From: Edouard Klein <edk@beaver-labs.com>
To: help-guix <help-guix@gnu.org>
Subject: Can't setuid-program to a custom user
Date: Tue, 11 Apr 2023 16:47:14 +0200 [thread overview]
Message-ID: <877cuijwpa.fsf@rdklein.fr> (raw)
Dear Guix,
I am trying to install a program that requires its own user, and to
create a suid binary that will launch as this user, no matter who
launches it.
See lines 119 on of this file:
https://gitlab.com/edouardklein/guix/-/blob/6ae4c66bde1927aaae041311888c35105595a83e/beaver/packages/plan9.scm#L119
The creation of the account is successful, e.g. when I run a container
like so:
$(guix system container -e "(begin (use-modules (beaver system) (beaver
packages plan9)) (sucf minimal-container))")
I can check /etc/passwd and the user "suc" is in there.
I can launch guile, and type (getpw "suc") and get in response:
"$1 = #("suc" "x" 1000 30001 "" "/home/suc"
"/gnu/store/d99ykvj3axzzidygsmdmzxah4lvxd6hw-bash-5.1.8/bin/bash")"
I can check that the directory /var/lib/suc exists and is owned by the
user:
ls -l /var/lib/
total 4
-rw------- 1 root root 512 Apr 11 14:46 random-seed
drwxr-xr-x 2 suc suc 40 Apr 11 14:46 suc/
However, when I try to setuid the suc binary to user suc:
#+begin_src scheme
(setuid-programs
(cons (setuid-program (program (file-append suc "/bin/suc"))
(user "suc"))
#+end_src
Then when I launch my container I get:
"ERROR: In procedure getpw:
In procedure getpw: entry not found"
Which is very astonishing given that the user exists !
Does the setuid binaries service try to do its stuff before the accounts
are created ?
Does anybody have the slightest idea of why the user is not found ?
BTW, it works if I setuid to root by removing the `(user "suc")`.
Thanks in advance,
Edouard.
reply other threads:[~2023-04-11 14:55 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=877cuijwpa.fsf@rdklein.fr \
--to=edk@beaver-labs.com \
--cc=help-guix@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.