bug#73680: privileged-programs: cant set setuid/setgid to new accounts/groups

[Dariqq <dariqq@posteo.net>]

Hi,

I was writing a service which (among other things) adds a setuid/setgid 
binary for new account+groupn. I got errors and warnings when trying to 
instantiate the operating system.


As a reproducer consider this os which tries to privilege the hello 
package to a hello user and group (I started this operating system with 
guix system container.):

#+begin_src scheme
(use-modules (gnu)
	     (gnu services))
(use-system-modules privilege shadow)
(use-package-modules base admin)

(define %hello-accounts
   (list (user-group (name "hello") (system? #t))
         (user-account
          (name "hello")
          (group "hello")
          (system? #t)
          (comment "hello user")
          (home-directory "/var/empty")
          (shell (file-append shadow "/sbin/nologin")))))

(define %hello-privileged
   (list
    (privileged-program
     (program (file-append hello "/bin/hello"))
     (setuid? #t)
     (setgid? #t)
     (user "hello")
     (group "hello"))))

(define hello-service-type
   (service-type
    (name 'hello)
    (extensions
     (list (service-extension account-service-type
                              (const %hello-accounts))
	  (service-extension privileged-program-service-type
                              (const %hello-privileged))))
    (default-value #f)
    (description "Hello Reproducer")))


(operating-system
   (host-name "hello-test")
   (services
    (cons (service hello-service-type) %base-services))
   (file-systems (cons (file-system
                         (device (file-system-label "my-root"))
                         (mount-point "/")
                         (type "ext4"))
                       %base-file-systems))
   (bootloader (bootloader-configuration
                (bootloader grub-bootloader)
                (targets '("/dev/sda")))))
#+end_src



*  when setuid? is #t (regardless of setgid?) I get a fatal error:

setting up privileged programs in '/run/privileged/bin'...
Backtrace:
[...]
In gnu/build/activation.scm:
    364:57  1 (_)
In unknown file:
            0 (getpw "hello")

ERROR: In procedure getpw:
In procedure getpw: entry not found

Which seems to indicate that the user does not yet exist?

* when setuid? is #f, user field is commented and setgid? #t there is a 
nonfatal warning, however privileging fails:

setting up privileged programs in '/run/privileged/bin'...
warning: failed to privilege 
"/gnu/store/8bjy9g0cssjrw9ljz2r8ww1sma95isfj-hello-2.12.1/bin/hello": No 
such file or directory

When the griup is changed to 0/"root" (the default) things work, i think 
because that account already exists.


As another example: the opensmtpd-service-type adds its utilties as 
setgid smtpq.

The systemtest is failing with the same error: 
https://ci.guix.gnu.org/build/6060982/details

 From the log
warning: failed to privilege 
"/gnu/store/2ng9wzk5d13xcxhk7w7k5zzdm24shk91-opensmtpd-7.5.0p0/sbin/smtpctl": 
No such file or directory




However things are very weird because I have the opensmtpd server 
running and working locally.

maybe a weird race-condition between account-creation and setting up 
privileged programs? Can we ensure that the account creation always 
happens before privileged programs are created?