* Can't setuid-program to a custom user
@ 2023-04-11 14:47 Edouard Klein
0 siblings, 0 replies; only message in thread
From: Edouard Klein @ 2023-04-11 14:47 UTC (permalink / raw)
To: help-guix
Dear Guix,
I am trying to install a program that requires its own user, and to
create a suid binary that will launch as this user, no matter who
launches it.
See lines 119 on of this file:
https://gitlab.com/edouardklein/guix/-/blob/6ae4c66bde1927aaae041311888c35105595a83e/beaver/packages/plan9.scm#L119
The creation of the account is successful, e.g. when I run a container
like so:
$(guix system container -e "(begin (use-modules (beaver system) (beaver
packages plan9)) (sucf minimal-container))")
I can check /etc/passwd and the user "suc" is in there.
I can launch guile, and type (getpw "suc") and get in response:
"$1 = #("suc" "x" 1000 30001 "" "/home/suc"
"/gnu/store/d99ykvj3axzzidygsmdmzxah4lvxd6hw-bash-5.1.8/bin/bash")"
I can check that the directory /var/lib/suc exists and is owned by the
user:
ls -l /var/lib/
total 4
-rw------- 1 root root 512 Apr 11 14:46 random-seed
drwxr-xr-x 2 suc suc 40 Apr 11 14:46 suc/
However, when I try to setuid the suc binary to user suc:
#+begin_src scheme
(setuid-programs
(cons (setuid-program (program (file-append suc "/bin/suc"))
(user "suc"))
#+end_src
Then when I launch my container I get:
"ERROR: In procedure getpw:
In procedure getpw: entry not found"
Which is very astonishing given that the user exists !
Does the setuid binaries service try to do its stuff before the accounts
are created ?
Does anybody have the slightest idea of why the user is not found ?
BTW, it works if I setuid to root by removing the `(user "suc")`.
Thanks in advance,
Edouard.
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2023-04-11 14:55 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-04-11 14:47 Can't setuid-program to a custom user Edouard Klein
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.