From: Tobias Geerinckx-Rice via Guix-patches via <guix-patches@gnu.org>
To: 61462@debbugs.gnu.org
Subject: [bug#61462] [PATCH 06/10] system: (gnu system setuid) wraps (gnu system privilege).
Date: Sun, 5 Feb 2023 01:00:15 +0100 [thread overview]
Message-ID: <20230205000019.6259-6-me@tobias.gr> (raw)
In-Reply-To: <20230205000019.6259-1-me@tobias.gr>
* gnu/system/setuid.scm (setuid-program): Rewrite as syntax to create a
<privileged-program> record that is setuid by default.
(setuid-program?, setuid-program-program, setuid-program-setuid?)
(setuid-program-setgid?, setuid-program-user, setuid-program-group):
Alias their privileged-program equivalent.
---
gnu/system/setuid.scm | 44 +++++++++++++++++++++++--------------------
1 file changed, 24 insertions(+), 20 deletions(-)
diff --git a/gnu/system/setuid.scm b/gnu/system/setuid.scm
index 83111d932c..4dd0cc8962 100644
--- a/gnu/system/setuid.scm
+++ b/gnu/system/setuid.scm
@@ -1,5 +1,6 @@
;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re>
+;;; Copyright © 2022 Tobias Geerinckx-Rice <me@tobias.gr>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -17,7 +18,9 @@
;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
(define-module (gnu system setuid)
- #:use-module (guix records)
+ #:use-module (gnu system privilege)
+ #:use-module (ice-9 match)
+ #:use-module (srfi srfi-1)
#:export (setuid-program
setuid-program?
setuid-program-program
@@ -30,28 +33,29 @@ (define-module (gnu system setuid)
;;; Commentary:
;;;
-;;; Data structures representing setuid/setgid programs. This is meant to be
-;;; used both on the host side and at run time--e.g., in activation snippets.
+;;; Do not use this module in new code. It used to define data structures
+;;; representing setuid/setgid programs, but is now a mere compatibility shim
+;;; wrapping a subset of (gnu system privilege).
;;;
;;; Code:
-(define-record-type* <setuid-program>
- setuid-program make-setuid-program
- setuid-program?
- ;; Path to program to link with setuid permissions
- (program setuid-program-program) ;file-like
- ;; Whether to set user setuid bit
- (setuid? setuid-program-setuid? ;boolean
- (default #t))
- ;; Whether to set group setgid bit
- (setgid? setuid-program-setgid? ;boolean
- (default #f))
- ;; The user this should be set to (defaults to root)
- (user setuid-program-user ;integer or string
- (default 0))
- ;; Group we want to set this to (defaults to root)
- (group setuid-program-group ;integer or string
- (default 0)))
+(define-syntax setuid-program
+ (lambda (fields)
+ (syntax-case fields ()
+ ((_ (field value) ...)
+ #`(privileged-program
+ (setuid? (match (assoc-ref '((field value) ...) 'setuid?)
+ ((#f) #f)
+ (_ #t)))
+ #,@(remove (match-lambda ((f _) (eq? (syntax->datum f) 'setuid?)))
+ #'((field value) ...)))))))
+
+(define setuid-program? privileged-program?)
+(define setuid-program-program privileged-program-program)
+(define setuid-program-setuid? privileged-program-setuid?)
+(define setuid-program-setgid? privileged-program-setgid?)
+(define setuid-program-user privileged-program-user)
+(define setuid-program-group privileged-program-group)
(define (file-like->setuid-program program)
(setuid-program (program program)))
--
2.39.1
next prev parent reply other threads:[~2023-02-12 20:49 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-12 20:37 [bug#61462] Add support for file capabilities(7) Tobias Geerinckx-Rice via Guix-patches via
2023-02-05 0:00 ` [bug#61462] [PATCH 01/10] system: Disallow file-like setuid-programs Tobias Geerinckx-Rice via Guix-patches via
2023-02-05 0:00 ` [bug#61462] [PATCH 02/10] services: setuid-program: Populate /run/privileged/bin Tobias Geerinckx-Rice via Guix-patches via
2023-02-05 0:00 ` [bug#61462] [PATCH 03/10] system: Use /run/privileged/bin in search paths Tobias Geerinckx-Rice via Guix-patches via
2023-02-05 0:00 ` [bug#61462] [PATCH 04/10] gnu: Replace (almost) all uses of /run/setuid-programs Tobias Geerinckx-Rice via Guix-patches via
2023-02-05 0:00 ` [bug#61462] [PATCH 05/10] system: Add (gnu system privilege) Tobias Geerinckx-Rice via Guix-patches via
2023-02-05 0:00 ` Tobias Geerinckx-Rice via Guix-patches via [this message]
2023-02-05 0:00 ` [bug#61462] [PATCH 07/10] build: Rename activate-setuid-programs Tobias Geerinckx-Rice via Guix-patches via
2023-02-05 0:00 ` [bug#61462] [PATCH 08/10] services: Rename setuid-program-service-type Tobias Geerinckx-Rice via Guix-patches via
2023-02-05 0:00 ` [bug#61462] [PATCH 09/10] system: Use privileged-program-service-type by default Tobias Geerinckx-Rice via Guix-patches via
2023-02-05 0:00 ` [bug#61462] [PATCH 10/10] system: Add privileged-programs to <operating-system> Tobias Geerinckx-Rice via Guix-patches via
2023-02-12 21:05 ` [bug#61462] Add support for file capabilities(7) Tobias Geerinckx-Rice via Guix-patches via
2023-03-04 16:55 ` Ludovic Courtès
2023-03-24 4:31 ` Vagrant Cascadian via Guix-patches
2023-04-18 13:14 ` Ludovic Courtès
2023-04-18 19:38 ` Vagrant Cascadian
2023-04-20 10:33 ` Ludovic Courtès
2023-07-15 23:59 ` [bug#61462] [PATCH v2 01/10] system: Disallow file-like setuid-programs Tobias Geerinckx-Rice via Guix-patches via
2023-07-15 23:59 ` [bug#61462] [PATCH v2 02/10] services: setuid-program: Populate /run/privileged/bin Tobias Geerinckx-Rice via Guix-patches via
2023-07-15 23:59 ` [bug#61462] [PATCH v2 03/10] system: Use /run/privileged/bin in search paths Tobias Geerinckx-Rice via Guix-patches via
2023-07-15 23:59 ` [bug#61462] [PATCH v2 04/10] gnu: Replace (almost) all uses of /run/setuid-programs Tobias Geerinckx-Rice via Guix-patches via
2023-07-15 23:59 ` [bug#61462] [PATCH v2 05/10] system: Add (gnu system privilege) Tobias Geerinckx-Rice via Guix-patches via
2023-07-15 23:59 ` [bug#61462] [PATCH v2 06/10] system: (gnu system setuid) wraps " Tobias Geerinckx-Rice via Guix-patches via
2023-07-15 23:59 ` [bug#61462] [PATCH v2 07/10] build: Rename activate-setuid-programs Tobias Geerinckx-Rice via Guix-patches via
2023-07-15 23:59 ` [bug#61462] [PATCH v2 08/10] services: Rename setuid-program-service-type Tobias Geerinckx-Rice via Guix-patches via
2023-07-15 23:59 ` [bug#61462] [PATCH v2 09/10] system: Use privileged-program-service-type by default Tobias Geerinckx-Rice via Guix-patches via
2023-07-16 0:00 ` [bug#61462] [PATCH v2 10/10] system: Add privileged-programs to <operating-system> Tobias Geerinckx-Rice via Guix-patches via
2023-07-21 18:53 ` [bug#61462] Add support for file capabilities(7) Vagrant Cascadian
2023-07-21 19:11 ` Vagrant Cascadian
2023-08-08 15:40 ` Ludovic Courtès
2023-08-29 20:29 ` [bug#61462] /run should be cleaned on boot Vagrant Cascadian
2023-11-15 21:37 ` [bug#61462] Add support for file capabilities(7) Vagrant Cascadian
2023-12-24 0:34 ` Vagrant Cascadian
2024-01-08 16:45 ` Ludovic Courtès
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230205000019.6259-6-me@tobias.gr \
--to=guix-patches@gnu.org \
--cc=61462@debbugs.gnu.org \
--cc=me@tobias.gr \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).