GNU bug report logs - #36093
[PATCH 0/2] 'guix pack --entry-point' and Singularity service

Previous Next

Full log

View this message in rfc822 format

From: Ludovic Courtès <ludo <at> gnu.org>
To: Danny Milosavljevic <dannym <at> scratchpost.org>
Cc: 36093 <at> debbugs.gnu.org
Subject: [bug#36093] [PATCH 1/2] services: Add Singularity.
Date: Wed, 05 Jun 2019 22:24:05 +0200

Hi Danny,

Danny Milosavljevic <dannym <at> scratchpost.org> skribis:

> On Tue,  4 Jun 2019 23:01:14 +0200
> Ludovic Courtès <ludo <at> gnu.org> wrote:
>
>> +@defvr {Scheme Variable} singularity-service-type
>> +This is the type of the service that runs
>> +@url{https://www.sylabs.io/singularity/, Singularity}, 
>
> Does it?
> Doesn't it just "allow you to invoke"?

Yes, you’re right.  I’ll reword as you suggest.

>> +                  (substitute* (find-files "libexec/cli" "\\.exec$")
>> +                    (("\\$SINGULARITY_libexecdir/singularity/bin/([a-z]+)-suid"
>> +                      _ program)
>> +                     (string-append "/run/setuid-programs/singularity-"
>> +                                    program "-helper")))
>
> Is absolute path OK?  There have been some efforts to get guix to relocate in
> the past.  Does this apply here?

I think it’s OK: those setuid helpers can only be used on Guix System,
not on a foreign distro, and it goes hand-in-hand with
‘singularity-service-type’.

>> +        ;; Create the directories that Singularity 2.6 expects to find.
>> +        (for-each (lambda (directory)
>> +                    (mkdir-p (string-append "/var/singularity/mnt/"
>> +                                            directory)))
>> +                  '("container" "final" "overlay" "session")))))
>
> Are permissions OK?

They’re good enough for the test, but perhaps it should be #o700.
I’ll check if it works like that.

There’s been a nice CVE for Singularity 3.x in this area recently:

  https://nvd.nist.gov/vuln/detail/CVE-2019-11328

It’s not directly applicable here but there could be similar issues.

Thanks,
Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.