From patchwork Wed Apr 23 14:13:10 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sergey Trofimov X-Patchwork-Id: 41956 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id 3FBFE27BC4A; Wed, 23 Apr 2025 15:14:29 +0100 (BST) X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-6.4 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_BLOCKED, RCVD_IN_VALIDITY_CERTIFIED,RCVD_IN_VALIDITY_RPBL,RCVD_IN_VALIDITY_SAFE, SPF_HELO_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.6 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id 5CE0A27BC49 for ; Wed, 23 Apr 2025 15:14:27 +0100 (BST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1u7ari-0006ev-Bg; Wed, 23 Apr 2025 10:14:18 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1u7ara-0006eE-HW for guix-patches@gnu.org; Wed, 23 Apr 2025 10:14:12 -0400 Received: from debbugs.gnu.org ([2001:470:142:5::43]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1u7arU-0000WC-R7 for guix-patches@gnu.org; Wed, 23 Apr 2025 10:14:10 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debbugs.gnu.org; s=debbugs-gnu-org; h=MIME-Version:Date:From:To:In-Reply-To:References:Subject; bh=UHePvj8IKTcbzSwSTo845mfz7fvBW79NuXUPYHFFFoc=; b=Q1nRnbd+2mJNMF6V/1qQe/UZxvrN6ZMRQgnqOzQH2Mi2VzvI2Nk80mgY6eyc2BQTX01/2U8aoay3xekGEXb073MZEdQQLJrj/u1lGKpMgBaeUl/IWf4E2v3VN3z3HVTi+UJqw0t3a+TDpGfmbX9YqUMANCyA6edsLjptZAPwwr/Q7ZUsvVtg1dwoQ1ld+MO7ncie1NkVyOUZaMnOhY4mTVw2/VJfTJ+zlUJKn0BRyEFB/0q6m75XDT6J4O1EIG5LjguNKHKN6l3vhEQFJKdvvNXmlY+XWP/Of20xIW8Cv8bx6IihWtoUxaOvCEvzAem3Z1L7hqYEkFJVKapxBki+eQ==; Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1u7arU-0007wt-4Q; Wed, 23 Apr 2025 10:14:04 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#77968] [PATCH v1] gnu: openssh: Adapt for root-less guix store. References: In-Reply-To: Resent-From: Sergey Trofimov Original-Sender: "Debbugs-submit" Resent-CC: sarg@sarg.org.ru, guix-patches@gnu.org Resent-Date: Wed, 23 Apr 2025 14:14:04 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 77968 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 77968@debbugs.gnu.org Cc: Sergey Trofimov , Sergey Trofimov X-Debbugs-Original-Xcc: Sergey Trofimov Received: via spool by 77968-submit@debbugs.gnu.org id=B77968.174541761130179 (code B ref 77968); Wed, 23 Apr 2025 14:14:04 +0000 Received: (at 77968) by debbugs.gnu.org; 23 Apr 2025 14:13:31 +0000 Received: from localhost ([127.0.0.1]:58154 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1u7aqv-0007qR-AE for submit@debbugs.gnu.org; Wed, 23 Apr 2025 10:13:30 -0400 Received: from mail-ed1-x536.google.com ([2a00:1450:4864:20::536]:58636) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from ) id 1u7aqo-0007oI-Dp for 77968@debbugs.gnu.org; Wed, 23 Apr 2025 10:13:26 -0400 Received: by mail-ed1-x536.google.com with SMTP id 4fb4d7f45d1cf-5e8be1c6ff8so11669894a12.1 for <77968@debbugs.gnu.org>; Wed, 23 Apr 2025 07:13:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sarg.org.ru; s=google; t=1745417596; x=1746022396; darn=debbugs.gnu.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=UHePvj8IKTcbzSwSTo845mfz7fvBW79NuXUPYHFFFoc=; b=UBQa67gH94Jmqh4ky+ns7OTtrZU6BGW6eljtZUeLofK1++UXNa5VVYhyCobr5P4qb8 tUoj+WeouCY2OZCOGqbf2ffgYxWoCmttLFuUl0p8t6DwfK1Zn5yoQnVQq5W1pRsMrqqb 4mz1BiyO043BKBRsDVfqhXc0v/5WxU6KzglPitVD04Au3pxO5dWgAqLFs8gyeC+nV0DV 8pKa3Y1oEM0xPKTJUkniEgKzYxAtTrshmWdk20Zy9PALqlaAneM4Bhscmhb1XbQj1PlK cN1e5jeR2pULdxP8LWVkOXmp/CbBbWLF69LsCbwk6MpQ8gpRoMNzpfd5ou0Aq+wge41P FBKQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1745417596; x=1746022396; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=UHePvj8IKTcbzSwSTo845mfz7fvBW79NuXUPYHFFFoc=; b=Llr4M4mNUjRABQTQeUmm4Q9R+FtHRie66lj+ngrXbXQLPFexhJ3vmrDc4edKVKj/4z MrmV/AV9afy99QS2M2abIshWQ3TmbKYRbzJne9LXHlbxuQfiIhYGZAPM0iottS6hm29y L2ENDAlfKSbB4bSUz8G/7+fyD5P5IRdacmdAx7pMF89RIDxOD4gj73ahOQzgCztPDMV7 ONb6NM7jZnP90gu+eaD6WTLlP3yNBnpaHczRRsnIaqel7dBgaLsCLL5v/W+ma32dmlIZ 47k1DTg81RUS+2LRY7mklkhmSR3EjaqKCbo1A6PCOHPA2XMfXFfSa9k8KssgvlXvt4c3 jH5g== X-Gm-Message-State: AOJu0YzU9C3woL5M81uzD5PRU3g1MtOlsDDVxR5reFmQBNcC2s1yyCGP G37ISNshqSc6tuhLNyYyvJiPvdySkrP59Q2b0R6MyJLvh1zNU6jYy2Mwg3OQ82SIrLu+62bY/Xm 8BZg= X-Gm-Gg: ASbGncuIZt/aTyDgEYuFEgb1QAZFwNc7RlEZel8oH0IOB0AMmx1zcXHWEscEFXfL0Wh s/053ptI+07e2DpE23hURnSNn6xURt2oMbQy0VurRuyeEzCugePQE+ASvVQyp37JZ9hzOAasZBe r4XiS0mMOYKaLvjiEgfdN/r63i4KIY5NeKcH6p9Ed+EWleYysj0eksq2XUpPpI19HrYqyLFR2yt zIkaGqR5CCoLEukW6BjPXoNgQu1JgC8YlTLHaBPMbJm5DDxz8ADHUE2BQ/iQb35HSFvH+SmQLyK EHpz4nguqkv68BzekfRnrMP5paycYkmvoKfxccHI0IdAWeqZ X-Google-Smtp-Source: AGHT+IGrkwcNDQJaDtBE5P5PeATUdoq+ZJJCT9rrMwm/EmmRI99gVMjtmGAzMh8oKfMR+XU6Q+LYRA== X-Received: by 2002:a05:6402:518d:b0:5f4:d5c7:d6f7 with SMTP id 4fb4d7f45d1cf-5f62853dc20mr16729246a12.8.1745417595233; Wed, 23 Apr 2025 07:13:15 -0700 (PDT) Received: from localhost ([2a02:2454:a095:5600:a64e:31ff:fe38:fd6c]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-5f62554a102sm7404324a12.10.2025.04.23.07.13.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 23 Apr 2025 07:13:14 -0700 (PDT) Date: Wed, 23 Apr 2025 16:13:10 +0200 Message-ID: <832e1767fc8d3203c8804035c344df0f99d5716d.1745417565.git.sarg@sarg.org.ru> X-Mailer: git-send-email 2.49.0 MIME-Version: 1.0 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-to: Sergey Trofimov X-ACL-Warn: , Sergey Trofimov via Guix-patches X-Patchwork-Original-From: Sergey Trofimov via Guix-patches via From: Sergey Trofimov Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org X-getmail-retrieved-from-mailbox: Patches * gnu/packages/patches/openssh-trust-guix-store-directory.patch (openssh): Adjust to trust files in guix store owned by guix-daemon. * gnu/packages/ssh.scm (openssh): [phases]: Append ending slash when substituting STORE_DIRECTORY. Use default PRIVSEP_PATH (/var/empty). Change-Id: I3bd01f8b9d6406e3b886eea8f4b8c265a51cc72f --- .../openssh-trust-guix-store-directory.patch | 67 +++++++++++++------ gnu/packages/ssh.scm | 14 ++-- 2 files changed, 51 insertions(+), 30 deletions(-) base-commit: 699ce22ed812cf8cfcdd8d0341829f8fac2c864a -- 2.49.0 diff --git a/gnu/packages/patches/openssh-trust-guix-store-directory.patch b/gnu/packages/patches/openssh-trust-guix-store-directory.patch index b3a9c1bdfc..d190740f10 100644 --- a/gnu/packages/patches/openssh-trust-guix-store-directory.patch +++ b/gnu/packages/patches/openssh-trust-guix-store-directory.patch @@ -3,20 +3,20 @@ From: Alexey Abramov Date: Fri, 22 Apr 2022 11:32:15 +0200 Subject: [PATCH] Trust guix store directory -To be able to execute binaries defined in OpenSSH configuration, we -need to tell OpenSSH that we can trust Guix store objects. safe_path -procedure takes a canonical path and for each component, walking -upwards, checks ownership and permissions constrains which are: must -be owned by root, not writable by group or others. +To be able to execute binaries defined in OpenSSH configuration, we need to +tell OpenSSH that we can trust Guix store objects. safe_path procedure is +patched to assume files in Guix store to be safe. Additionally configuration +file placed in Guix store is assumed to be safe to load. --- - misc.c | 5 +++++ - 1 file changed, 5 insertions(+) + misc.c | 6 ++++++ + readconf.c | 7 ++++--- + 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/misc.c b/misc.c -index 0134d69..7131d5e 100644 +index dd0bd032a..6b866464c 100644 --- a/misc.c +++ b/misc.c -@@ -2146,6 +2146,7 @@ int +@@ -2254,6 +2254,7 @@ int safe_path(const char *name, struct stat *stp, const char *pw_dir, uid_t uid, char *err, size_t errlen) { @@ -24,17 +24,42 @@ index 0134d69..7131d5e 100644 char buf[PATH_MAX], homedir[PATH_MAX]; char *cp; int comparehome = 0; -@@ -2178,6 +2179,10 @@ safe_path(const char *name, struct stat *stp, const char *pw_dir, - } - strlcpy(buf, cp, sizeof(buf)); - -+ /* If we are past the Guix store then we can stop */ -+ if (strcmp(guix_store, buf) == 0) -+ break; +@@ -2271,6 +2272,11 @@ safe_path(const char *name, struct stat *stp, const char *pw_dir, + snprintf(err, errlen, "%s is not a regular file", buf); + return -1; + } ++ // the file is trusted when it is located in guix store ++ if (strncmp(buf, guix_store, strlen(guix_store)) == 0) { ++ return 0; ++ } + - if (stat(buf, &st) == -1 || - (!platform_sys_dir_uid(st.st_uid) && st.st_uid != uid) || - (st.st_mode & 022) != 0) { + if ((!platform_sys_dir_uid(stp->st_uid) && stp->st_uid != uid) || + (stp->st_mode & 022) != 0) { + snprintf(err, errlen, "bad ownership or modes for file %s", +diff --git a/readconf.c b/readconf.c +index 7cbe7d2c2..40a5f1ace 100644 +--- a/readconf.c ++++ b/readconf.c +@@ -2566,6 +2566,7 @@ read_config_file_depth(const char *filename, struct passwd *pw, + { + FILE *f; + char *line = NULL; ++ char errmsg[512]; + size_t linesize = 0; + int linenum; + int bad_options = 0; +@@ -2581,9 +2582,9 @@ read_config_file_depth(const char *filename, struct passwd *pw, + + if (fstat(fileno(f), &sb) == -1) + fatal("fstat %s: %s", filename, strerror(errno)); +- if (((sb.st_uid != 0 && sb.st_uid != getuid()) || +- (sb.st_mode & 022) != 0)) +- fatal("Bad owner or permissions on %s", filename); ++ if (safe_path(filename, &sb, pw->pw_dir, pw->pw_uid, errmsg, sizeof(errmsg)) != 0) { ++ fatal(errmsg); ++ } + } + + debug("Reading configuration data %.200s", filename); -- -2.34.0 - +2.49.0 diff --git a/gnu/packages/ssh.scm b/gnu/packages/ssh.scm index 5f0b3e2a6a..0518d2ee1c 100644 --- a/gnu/packages/ssh.scm +++ b/gnu/packages/ssh.scm @@ -267,16 +267,11 @@ (define-public openssh '())) #:phases #~(modify-phases %standard-phases - (add-after 'configure 'reset-/var/empty - (lambda _ - (substitute* "Makefile" - (("PRIVSEP_PATH=/var/empty") - (string-append "PRIVSEP_PATH=" #$output "/var/empty"))))) (add-after 'configure 'set-store-location (lambda _ (substitute* "misc.c" (("@STORE_DIRECTORY@") - (string-append "\"" (%store-directory) "\""))))) + (string-append "\"" (%store-directory) "/\""))))) (add-before 'check 'patch-tests (lambda _ (substitute* "regress/test-exec.sh" @@ -289,9 +284,10 @@ (define-public openssh (string-append pre post))))) (replace 'install (lambda* (#:key (make-flags '()) #:allow-other-keys) - ;; Install without host keys and system configuration files. This - ;; will install /var/empty to the store, which is needed by the - ;; system openssh-service-type. + ;; don't create /var/empty + (substitute* "Makefile" + ((".*MKDIR_P.*PRIVSEP_PATH.*") "")) + ;; Install without host keys and system configuration files. (apply invoke "make" "install-nosysconf" make-flags) (with-directory-excursion "contrib" (chmod "ssh-copy-id" #o555)