| Message ID | 878ruo60c9.fsf@trop.in |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [bug#53468,RFC] gnu: linux-pam: Change path to unix_chkpwd helper. | expand |
| Context | Check | Description |
|---|---|---|
| cbaines/comparison | success | View comparision |
| cbaines/git branch | success | View Git branch |
| cbaines/applying patch | fail | View Laminar job |
| cbaines/issue | success | View issue |
Hi, Andrew Tropin <andrew@trop.in> skribis: > From e96d3f6d82b134829fcb31777e81928c73847dcc Mon Sep 17 00:00:00 2001 > From: Andrew Tropin <andrew@trop.in> > Date: Sun, 6 Feb 2022 08:13:49 +0300 > Subject: [PATCH v3] gnu: linux-pam: Change path to unix_chkpwd helper. > > * gnu/packages/patches/change-path-to-unix_chkpwd.patch: New file. > * gnu/packages/linux.scm (linux-pam): Add patch. > * gnu/system/pam.scm (pam-root-service-type): Add unix_chkpwd to setuid. LGTM, minor the patch file name as reported by ‘guix lint’ and missing ‘gnu/local.mk’. However, it looks like my brain wasn’t fully operational when I previously replied, because: --8<---------------cut here---------------start------------->8--- $ guix refresh -l linux-pam Building the following 2418 packages would ensure 6038 dependent packages are rebuilt: […] --8<---------------cut here---------------end--------------->8--- So I went ahead, fixed up the issues above, and pushed to ‘core-updates’. Thanks! Ludo’.
On 2022-02-10 23:42, Ludovic Courtès wrote: > Hi, > > Andrew Tropin <andrew@trop.in> skribis: > >> From e96d3f6d82b134829fcb31777e81928c73847dcc Mon Sep 17 00:00:00 2001 >> From: Andrew Tropin <andrew@trop.in> >> Date: Sun, 6 Feb 2022 08:13:49 +0300 >> Subject: [PATCH v3] gnu: linux-pam: Change path to unix_chkpwd helper. >> >> * gnu/packages/patches/change-path-to-unix_chkpwd.patch: New file. >> * gnu/packages/linux.scm (linux-pam): Add patch. >> * gnu/system/pam.scm (pam-root-service-type): Add unix_chkpwd to setuid. > > LGTM, minor the patch file name as reported by ‘guix lint’ and missing > ‘gnu/local.mk’. > > However, it looks like my brain wasn’t fully operational when I > previously replied, because: > > --8<---------------cut here---------------start------------->8--- > $ guix refresh -l linux-pam > Building the following 2418 packages would ensure 6038 dependent > packages are rebuilt: […] > --8<---------------cut here---------------end--------------->8--- > > So I went ahead, fixed up the issues above, and pushed to > ‘core-updates’. Thank you very much!) When is the next core-update to master merge scheduled?
Hi,
Andrew Tropin <andrew@trop.in> skribis:
> When is the next core-update to master merge scheduled?
It’s not scheduled, but it’s likely several months from now… maybe less
if motivated people help drive the effort. :-)
Ludo’.
From e96d3f6d82b134829fcb31777e81928c73847dcc Mon Sep 17 00:00:00 2001 From: Andrew Tropin <andrew@trop.in> Date: Sun, 6 Feb 2022 08:13:49 +0300 Subject: [PATCH v3] gnu: linux-pam: Change path to unix_chkpwd helper. * gnu/packages/patches/change-path-to-unix_chkpwd.patch: New file. * gnu/packages/linux.scm (linux-pam): Add patch. * gnu/system/pam.scm (pam-root-service-type): Add unix_chkpwd to setuid. --- gnu/packages/linux.scm | 3 ++- .../patches/change-path-to-unix_chkpwd.patch | 13 +++++++++++++ gnu/system/pam.scm | 10 ++++++++-- 3 files changed, 23 insertions(+), 3 deletions(-) create mode 100644 gnu/packages/patches/change-path-to-unix_chkpwd.patch diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm index 2e2d01c656..bc2927d0b4 100644 --- a/gnu/packages/linux.scm +++ b/gnu/packages/linux.scm @@ -1625,7 +1625,8 @@ (define-public linux-pam (sha256 (base32 "1z4jayf69qyyxln1gl6ch4qxfd66ib1g42garnrv2d8i1drl0790")) - (patches (search-patches "linux-pam-no-setfsuid.patch")))) + (patches (search-patches "change-path-to-unix_chkpwd.patch" + "linux-pam-no-setfsuid.patch")))) (build-system gnu-build-system) (native-inputs diff --git a/gnu/packages/patches/change-path-to-unix_chkpwd.patch b/gnu/packages/patches/change-path-to-unix_chkpwd.patch new file mode 100644 index 0000000000..e5c6d2649c --- /dev/null +++ b/gnu/packages/patches/change-path-to-unix_chkpwd.patch @@ -0,0 +1,13 @@ +From: Andrew Tropin <andrew@trop.in> +Date: Sat, 5 Feb 2022 21:06:42 +0300 +Subject: [PATCH] Change path to unix_chkpwd. + +unix_chkpwd is designed to have a suid bit, but it's not possible to set it +for files in /gnu/store, and this patch tells unix_pam.so to lookup up for +unix_chkpwd in directory generated by setuid-program system service. + +--- a/modules/pam_unix/Makefile.in ++++ b/modules/pam_unix/Makefile.in +@@ -651,1 +651,1 @@ +- -DCHKPWD_HELPER=\"$(sbindir)/unix_chkpwd\" \ ++ -DCHKPWD_HELPER=\"/run/setuid-programs/unix_chkpwd\" \ diff --git a/gnu/system/pam.scm b/gnu/system/pam.scm index 2574e019f1..b635681642 100644 --- a/gnu/system/pam.scm +++ b/gnu/system/pam.scm @@ -21,6 +21,7 @@ (define-module (gnu system pam) #:use-module (guix derivations) #:use-module (guix gexp) #:use-module (gnu services) + #:use-module (gnu system setuid) #:use-module (ice-9 match) #:use-module (srfi srfi-1) #:use-module (srfi srfi-9) @@ -375,8 +376,13 @@ (define (extend-configuration initial extensions) (define pam-root-service-type (service-type (name 'pam) - (extensions (list (service-extension etc-service-type - /etc-entry))) + (extensions + (list (service-extension + setuid-program-service-type + (lambda (_) + (list (file-like->setuid-program + (file-append linux-pam "/sbin/unix_chkpwd"))))) + (service-extension etc-service-type /etc-entry))) ;; Arguments include <pam-service> as well as procedures. (compose concatenate) -- 2.34.0