Subject: bug#28751: closed (Re: bug#28751: GuixSD setuid-programs handling creates setuid binaries in the store)

From: [email-masked] (GNU bug Tracking System)
Date: Sun, 08 Oct 2017 19:55:02 +0000

Your bug report

#28751: GuixSD setuid-programs handling creates setuid binaries in the store

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
28751: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=28751
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#28751: GuixSD setuid-programs handling creates setuid binaries in the store
From: [email-masked] (Ludovic Courtès)
To: [email-masked]
Date: Sun, 08 Oct 2017 21:54:22 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

[email-masked] (Ludovic Courtès) skribis:

> [email-masked] (Ludovic Courtès) skribis:
>
>> On GuixSD, ‘activate-setuid-programs’ in (gnu build activation) would
>> create setuid-root binaries under /gnu/store for all the programs listed
>> under ‘setuid-programs’ in the ‘operating-system’ declaration.
>
> Fixed by
> <https://git.savannah.gnu.org/cgit/guix.git/commit/?id=5e66574a128937e7f2fcf146d146225703ccfd5d>.

Detailed announcement at:

  https://lists.gnu.org/archive/html/guix-devel/2017-10/msg00090.html

Ludo’.

Subject: GuixSD setuid-programs handling creates setuid binaries in the store
From: [email-masked] (Ludovic Courtès)
To: [email-masked]
Date: Sun, 08 Oct 2017 21:25:15 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

On GuixSD, ‘activate-setuid-programs’ in (gnu build activation) would
create setuid-root binaries under /gnu/store for all the programs listed
under ‘setuid-programs’ in the ‘operating-system’ declaration.

‘activate-setuid-programs’ in (gnu build activation) does this:

  (define (make-setuid-program prog)
    (let ((target (string-append %setuid-directory
                                 "/" (basename prog))))
      (link-or-copy prog target)
      (chown target 0 0)
      (chmod target #o6555)))

which amounts to:

  1. ln /gnu/store/…/bin/su /run/setuid-programs/su
  2. chmod +s /run/setuid-programs/su

meaning that *both* ‘su’ files become setuid root.

This leads to setuid-root files in the store, which is a violation of a
fundamental assumption that setuid files cannot exist in the store.

Detailed announcement and fix coming.

Ludo’.