022 Tobias Geerinckx-Rice ;;; ;;; This file is part of GNU Guix. ;;; @@ -278,14 +279,29 @@ (define (activate-etc etc) string)) + (scandir directory + (lambda (file) + (not (member file '("." "..")))) + string)) - (scandir %setuid-directory - (lambda (file) - (not (member file '("." "..")))) - string. (format (current-error-port) "warning: failed to make ~s setuid/setgid: ~a~%" diff --git a/gnu/services.scm b/gnu/services.scm index 109e050a23..eefe58b336 100644 --- a/gnu/services.scm +++ b/gnu/services.scm @@ -6,6 +6,7 @@ ;;; Copyright © 2021 raid5atemyhomework ;;; Copyright © 2020 Christine Lemmer-Webber ;;; Copyright © 2020, 2021 Brice Waegeneire +;;; Copyright © 2022 Tobias Geerinckx-Rice ;;; Copyright © 2023 Brian Cully ;;; ;;; This file is part of GNU Guix. @@ -892,8 +893,12 @@ (define setuid-program-service-type (extend (lambda (config extensions) (append config extensions))) (description - "Populate @file{/run/setuid-programs} with the specified -executables, making them setuid and/or setgid."))) + "Copy the specified executables to @file{/run/privileged/bin} +and apply special privileges like setuid and/or setgid. + +The deprecated @file{/run/setuid-programs} directory is also populated with +symbolic links to their @file{/run/privileged/bin} counterpart. It will be +removed in a future Guix release."))) (define (packages->profile-entry packages) "Return a system entry for the profile containing PACKAGES."