ryan77627/guix
1
0
Fork 0
mirror of https://git.in.rschanz.org/ryan77627/guix.git synced 2024-12-24 05:18:07 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

services: setuid-program: Populate /run/privileged/bin.

Browse source 
Create /run/setuid-programs compatibility symlinks so that we can
migrate all users (both package and human) piecemeal at our leisure.

Apart from being symlinks, this should be a user-invisible change.

* gnu/build/activation.scm (%privileged-program-directory): New variable.
[activate-setuid-programs]: Put privileged copies in
%PRIVILEGED-PROGRAM-DIRECTORY, with compatibility symlinks to each in
%SETUID-DIRECTORY.
* gnu/services.scm (setuid-program-service-type): Update docstring.
* doc/guix.texi (Setuid Programs): Update @file{} name accordingly.
This commit is contained in:
Tobias Geerinckx-Rice 2022-05-29 02:00:00 +02:00
parent 0dffb851e0
commit d6c9754c56
No known key found for this signature in database
GPG key ID: 0DB0FF884F556D79
3 changed files with 44 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
doc/guix.texi
View file

@ -41732,7 +41732,7 @@ The list includes commands such as @command{passwd}, @command{ping},
@end defvar
Under the hood, the actual setuid programs are created in the
@file{/run/setuid-programs} directory at system activation time. The
@file{/run/privileged/bin} directory at system activation time. The
files in this directory refer to the ``real'' binaries, which are in the
store.

54
gnu/build/activation.scm
View file

@ -8,6 +8,7 @@
;;; Copyright © 2021 Maxime Devos <maximedevos@telenet.be>
;;; Copyright © 2020 Christine Lemmer-Webber <cwebber@dustycloud.org>
;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re>
;;; Copyright © 2022 Tobias Geerinckx-Rice <me@tobias.gr>
;;; Copyright © 2024 Nicolas Graves <ngraves@ngraves.fr>
;;;
;;; This file is part of GNU Guix.
@ -279,14 +280,29 @@ (define (rm-f file)
string<?)))
(define %setuid-directory
;; Place where setuid programs are stored.
;; Place where setuid programs used to be stored. It exists for backwards
;; compatibility & will be removed. Use %PRIVILEGED-PROGRAM-DIRECTORY instead.
"/run/setuid-programs")
(define %privileged-program-directory
;; Place where privileged copies of programs are stored.
"/run/privileged/bin")
(define (activate-setuid-programs programs)
"Turn PROGRAMS, a list of file setuid-programs record, into setuid programs
stored under %SETUID-DIRECTORY."
(define (make-setuid-program program setuid? setgid? uid gid)
(let ((target (string-append %setuid-directory
"Turn PROGRAMS, a list of file setuid-programs records, into privileged
copies stored under %PRIVILEGED-PROGRAM-DIRECTORY."
(define (ensure-empty-directory directory)
(if (file-exists? directory)
(for-each (compose delete-file
(cut string-append directory "/" <>))
(scandir directory
(lambda (file)
(not (member file '("." ".."))))
string<?))
(mkdir-p directory)) )
(define (make-privileged-program program setuid? setgid? uid gid)
(let ((target (string-append %privileged-program-directory
"/" (basename program)))
(mode (+ #o0555 ; base permissions
(if setuid? #o4000 0) ; setuid bit
@ -295,16 +311,17 @@ (define (make-setuid-program program setuid? setgid? uid gid)
(chown target uid gid)
(chmod target mode)))
(format #t "setting up setuid programs in '~a'...~%"
%setuid-directory)
(if (file-exists? %setuid-directory)
(for-each (compose delete-file
(cut string-append %setuid-directory "/" <>))
(scandir %setuid-directory
(lambda (file)
(not (member file '("." ".."))))
string<?))
(mkdir-p %setuid-directory))
(define (make-deprecated-wrapper program)
;; This will eventually become a script that warns on usage, then vanish.
(symlink (string-append %privileged-program-directory
"/" (basename program))
(string-append %setuid-directory
"/" (basename program))))
(format #t "setting up privileged programs in '~a'...~%"
%privileged-program-directory)
(ensure-empty-directory %privileged-program-directory)
(ensure-empty-directory %setuid-directory)
(for-each (lambda (program)
(catch 'system-error
@ -320,11 +337,12 @@ (define (make-setuid-program program setuid? setgid? uid gid)
(gid (match group
((? string?) (group:gid (getgrnam group)))
((? integer?) group))))
(make-setuid-program program-name setuid? setgid? uid gid)))
(make-privileged-program program-name setuid? setgid? uid gid)
(make-deprecated-wrapper program-name)))
(lambda args
;; If we fail to create a setuid program, better keep going
;; so that we don't leave %SETUID-DIRECTORY empty or
;; half-populated. This can happen if PROGRAMS contains
;; so that we don't leave %PRIVILEGED-PROGRAM-DIRECTORY empty
;; or half-populated. This can happen if PROGRAMS contains
;; incorrect file names: <https://bugs.gnu.org/38800>.
(format (current-error-port)
"warning: failed to make ~s setuid/setgid: ~a~%"

9
gnu/services.scm
View file

@ -6,6 +6,7 @@
;;; Copyright © 2021 raid5atemyhomework <raid5atemyhomework@protonmail.com>
;;; Copyright © 2020 Christine Lemmer-Webber <cwebber@dustycloud.org>
;;; Copyright © 2020, 2021 Brice Waegeneire <brice@waegenei.re>
;;; Copyright © 2022 Tobias Geerinckx-Rice <me@tobias.gr>
;;; Copyright © 2023 Brian Cully <bjc@spork.org>
;;; Copyright © 2024 Nicolas Graves <ngraves@ngraves.fr>
;;;
@ -921,8 +922,12 @@ (define setuid-program-service-type
(extend (lambda (config extensions)
(append config extensions)))
(description
"Populate @file{/run/setuid-programs} with the specified
executables, making them setuid and/or setgid.")))
"Copy the specified executables to @file{/run/privileged/bin}
and apply special privileges like setuid and/or setgid.
The deprecated @file{/run/setuid-programs} directory is also populated with
symbolic links to their @file{/run/privileged/bin} counterpart. It will be
removed in a future Guix release.")))
(define (packages->profile-entry packages)
"Return a system entry for the profile containing PACKAGES."