From: Brice Waegeneire <brice@waegenei.re>
To: 48986@debbugs.gnu.org
Subject: [bug#48986] [PATCH] gnu: opendoas: Fix restricted path "safepath".
Date: Sat, 12 Jun 2021 23:24:42 +0200 [thread overview]
Message-ID: <20210612212442.13395-1-brice@waegenei.re> (raw)
OpenDoas look for binaries in safepath when a rule specify a relative
command, such as “permit keepenv :wheel cmd guix”.
* gnu/packages/admin.scm (opendoas)[phases]: Rename 'fix-install' phase
to 'pre-configure', run it before 'configure' and add a substitution for
safepath.
---
gnu/packages/admin.scm | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
diff --git a/gnu/packages/admin.scm b/gnu/packages/admin.scm
index 12eb659039..80d12fc2a3 100644
--- a/gnu/packages/admin.scm
+++ b/gnu/packages/admin.scm
@@ -41,6 +41,7 @@
;;; Copyright © 2021 Hyunseok Kim <lasnesne@lagunposprasihopre.org>
;;; Copyright © 2021 David Larsson <david.larsson@selfhosted.xyz>
;;; Copyright © 2021 WinterHound <winterhound@yandex.com>
+;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -1699,18 +1700,25 @@ commands and their arguments.")
(arguments
`(#:phases
(modify-phases %standard-phases
+ (add-before 'configure 'pre-configure
+ (lambda* (#:key outputs #:allow-other-keys)
+ (substitute* "GNUmakefile"
+ (("^\tchown.*$") ""))
+ (substitute* "doas.c"
+ (("safepath =" match)
+ (string-append match " \""
+ "/run/setuid-programs:"
+ "/run/current-system/profile/bin:"
+ "/run/current-system/profile/sbin:"
+ "\" ")))
+ #t))
(replace 'configure
;; The configure script doesn't accept most of the default flags.
(lambda* (#:key configure-flags #:allow-other-keys)
;; The configure script can be told which compiler to use only
;; through environment variables.
(setenv "CC" ,(cc-for-target))
- (apply invoke "./configure" configure-flags)))
- (add-before 'install 'fix-makefile
- (lambda* (#:key outputs #:allow-other-keys)
- (substitute* "GNUmakefile"
- (("^\tchown.*$") ""))
- #t)))
+ (apply invoke "./configure" configure-flags))))
#:configure-flags
(list (string-append "--prefix=" (assoc-ref %outputs "out"))
"--with-timestamp")
--
2.31.1
next reply other threads:[~2021-06-12 21:25 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-12 21:24 Brice Waegeneire [this message]
2021-06-16 20:53 ` [bug#48986] [PATCH] gnu: opendoas: Fix restricted path "safepath" Ludovic Courtès
2021-06-19 21:48 ` bug#48986: " Brice Waegeneire
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210612212442.13395-1-brice@waegenei.re \
--to=brice@waegenei.re \
--cc=48986@debbugs.gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).