services: setuid-program: Populate /run/privileged/bin.

Create /run/setuid-programs compatibility symlinks so that we can
migrate all users (both package and human) piecemeal at our leisure.

Apart from being symlinks, this should be a user-invisible change.

* gnu/build/activation.scm (%privileged-program-directory): New variable.
[activate-setuid-programs]: Put privileged copies in
%PRIVILEGED-PROGRAM-DIRECTORY, with compatibility symlinks to each in
%SETUID-DIRECTORY.
* gnu/services.scm (setuid-program-service-type): Update docstring.
* doc/guix.texi (Setuid Programs): Update @file{} name accordingly.

doc/guix.texi

@@ -41732,7 +41732,7 @@ The list includes commands such as @command{passwd}, @command{ping},
 @end defvar
 
 Under the hood, the actual setuid programs are created in the
-@file{/run/setuid-programs} directory at system activation time.  The
+@file{/run/privileged/bin} directory at system activation time.  The
 files in this directory refer to the ``real'' binaries, which are in the
 store.
 

gnu/build/activation.scm

@@ -8,6 +8,7 @@
 ;;; Copyright © 2021 Maxime Devos <maximedevos@telenet.be>
 ;;; Copyright © 2020 Christine Lemmer-Webber <cwebber@dustycloud.org>
 ;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re>
+;;; Copyright © 2022 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2024 Nicolas Graves <ngraves@ngraves.fr>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -279,14 +280,29 @@ (define (rm-f file)
                      string<?)))
 
 (define %setuid-directory
-  ;; Place where setuid programs are stored.
+  ;; Place where setuid programs used to be stored.  It exists for backwards
+  ;; compatibility & will be removed.  Use %PRIVILEGED-PROGRAM-DIRECTORY instead.
   "/run/setuid-programs")
 
+(define %privileged-program-directory
+  ;; Place where privileged copies of programs are stored.
+  "/run/privileged/bin")
+
 (define (activate-setuid-programs programs)
-  "Turn PROGRAMS, a list of file setuid-programs record, into setuid programs
+  "Turn PROGRAMS, a list of file setuid-programs records, into privileged
-stored under %SETUID-DIRECTORY."
+copies stored under %PRIVILEGED-PROGRAM-DIRECTORY."
-  (define (make-setuid-program program setuid? setgid? uid gid)
+  (define (ensure-empty-directory directory)
-    (let ((target (string-append %setuid-directory
+    (if (file-exists? directory)
+        (for-each (compose delete-file
+                           (cut string-append directory "/" <>))
+                  (scandir directory
+                           (lambda (file)
+                             (not (member file '("." ".."))))
+                           string<?))
+        (mkdir-p directory))    )
+
+  (define (make-privileged-program program setuid? setgid? uid gid)
+    (let ((target (string-append %privileged-program-directory
                                  "/" (basename program)))
           (mode (+ #o0555                   ; base permissions
                    (if setuid? #o4000 0)    ; setuid bit
@@ -295,16 +311,17 @@ (define (make-setuid-program program setuid? setgid? uid gid)
       (chown target uid gid)
       (chmod target mode)))
 
-  (format #t "setting up setuid programs in '~a'...~%"
+  (define (make-deprecated-wrapper program)
-          %setuid-directory)
+    ;; This will eventually become a script that warns on usage, then vanish.
-  (if (file-exists? %setuid-directory)
+    (symlink (string-append %privileged-program-directory
-      (for-each (compose delete-file
+                            "/" (basename program))
-                         (cut string-append %setuid-directory "/" <>))
+             (string-append %setuid-directory
-                (scandir %setuid-directory
+                            "/" (basename program))))
-                         (lambda (file)
+
-                           (not (member file '("." ".."))))
+  (format #t "setting up privileged programs in '~a'...~%"
-                         string<?))
+          %privileged-program-directory)
-      (mkdir-p %setuid-directory))
+  (ensure-empty-directory %privileged-program-directory)
+  (ensure-empty-directory %setuid-directory)
 
   (for-each (lambda (program)
               (catch 'system-error
@@ -320,11 +337,12 @@ (define (make-setuid-program program setuid? setgid? uid gid)
                          (gid (match group
                                 ((? string?) (group:gid (getgrnam group)))
                                 ((? integer?) group))))
-                    (make-setuid-program program-name setuid? setgid? uid gid)))
+                    (make-privileged-program program-name setuid? setgid? uid gid)
+                    (make-deprecated-wrapper program-name)))
                 (lambda args
                   ;; If we fail to create a setuid program, better keep going
-                  ;; so that we don't leave %SETUID-DIRECTORY empty or
+                  ;; so that we don't leave %PRIVILEGED-PROGRAM-DIRECTORY empty
-                  ;; half-populated.  This can happen if PROGRAMS contains
+                  ;; or half-populated.  This can happen if PROGRAMS contains
                   ;; incorrect file names: <https://bugs.gnu.org/38800>.
                   (format (current-error-port)
                           "warning: failed to make ~s setuid/setgid: ~a~%"

gnu/services.scm

@@ -6,6 +6,7 @@
 ;;; Copyright © 2021 raid5atemyhomework <raid5atemyhomework@protonmail.com>
 ;;; Copyright © 2020 Christine Lemmer-Webber <cwebber@dustycloud.org>
 ;;; Copyright © 2020, 2021 Brice Waegeneire <brice@waegenei.re>
+;;; Copyright © 2022 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2023 Brian Cully <bjc@spork.org>
 ;;; Copyright © 2024 Nicolas Graves <ngraves@ngraves.fr>
 ;;;
@@ -921,8 +922,12 @@ (define setuid-program-service-type
                 (extend (lambda (config extensions)
                           (append config extensions)))
                 (description
-                 "Populate @file{/run/setuid-programs} with the specified
+                 "Copy the specified executables to @file{/run/privileged/bin}
-executables, making them setuid and/or setgid.")))
+and apply special privileges like setuid and/or setgid.
+
+The deprecated @file{/run/setuid-programs} directory is also populated with
+symbolic links to their @file{/run/privileged/bin} counterpart.  It will be
+removed in a future Guix release.")))
 
 (define (packages->profile-entry packages)
   "Return a system entry for the profile containing PACKAGES."