ryan77627/guix
1
0
Fork 0
mirror of https://git.in.rschanz.org/ryan77627/guix.git synced 2024-11-07 07:26:13 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

system: Add privileged-programs to <operating-system>.

Browse source 
* gnu/system.scm (<operating-system>): Add new privileged-programs
field, that defaults to…
(%default-privileged-programs): …this new variable, renamed from…
(%setuid-programs): …this, which is now defined as the empty list.
* doc/guix.texi (Setuid Programs): Rename this…
(Privileged Programs): …to this.  Adjust all refs.  Update all mentions
of ‘setuid’ (whether in prose, variable names, or code samples) to use
the new ‘privilege[d]’ terminology instead.
(operating-system Reference, X Window, Invoking guix system)
(Service Reference): Adjust likewise.
This commit is contained in:
Tobias Geerinckx-Rice 2022-10-23 02:00:01 +02:00
parent beb37ea4ad
commit 4e58dfee6c
No known key found for this signature in database
GPG key ID: 0DB0FF884F556D79
4 changed files with 60 additions and 45 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

81
doc/guix.texi
View file

@ -370,7 +370,7 @@ System Configuration
* Keyboard Layout:: How the system interprets key strokes. * Keyboard Layout:: How the system interprets key strokes.
* Locales:: Language and cultural convention settings. * Locales:: Language and cultural convention settings.
* Services:: Specifying system services. * Services:: Specifying system services.
* Setuid Programs:: Programs running with elevated privileges. * Privileged Programs:: Programs running with elevated privileges.
* X.509 Certificates:: Authenticating HTTPS servers. * X.509 Certificates:: Authenticating HTTPS servers.
* Name Service Switch:: Configuring libc's name service switch. * Name Service Switch:: Configuring libc's name service switch.
* Initial RAM Disk:: Linux-Libre bootstrapping. * Initial RAM Disk:: Linux-Libre bootstrapping.
@ -16965,7 +16965,7 @@ instance to support new system services.
* Keyboard Layout:: How the system interprets key strokes. * Keyboard Layout:: How the system interprets key strokes.
* Locales:: Language and cultural convention settings. * Locales:: Language and cultural convention settings.
* Services:: Specifying system services. * Services:: Specifying system services.
* Setuid Programs:: Programs running with elevated privileges. * Privileged Programs:: Programs running with elevated privileges.
* X.509 Certificates:: Authenticating HTTPS servers. * X.509 Certificates:: Authenticating HTTPS servers.
* Name Service Switch:: Configuring libc's name service switch. * Name Service Switch:: Configuring libc's name service switch.
* Initial RAM Disk:: Linux-Libre bootstrapping. * Initial RAM Disk:: Linux-Libre bootstrapping.
@ -17689,9 +17689,9 @@ touch this field.
Linux @dfn{pluggable authentication module} (PAM) services. Linux @dfn{pluggable authentication module} (PAM) services.
@c FIXME: Add xref to PAM services section. @c FIXME: Add xref to PAM services section.
@item @code{setuid-programs} (default: @code{%setuid-programs}) @item @code{privileged-programs} (default: @code{%default-privileged-programs})
List of @code{<setuid-program>}. @xref{Setuid Programs}, for more List of @code{<privileged-program>}. @xref{Privileged Programs}, for
information. more information.
@item @code{sudoers-file} (default: @code{%sudoers-specification}) @item @code{sudoers-file} (default: @code{%sudoers-specification})
@cindex sudoers file @cindex sudoers file
@ -23700,10 +23700,10 @@ environment, you are unlikely to need this procedure.
@defvar screen-locker-service-type @defvar screen-locker-service-type
Type for a service that adds a package for a screen locker or screen Type for a service that adds a package for a screen locker or screen
saver to the set of setuid programs and/or add a PAM entry for it. The saver to the set of privileged programs and/or add a PAM entry for it. The
value for this service is a @code{<screen-locker-configuration>} object. value for this service is a @code{<screen-locker-configuration>} object.
While the default behavior is to setup both a setuid program and PAM While the default behavior is to setup both a privileged program and PAM
entry, these two methods are redundant. Screen locker programs may not entry, these two methods are redundant. Screen locker programs may not
execute when PAM is configured and @code{setuid} is set on their execute when PAM is configured and @code{setuid} is set on their
executable. In this case, @code{using-setuid?} can be set to @code{#f}. executable. In this case, @code{using-setuid?} can be set to @code{#f}.
@ -27877,7 +27877,7 @@ remote servers. Run @command{man smtpd.conf} for more information.
Make the following commands setgid to @code{smtpq} so they can be Make the following commands setgid to @code{smtpq} so they can be
executed: @command{smtpctl}, @command{sendmail}, @command{send-mail}, executed: @command{smtpctl}, @command{sendmail}, @command{send-mail},
@command{makemap}, @command{mailq}, and @command{newaliases}. @command{makemap}, @command{mailq}, and @command{newaliases}.
@xref{Setuid Programs}, for more information on setgid programs. @xref{Privileged Programs}, for more information on setgid programs.
@end table @end table
@end deftp @end deftp
@ -40848,8 +40848,8 @@ create and run application bundles (aka. ``containers''). The value for this
service is the Singularity package to use. service is the Singularity package to use.
The service does not install a daemon; instead, it installs helper programs as The service does not install a daemon; instead, it installs helper programs as
setuid-root (@pxref{Setuid Programs}) such that unprivileged users can invoke setuid-root (@pxref{Privileged Programs}) such that unprivileged users can
@command{singularity run} and similar commands. invoke @command{singularity run} and similar commands.
@end defvar @end defvar
@cindex OCI-backed, Shepherd services @cindex OCI-backed, Shepherd services
@ -41649,9 +41649,10 @@ invokation.
@c %end of fragment @c %end of fragment
@node Setuid Programs @node Privileged Programs
@section Setuid Programs @section Privileged Programs
@cindex privileged programs
@cindex setuid programs @cindex setuid programs
@cindex setgid programs @cindex setgid programs
Some programs need to run with elevated privileges, even when they are Some programs need to run with elevated privileges, even when they are
@ -41664,46 +41665,48 @@ obvious security reasons. To address that, @command{passwd} should be
(@pxref{How Change Persona,,, libc, The GNU C Library Reference Manual}, (@pxref{How Change Persona,,, libc, The GNU C Library Reference Manual},
for more info about the setuid mechanism). for more info about the setuid mechanism).
The store itself @emph{cannot} contain setuid programs: that would be a The store itself @emph{cannot} contain privileged programs: that would be
security issue since any user on the system can write derivations that a security issue since any user on the system can write derivations that
populate the store (@pxref{The Store}). Thus, a different mechanism is populate the store (@pxref{The Store}). Thus, a different mechanism is
used: instead of changing the setuid or setgid bits directly on files that used: instead of directly granting permissions to files that are in
are in the store, we let the system administrator @emph{declare} which the store, we let the system administrator @emph{declare} which
programs should be entrusted with these additional privileges. programs should be entrusted with these additional privileges.
The @code{setuid-programs} field of an @code{operating-system} The @code{privileged-programs} field of an @code{operating-system}
declaration contains a list of @code{<setuid-program>} denoting the declaration contains a list of @code{<privileged-program>} denoting the
names of programs to have a setuid or setgid bit set (@pxref{Using the names of programs to have a setuid or setgid bit set (@pxref{Using the
Configuration System}). For instance, the @command{mount.nfs} program, Configuration System}). For instance, the @command{mount.nfs} program,
which is part of the nfs-utils package, with a setuid root can be which is part of the nfs-utils package, with a setuid root can be
designated like this: designated like this:
@lisp @lisp
(setuid-program (privileged-program
(program (file-append nfs-utils "/sbin/mount.nfs"))) (program (file-append nfs-utils "/sbin/mount.nfs"))
(setuid? #t))
@end lisp @end lisp
And then, to make @command{mount.nfs} setuid on your system, add the And then, to make @command{mount.nfs} setuid on your system, add the
previous example to your operating system declaration by appending it to previous example to your operating system declaration by appending it to
@code{%setuid-programs} like this: @code{%default-privileged-programs} like this:
@lisp @lisp
(operating-system (operating-system
;; Some fields omitted... ;; Some fields omitted...
(setuid-programs (privileged-programs
(append (list (setuid-program (append (list (privileged-program
(program (file-append nfs-utils "/sbin/mount.nfs")))) (program (file-append nfs-utils "/sbin/mount.nfs"))
%setuid-programs))) (setuid? #t))
%default-privileged-programs)))
@end lisp @end lisp
@deftp {Data Type} setuid-program @deftp {Data Type} privileged-program
This data type represents a program with a setuid or setgid bit set. This data type represents a program with special privileges, such as setuid
@table @asis @table @asis
@item @code{program} @item @code{program}
A file-like object having its setuid and/or setgid bit set. A file-like object to which all given privileges should apply.
@item @code{setuid?} (default: @code{#t}) @item @code{setuid?} (default: @code{#f})
Whether to set user setuid bit. Whether to set user setuid bit.
@item @code{setgid?} (default: @code{#f}) @item @code{setgid?} (default: @code{#f})
@ -41720,18 +41723,18 @@ defaults to root.
@end table @end table
@end deftp @end deftp
A default set of setuid programs is defined by the A default set of privileged programs is defined by the
@code{%setuid-programs} variable of the @code{(gnu system)} module. @code{%default-privileged-programs} variable of the @code{(gnu system)} module.
@defvar %setuid-programs @defvar {Scheme Variable} %default-privileged-programs
A list of @code{<setuid-program>} denoting common programs that are A list of @code{<privileged-program>} denoting common programs with
setuid-root. elevated privileges.
The list includes commands such as @command{passwd}, @command{ping}, The list includes commands such as @command{passwd}, @command{ping},
@command{su}, and @command{sudo}. @command{su}, and @command{sudo}.
@end defvar @end defvar
Under the hood, the actual setuid programs are created in the Under the hood, the actual privileged programs are created in the
@file{/run/privileged/bin} directory at system activation time. The @file{/run/privileged/bin} directory at system activation time. The
files in this directory refer to the ``real'' binaries, which are in the files in this directory refer to the ``real'' binaries, which are in the
store. store.
@ -42674,7 +42677,7 @@ once @command{reconfigure} has completed.
@end quotation @end quotation
This effects all the configuration specified in @var{file}: user This effects all the configuration specified in @var{file}: user
accounts, system services, global package list, setuid programs, etc. accounts, system services, global package list, privileged programs, etc.
The command starts system services specified in @var{file} that are not The command starts system services specified in @var{file} that are not
currently running; if a service is currently running this command will currently running; if a service is currently running this command will
arrange for it to be upgraded the next time it is stopped (e.g.@: by arrange for it to be upgraded the next time it is stopped (e.g.@: by
@ -44047,10 +44050,10 @@ In this example, the effect would be to add an @file{/etc/issue} file
pointing to the given file. pointing to the given file.
@end defvar @end defvar
@defvar setuid-program-service-type @defvar privileged-program-service-type
Type for the ``setuid-program service''. This service collects lists of Type for the ``privileged-program service''. This service collects lists of
executable file names, passed as gexps, and adds them to the set of executable file names, passed as gexps, and adds them to the set of
setuid and setgid programs on the system (@pxref{Setuid Programs}). privileged programs on the system (@pxref{Privileged Programs}).
@end defvar @end defvar
@defvar profile-service-type @defvar profile-service-type

2
gnu/packages/crypto.scm
View file

@ -504,7 +504,7 @@ (define-public tomb
`(#:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out"))) `(#:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out")))
;; The "sudo" input is needed only to satisfy dependency checks in the ;; The "sudo" input is needed only to satisfy dependency checks in the
;; 'check' phase. The "sudo" used at runtime should come from the ;; 'check' phase. The "sudo" used at runtime should come from the
;; system's setuid-programs, so ensure no reference is kept. ;; system's privileged-programs, so ensure no reference is kept.
#:disallowed-references (,sudo) #:disallowed-references (,sudo)
;; TODO: Build and install gtk and qt trays ;; TODO: Build and install gtk and qt trays
#:phases #:phases

1
gnu/services.scm
View file

@ -47,7 +47,6 @@ (define-module (gnu services)
#:use-module (gnu packages bash) #:use-module (gnu packages bash)
#:use-module (gnu packages hurd) #:use-module (gnu packages hurd)
#:use-module (gnu system privilege) #:use-module (gnu system privilege)
#:use-module (gnu system setuid)
#:use-module (srfi srfi-1) #:use-module (srfi srfi-1)
#:use-module (srfi srfi-9) #:use-module (srfi srfi-9)
#:use-module (srfi srfi-9 gnu) #:use-module (srfi srfi-9 gnu)

21
gnu/system.scm
View file

@ -77,6 +77,7 @@ (define-module (gnu system)
#:use-module (gnu system locale) #:use-module (gnu system locale)
#:use-module (gnu system pam) #:use-module (gnu system pam)
#:use-module (gnu system linux-initrd) #:use-module (gnu system linux-initrd)
#:use-module (gnu system privilege)
#:use-module (gnu system setuid) #:use-module (gnu system setuid)
#:use-module (gnu system uuid) #:use-module (gnu system uuid)
#:use-module (gnu system file-systems) #:use-module (gnu system file-systems)
@ -130,6 +131,7 @@ (define-module (gnu system)
operating-system-keyboard-layout operating-system-keyboard-layout
operating-system-name-service-switch operating-system-name-service-switch
operating-system-pam-services operating-system-pam-services
operating-system-privileged-programs
operating-system-setuid-programs operating-system-setuid-programs
operating-system-skeletons operating-system-skeletons
operating-system-sudoers-file operating-system-sudoers-file
@ -174,6 +176,7 @@ (define-module (gnu system)
local-host-aliases ;deprecated local-host-aliases ;deprecated
%root-account %root-account
%default-privileged-programs
%setuid-programs %setuid-programs
%sudoers-specification %sudoers-specification
%base-packages %base-packages
@ -301,7 +304,10 @@ (define-record-type* <operating-system> operating-system
(pam-services operating-system-pam-services ; list of PAM services (pam-services operating-system-pam-services ; list of PAM services
(default (base-pam-services))) (default (base-pam-services)))
(privileged-programs operating-system-privileged-programs ; list of <privileged-program>
(default %default-privileged-programs))
(setuid-programs operating-system-setuid-programs (setuid-programs operating-system-setuid-programs
;; For backwards compatibility; will be removed.
(default %setuid-programs)) ; list of <setuid-program> (default %setuid-programs)) ; list of <setuid-program>
(sudoers-file operating-system-sudoers-file ; file-like (sudoers-file operating-system-sudoers-file ; file-like
@ -821,7 +827,8 @@ (define known-fs
(service host-name-service-type host-name) (service host-name-service-type host-name)
procs root-fs procs root-fs
(service privileged-program-service-type (service privileged-program-service-type
(operating-system-setuid-programs os)) (append (operating-system-privileged-programs os)
(operating-system-setuid-programs os)))
(service profile-service-type (service profile-service-type
(operating-system-packages os)) (operating-system-packages os))
boot-fs non-boot-fs boot-fs non-boot-fs
@ -860,7 +867,8 @@ (define (hurd-default-essential-services os)
(service hosts-service-type (service hosts-service-type
(local-host-entries host-name))) (local-host-entries host-name)))
(service privileged-program-service-type (service privileged-program-service-type
(operating-system-setuid-programs os)) (append (operating-system-privileged-programs os)
(operating-system-setuid-programs os)))
(service profile-service-type (operating-system-packages os))))) (service profile-service-type (operating-system-packages os)))))
(define* (operating-system-services os) (define* (operating-system-services os)
@ -1239,8 +1247,7 @@ (define (operating-system-environment-variables os)
;; when /etc/machine-id is missing. Make sure these warnings are non-fatal. ;; when /etc/machine-id is missing. Make sure these warnings are non-fatal.
("DBUS_FATAL_WARNINGS" . "0"))) ("DBUS_FATAL_WARNINGS" . "0")))
(define %setuid-programs (define %default-privileged-programs
;; Default set of setuid-root programs.
(let ((shadow (@ (gnu packages admin) shadow))) (let ((shadow (@ (gnu packages admin) shadow)))
(map file-like->setuid-program (map file-like->setuid-program
(list (file-append shadow "/bin/passwd") (list (file-append shadow "/bin/passwd")
@ -1262,6 +1269,12 @@ (define %setuid-programs
(file-append util-linux "/bin/mount") (file-append util-linux "/bin/mount")
(file-append util-linux "/bin/umount"))))) (file-append util-linux "/bin/umount")))))
(define %setuid-programs
;; Do not add to this list or use it in new code! It's defined only to ease
;; transition to %default-privileged-programs and will be removed. Some rare
;; use cases already break, such as the obvious (remove … %setuid-programs).
'())
(define %sudoers-specification (define %sudoers-specification
;; Default /etc/sudoers contents: 'root' and all members of the 'wheel' ;; Default /etc/sudoers contents: 'root' and all members of the 'wheel'
;; group can do anything. See ;; group can do anything. See