Replace some more occurrences of ‘setuid-programs’.

* gnu/packages/containers.scm (podman, buildah)[arguments]:
Substitute /run/privileged/bin for /run/setuid-programs.
* gnu/packages/mail.scm (opensmtpd)[arguments]: Likewise.
* gnu/packages/spice.scm (spice-gtk)[arguments]: Likewise.
* gnu/packages/patches/enlightenment-fix-setuid-path.patch: Likewise.
* gnu/packages/xdisorg.scm (xsecurelock)[description]: Rewrite
example code to use the ‘privileged-program(s)’ terminology.
* doc/guix-cookbook.texi (Network bridge for QEMU): Likewise.
* gnu/packages/disk.scm (udevil)[arguments]: Update a comment.

Change-Id: I7f467e8743a3ef556cd89bac41509bf51d9edb30
This commit is contained in:
Tobias Geerinckx-Rice 2024-08-18 02:00:00 +02:00
parent ed3649bcce
commit ed4e0b48f1
No known key found for this signature in database
GPG key ID: 0DB0FF884F556D79
7 changed files with 30 additions and 26 deletions

View file

@ -3791,13 +3791,15 @@ QEMU comes with a helper program to conveniently make use of a network
bridge interface as an unprivileged user @pxref{Network options,,, QEMU, bridge interface as an unprivileged user @pxref{Network options,,, QEMU,
QEMU Documentation}. The binary must be made setuid root for proper QEMU Documentation}. The binary must be made setuid root for proper
operation; this can be achieved by adding it to the operation; this can be achieved by adding it to the
@code{setuid-programs} field of your (host) @code{operating-system} @code{privileged-programs} field of your (host) @code{operating-system}
definition, as shown below: definition, as shown below:
@example lisp @example lisp
(setuid-programs (privileged-programs
(cons (file-append qemu "/libexec/qemu-bridge-helper") (cons (privileged-program
%setuid-programs)) (program (file-append qemu "/libexec/qemu-bridge-helper"))
(setuid? #t))
%default-privileged-programs))
@end example @end example
The file @file{/etc/qemu/bridge.conf} must also be made to allow the The file @file{/etc/qemu/bridge.conf} must also be made to allow the

View file

@ -536,7 +536,7 @@ (define-public podman
,(string-append #$iptables "/sbin") ,(string-append #$iptables "/sbin")
,(string-append #$passt "/bin") ,(string-append #$passt "/bin")
,(string-append #$procps "/bin") ; ps ,(string-append #$procps "/bin") ; ps
"/run/setuid-programs"))))) "/run/privileged/bin")))))
(add-after 'install 'install-completions (add-after 'install 'install-completions
(lambda _ (lambda _
(invoke "make" "install.completions" (invoke "make" "install.completions"
@ -669,7 +669,7 @@ (define-public buildah
(,(string-append #$crun "/bin") (,(string-append #$crun "/bin")
,(string-append #$gcc "/bin") ; cpp ,(string-append #$gcc "/bin") ; cpp
,(string-append #$passt "/bin") ,(string-append #$passt "/bin")
"/run/setuid-programs"))))) "/run/privileged/bin")))))
(add-after 'install 'install-completions (add-after 'install 'install-completions
(lambda _ (lambda _
(invoke "make" "install.completions" (invoke "make" "install.completions"

View file

@ -209,9 +209,9 @@ (define-public udevil
(string-append "--sysconfdir=" (string-append "--sysconfdir="
(assoc-ref %outputs "out") (assoc-ref %outputs "out")
"/etc") "/etc")
;; udevil expects these programs to be run with uid set as root. ;; udevil expects these programs to be run with an UID of root.
;; user has to manually add these programs to setuid-programs. ;; mount and umount are %default-privileged-programs on Guix System;
;; mount and umount are default setuid-programs in guix system. ;; the others must be explicitly added if desired.
"--with-mount-prog=/run/privileged/bin/mount" "--with-mount-prog=/run/privileged/bin/mount"
"--with-umount-prog=/run/privileged/bin/umount" "--with-umount-prog=/run/privileged/bin/umount"
"--with-losetup-prog=/run/privileged/bin/losetup" "--with-losetup-prog=/run/privileged/bin/losetup"

View file

@ -3327,7 +3327,7 @@ (define-public opensmtpd
;; avoids warning smtpd: couldn't enqueue offline message ;; avoids warning smtpd: couldn't enqueue offline message
;; smtpctl exited abnormally ;; smtpctl exited abnormally
(substitute* "usr.sbin/smtpd/smtpd.h" (substitute* "usr.sbin/smtpd/smtpd.h"
(("/usr/bin/smtpctl") "/run/setuid-programs/smtpctl")) (("/usr/bin/smtpctl") "/run/privileged/bin/smtpctl"))
(substitute* "usr.sbin/smtpd/smtpctl.c" (substitute* "usr.sbin/smtpd/smtpctl.c"
;; gzcat is auto-detected at compile time, but cat isn't. ;; gzcat is auto-detected at compile time, but cat isn't.
(("/bin/cat" file) (search-input-file inputs file))) (("/bin/cat" file) (search-input-file inputs file)))

View file

@ -10,7 +10,7 @@ index 6d07a0ac3..31e0e728f 100644
snprintf(buf, sizeof(buf), snprintf(buf, sizeof(buf),
- "%s/enlightenment/utils/enlightenment_ckpasswd pw", - "%s/enlightenment/utils/enlightenment_ckpasswd pw",
- e_prefix_lib_get()); - e_prefix_lib_get());
+ "/run/setuid-programs/enlightenment_ckpasswd pw"); + "/run/privileged/bin/enlightenment_ckpasswd pw");
exe = ecore_exe_pipe_run(buf, ECORE_EXE_PIPE_WRITE, NULL); exe = ecore_exe_pipe_run(buf, ECORE_EXE_PIPE_WRITE, NULL);
if (!exe) goto out; if (!exe) goto out;
snprintf(buf, sizeof(buf), "pw %s", passwd); snprintf(buf, sizeof(buf), "pw %s", passwd);
@ -20,7 +20,7 @@ index 6d07a0ac3..31e0e728f 100644
snprintf(buf, sizeof(buf), snprintf(buf, sizeof(buf),
- "%s/enlightenment/utils/enlightenment_ckpasswd pk", - "%s/enlightenment/utils/enlightenment_ckpasswd pk",
- e_prefix_lib_get()); - e_prefix_lib_get());
+ "/run/setuid-programs/enlightenment_ckpasswd pk"); + "/run/privileged/bin/enlightenment_ckpasswd pk");
exe = ecore_exe_pipe_run(buf, ECORE_EXE_PIPE_WRITE, NULL); exe = ecore_exe_pipe_run(buf, ECORE_EXE_PIPE_WRITE, NULL);
if (!exe) goto out; if (!exe) goto out;
snprintf(buf, sizeof(buf), "%s %u %s", cookie, uid, passwd); snprintf(buf, sizeof(buf), "%s %u %s", cookie, uid, passwd);
@ -33,7 +33,7 @@ index 9b10b3117..74e6b72ad 100644
char buf[PATH_MAX]; char buf[PATH_MAX];
- snprintf(buf, sizeof(buf), "%s/enlightenment/utils/enlightenment_sys", eina_prefix_lib_get(pfx)); - snprintf(buf, sizeof(buf), "%s/enlightenment/utils/enlightenment_sys", eina_prefix_lib_get(pfx));
+ snprintf(buf, sizeof(buf), "/run/setuid-programs/enlightenment_sys"); + snprintf(buf, sizeof(buf), "/run/privileged/bin/enlightenment_sys");
eeze_disk_mount_wrapper_set(v->disk, buf); eeze_disk_mount_wrapper_set(v->disk, buf);
} }
v->guard = ecore_timer_loop_add(E_FM_EJECT_TIMEOUT, (Ecore_Task_Cb)_e_fm_main_eeze_vol_eject_timeout, v); v->guard = ecore_timer_loop_add(E_FM_EJECT_TIMEOUT, (Ecore_Task_Cb)_e_fm_main_eeze_vol_eject_timeout, v);
@ -42,7 +42,7 @@ index 9b10b3117..74e6b72ad 100644
char buf[PATH_MAX]; char buf[PATH_MAX];
- snprintf(buf, sizeof(buf), "%s/enlightenment/utils/enlightenment_sys", eina_prefix_lib_get(pfx)); - snprintf(buf, sizeof(buf), "%s/enlightenment/utils/enlightenment_sys", eina_prefix_lib_get(pfx));
+ snprintf(buf, sizeof(buf), "/run/setuid-programs/enlightenment_sys"); + snprintf(buf, sizeof(buf), "/run/privileged/bin/enlightenment_sys");
eeze_disk_mount_wrapper_set(v->disk, buf); eeze_disk_mount_wrapper_set(v->disk, buf);
} }
v->guard = ecore_timer_loop_add(E_FM_UNMOUNT_TIMEOUT, (Ecore_Task_Cb)_e_fm_main_eeze_vol_unmount_timeout, v); v->guard = ecore_timer_loop_add(E_FM_UNMOUNT_TIMEOUT, (Ecore_Task_Cb)_e_fm_main_eeze_vol_unmount_timeout, v);
@ -51,7 +51,7 @@ index 9b10b3117..74e6b72ad 100644
char buf2[PATH_MAX]; char buf2[PATH_MAX];
- snprintf(buf2, sizeof(buf2), "%s/enlightenment/utils/enlightenment_sys", eina_prefix_lib_get(pfx)); - snprintf(buf2, sizeof(buf2), "%s/enlightenment/utils/enlightenment_sys", eina_prefix_lib_get(pfx));
+ snprintf(buf2, sizeof(buf2), "/run/setuid-programs/enlightenment_sys"); + snprintf(buf2, sizeof(buf2), "/run/privileged/bin/enlightenment_sys");
eeze_disk_mount_wrapper_set(v->disk, buf2); eeze_disk_mount_wrapper_set(v->disk, buf2);
} }
v->guard = ecore_timer_loop_add(E_FM_MOUNT_TIMEOUT, (Ecore_Task_Cb)_e_fm_main_eeze_vol_mount_timeout, v); v->guard = ecore_timer_loop_add(E_FM_MOUNT_TIMEOUT, (Ecore_Task_Cb)_e_fm_main_eeze_vol_mount_timeout, v);
@ -65,7 +65,7 @@ index 722063339..2da2d5a23 100644
myasprintf(&buf3, myasprintf(&buf3,
- "E_ALERT_SYSTEM_BIN=%s/enlightenment/utils/enlightenment_system", - "E_ALERT_SYSTEM_BIN=%s/enlightenment/utils/enlightenment_system",
- eina_prefix_lib_get(pfx)); - eina_prefix_lib_get(pfx));
+ "E_ALERT_SYSTEM_BIN=/run/setuid-programs/enlightenment_system"); + "E_ALERT_SYSTEM_BIN=/run/privileged/bin/enlightenment_system");
putenv(buf3); putenv(buf3);
home = getenv("HOME"); home = getenv("HOME");
@ -78,7 +78,7 @@ index bfd43e7e2..45d78b7ed 100644
if (_respawn_count > 5) return; if (_respawn_count > 5) return;
snprintf(buf, sizeof(buf), snprintf(buf, sizeof(buf),
- "%s/enlightenment/utils/enlightenment_system", e_prefix_lib_get()); - "%s/enlightenment/utils/enlightenment_system", e_prefix_lib_get());
+ "/run/setuid-programs/enlightenment_system"); + "/run/privileged/bin/enlightenment_system");
_system_exe = ecore_exe_pipe_run _system_exe = ecore_exe_pipe_run
(buf, ECORE_EXE_NOT_LEADER | ECORE_EXE_TERM_WITH_PARENT | (buf, ECORE_EXE_NOT_LEADER | ECORE_EXE_TERM_WITH_PARENT |
ECORE_EXE_PIPE_READ | ECORE_EXE_PIPE_WRITE, NULL); ECORE_EXE_PIPE_READ | ECORE_EXE_PIPE_WRITE, NULL);

View file

@ -172,7 +172,7 @@ (define-public spice-gtk
;; variable. ;; variable.
(substitute* "src/usb-acl-helper.c" (substitute* "src/usb-acl-helper.c"
(("ACL_HELPER_PATH\"/spice-client-glib-usb-acl-helper\"") (("ACL_HELPER_PATH\"/spice-client-glib-usb-acl-helper\"")
"\"/run/setuid-programs/spice-client-glib-usb-acl-helper\"")))) "\"/run/privileged/bin/spice-client-glib-usb-acl-helper\""))))
(add-before 'configure 'correct-polkit-dir (add-before 'configure 'correct-polkit-dir
(lambda _ (lambda _
(substitute* "meson.build" (substitute* "meson.build"

View file

@ -17,7 +17,7 @@
;;; Copyright © 2016 Petter <petter@mykolab.ch> ;;; Copyright © 2016 Petter <petter@mykolab.ch>
;;; Copyright © 2017 Mekeor Melire <mekeor.melire@gmail.com> ;;; Copyright © 2017 Mekeor Melire <mekeor.melire@gmail.com>
;;; Copyright © 2017 Nikita <nikita@n0.is> ;;; Copyright © 2017 Nikita <nikita@n0.is>
;;; Copyright © 20172021 Tobias Geerinckx-Rice <me@tobias.gr> ;;; Copyright © 20172021, 2024 Tobias Geerinckx-Rice <me@tobias.gr>
;;; Copyright © 2017 Marek Benc <dusxmt@gmx.com> ;;; Copyright © 2017 Marek Benc <dusxmt@gmx.com>
;;; Copyright © 2017 Mike Gerwitz <mtg@gnu.org> ;;; Copyright © 2017 Mike Gerwitz <mtg@gnu.org>
;;; Copyright © 2018 Thomas Sigurdsen <tonton@riseup.net> ;;; Copyright © 2018 Thomas Sigurdsen <tonton@riseup.net>
@ -2730,15 +2730,17 @@ (define-public xsecurelock
(description "@code{xsecurelock} is an X11 screen locker which uses (description "@code{xsecurelock} is an X11 screen locker which uses
a modular design to avoid the usual pitfalls of screen locking utility design. a modular design to avoid the usual pitfalls of screen locking utility design.
As a consequence of the modular design, the usual screen locker service As a consequence of this design, you shouldn't use the usual screen locker
shouldn't be used with @code{xsecurelock}. Instead, you need to add a helper service with @code{xsecurelock}. Instead, add a helper binary to your
binary to setuid-binaries: @code{operating-system}'s @code{privileged-programs} field:
@example @example
(setuid-programs (privileged-programs
(cons* (cons*
(setuid-program (privileged-program
(program (file-append xsecurelock \"/libexec/xsecurelock/authproto_pam\"))) (program (file-append xsecurelock \"/libexec/xsecurelock/authproto_pam\"))
%setuid-programs)) (setuid? #t))
%default-privileged-programs))
@end example") @end example")
(license license:asl2.0))) (license license:asl2.0)))