From patchwork Sun Feb 6 05:16:54 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Andrew Tropin X-Patchwork-Id: 37015 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id 7420F27BBEA; Sun, 6 Feb 2022 05:18:12 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,SPF_HELO_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.6 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id E78BD27BBE9 for ; Sun, 6 Feb 2022 05:18:11 +0000 (GMT) Received: from localhost ([::1]:44198 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1nGZwB-0002jp-0l for patchwork@mira.cbaines.net; Sun, 06 Feb 2022 00:18:11 -0500 Received: from eggs.gnu.org ([209.51.188.92]:46902) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nGZw2-0002jd-OF for guix-patches@gnu.org; Sun, 06 Feb 2022 00:18:02 -0500 Received: from debbugs.gnu.org ([209.51.188.43]:42284) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1nGZw2-00057E-E7 for guix-patches@gnu.org; Sun, 06 Feb 2022 00:18:02 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1nGZw2-0002Bn-7P for guix-patches@gnu.org; Sun, 06 Feb 2022 00:18:02 -0500 X-Loop: help-debbugs@gnu.org Subject: [bug#53468] [RFC PATCH] gnu: linux-pam: Change path to unix_chkpwd helper. Resent-From: Andrew Tropin Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 06 Feb 2022 05:18:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 53468 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Ludovic =?utf-8?q?Court=C3=A8s?= Cc: 53468@debbugs.gnu.org Received: via spool by 53468-submit@debbugs.gnu.org id=B53468.16441246338354 (code B ref 53468); Sun, 06 Feb 2022 05:18:02 +0000 Received: (at 53468) by debbugs.gnu.org; 6 Feb 2022 05:17:13 +0000 Received: from localhost ([127.0.0.1]:36181 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nGZvE-0002Ag-IA for submit@debbugs.gnu.org; Sun, 06 Feb 2022 00:17:12 -0500 Received: from mail-lf1-f52.google.com ([209.85.167.52]:39516) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nGZv7-0002A3-RV for 53468@debbugs.gnu.org; Sun, 06 Feb 2022 00:17:11 -0500 Received: by mail-lf1-f52.google.com with SMTP id b9so20630604lfq.6 for <53468@debbugs.gnu.org>; Sat, 05 Feb 2022 21:17:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trop-in.20210112.gappssmtp.com; s=20210112; h=from:to:cc:subject:in-reply-to:references:date:message-id :mime-version; bh=ulcpM5K5F1c2MEQvcHRaYh3z3LPHnI+ph/OxoPEJVRQ=; b=Z6ir9VFt7MBMut261Jq/1b047OFuzgKmUFpDnMqulSujgqvQ14PNuHQSOf2ycUvjG4 TIQ+x8O0Goq9ZHlvcvWbCdevHbF2h+yHViUmmtZMAKeDyTl0vVJbFv3rjxFMpRI0NQ5X 1heWyOLagV2TazpjFt4vliBPpLuRjUxifq/a1tJzFLSsNzzjq5td/jKiuxT52QPzY6td u8YDXqPyyzB7Z+jcUb6w7pDB7xHjJ8IMGJn2BVkdmYxolqHOX71Mx0WobDa2OPe3H/b7 /qA+joVIvFs43o33V8c/pLx8/TkEsrMtxF6GseN+DZIw5xvCqzNXWvdIEqSx2MslCtGI quEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:in-reply-to:references:date :message-id:mime-version; bh=ulcpM5K5F1c2MEQvcHRaYh3z3LPHnI+ph/OxoPEJVRQ=; b=pdSSvDg37N9NReKoOdeS62pj3NJfDlMYKTM+IpWgUSe+Aer3V750WMoI+hGlZKrCBL e/vU4ilX25rib+huC/kiVsKhClG001HFSpBzYRTb1chPTCBEbQgaKcgOn9w2JRMFMDmW /q2nrSxidKFpP2+FkHi3Br/pAyTTOdTlKBCJYhd9ZdH/XMk1xq3iSKYSMB26I80oqHie aeM6hj0keaQfTEhP8wBI8hc3yLMQuMBHQTODo0rUOlHj3OSj8iuay35ChvqjopXHdXYg gO7tIgQaJiAHZ5GydKqOspiEyF3gaEwV/S3vxxn0YGya56f3eYjPHViun6ATv6o7vMhA Tupw== X-Gm-Message-State: AOAM531qNDeNFXA6sdo1hasBNUnFLtBxDCbS8kD7cxaGFFIaU4MayhHc rv1s0kEN70aZWrGBF53KrHjlbw== X-Google-Smtp-Source: ABdhPJxmNORqvlBx9BjAXw2nc6oBv6T/yRYdg7nzXNAolxpeQnw/arJAdOMkQUcunmrOPLwQCD7+GA== X-Received: by 2002:ac2:5190:: with SMTP id u16mr4448829lfi.257.1644124619804; Sat, 05 Feb 2022 21:16:59 -0800 (PST) Received: from localhost (109-252-135-33.dynamic.spd-mgts.ru. [109.252.135.33]) by smtp.gmail.com with ESMTPSA id e24sm1029162ljj.131.2022.02.05.21.16.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 05 Feb 2022 21:16:57 -0800 (PST) From: Andrew Tropin In-Reply-To: <877daamgf2.fsf_-_@gnu.org> References: <87tudu38yz.fsf@trop.in> <87sftetuhg.fsf@trop.in> <877daamgf2.fsf_-_@gnu.org> Date: Sun, 06 Feb 2022 08:16:54 +0300 Message-ID: <878ruo60c9.fsf@trop.in> MIME-Version: 1.0 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: "Guix-patches" X-getmail-retrieved-from-mailbox: Patches On 2022-02-04 23:10, Ludovic Courtès wrote: > Hi! > > Andrew Tropin skribis: > >> From ad876e5b134072601fa97d82a39b320a269f34a5 Mon Sep 17 00:00:00 2001 >> From: Andrew Tropin >> Date: Thu, 13 Jan 2022 21:41:58 +0300 >> Subject: [RFC PATCH v2] gnu: linux-pam: Change path to unix_chkpwd helper. >> >> * gnu/packages/patches/change-path-to-unix_chkpwd.patch: New file >> * gnu/packages/linux.scm (linux-pam): Add patch. >> * gnu/system/pam.scm (pam-root-service-type): Add unix_chkpwd to setuid >> binaries. > > [...] > >> + DIAG_PUSH_IGNORE_CAST_QUAL; >> +- execve(CHKPWD_HELPER, (char *const *) args, envp); >> ++ execve("/run/setuid-programs/unix_chkpwd", (char *const *) args, envp); >> + DIAG_POP_IGNORE_CAST_QUAL; > > Looks reasonable to me. However, could you change the CHKPWD_HELPER > macro definition in the Makefile template, as you suggested, instead of > patching the file? Sure, done in v3. From e96d3f6d82b134829fcb31777e81928c73847dcc Mon Sep 17 00:00:00 2001 From: Andrew Tropin Date: Sun, 6 Feb 2022 08:13:49 +0300 Subject: [PATCH v3] gnu: linux-pam: Change path to unix_chkpwd helper. * gnu/packages/patches/change-path-to-unix_chkpwd.patch: New file. * gnu/packages/linux.scm (linux-pam): Add patch. * gnu/system/pam.scm (pam-root-service-type): Add unix_chkpwd to setuid. --- gnu/packages/linux.scm | 3 ++- .../patches/change-path-to-unix_chkpwd.patch | 13 +++++++++++++ gnu/system/pam.scm | 10 ++++++++-- 3 files changed, 23 insertions(+), 3 deletions(-) create mode 100644 gnu/packages/patches/change-path-to-unix_chkpwd.patch diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm index 2e2d01c656..bc2927d0b4 100644 --- a/gnu/packages/linux.scm +++ b/gnu/packages/linux.scm @@ -1625,7 +1625,8 @@ (define-public linux-pam (sha256 (base32 "1z4jayf69qyyxln1gl6ch4qxfd66ib1g42garnrv2d8i1drl0790")) - (patches (search-patches "linux-pam-no-setfsuid.patch")))) + (patches (search-patches "change-path-to-unix_chkpwd.patch" + "linux-pam-no-setfsuid.patch")))) (build-system gnu-build-system) (native-inputs diff --git a/gnu/packages/patches/change-path-to-unix_chkpwd.patch b/gnu/packages/patches/change-path-to-unix_chkpwd.patch new file mode 100644 index 0000000000..e5c6d2649c --- /dev/null +++ b/gnu/packages/patches/change-path-to-unix_chkpwd.patch @@ -0,0 +1,13 @@ +From: Andrew Tropin +Date: Sat, 5 Feb 2022 21:06:42 +0300 +Subject: [PATCH] Change path to unix_chkpwd. + +unix_chkpwd is designed to have a suid bit, but it's not possible to set it +for files in /gnu/store, and this patch tells unix_pam.so to lookup up for +unix_chkpwd in directory generated by setuid-program system service. + +--- a/modules/pam_unix/Makefile.in ++++ b/modules/pam_unix/Makefile.in +@@ -651,1 +651,1 @@ +- -DCHKPWD_HELPER=\"$(sbindir)/unix_chkpwd\" \ ++ -DCHKPWD_HELPER=\"/run/setuid-programs/unix_chkpwd\" \ diff --git a/gnu/system/pam.scm b/gnu/system/pam.scm index 2574e019f1..b635681642 100644 --- a/gnu/system/pam.scm +++ b/gnu/system/pam.scm @@ -21,6 +21,7 @@ (define-module (gnu system pam) #:use-module (guix derivations) #:use-module (guix gexp) #:use-module (gnu services) + #:use-module (gnu system setuid) #:use-module (ice-9 match) #:use-module (srfi srfi-1) #:use-module (srfi srfi-9) @@ -375,8 +376,13 @@ (define (extend-configuration initial extensions) (define pam-root-service-type (service-type (name 'pam) - (extensions (list (service-extension etc-service-type - /etc-entry))) + (extensions + (list (service-extension + setuid-program-service-type + (lambda (_) + (list (file-like->setuid-program + (file-append linux-pam "/sbin/unix_chkpwd"))))) + (service-extension etc-service-type /etc-entry))) ;; Arguments include as well as procedures. (compose concatenate) -- 2.34.0