Package: guix-patches;
Reported by: Christopher Lemmer Webber <cwebber <at> dustycloud.org>
Date: Mon, 16 Nov 2020 23:31:02 UTC
Severity: normal
Done: Christine Lemmer-Webber <cwebber <at> dustycloud.org>
Bug is archived. No further changes may be made.
Message #32 received at 44700 <at> debbugs.gnu.org (full text, mbox):
From: Chris Lemmer-Webber <cwebber <at> dustycloud.org> To: Brice Waegeneire <brice <at> waegenei.re> Cc: 44700 <at> debbugs.gnu.org Subject: Re: [PATCH v2 2/2] services: Migrate to <setuid-program>. Date: Mon, 05 Jul 2021 11:28:35 -0400
Brice Waegeneire writes:
> * gnu/services/dbus.scm (dbus-setuid-programs, polkit-setuid-programs):
> Return setuid-programs.
> * gnu/services/desktop.scm (enlightenment-setuid-programs): Return
> setuid-programs.
> (%desktop-services)[mount-setuid-helpers]: Use setuid-programs.
> * gnu/services/docker.scm (singularity-setuid-programs): Return
> setuid-programs.
> * gnu/services/xorg.scm(screen-locker-setuid-programs): Return
> setuid-programs.
Again, probably want to indent consistently here. I think two spaces.
(However I guess this kind of indentation is not actually considered
standard for GNU changelog style, but Guix folks including myself tend
to do it...)
> * gnu/system.scm (%setuid-programs): Return setuid-programs.
> ---
> gnu/services/dbus.scm | 13 +++++++++----
> gnu/services/desktop.scm | 26 ++++++++++++++++----------
> gnu/services/docker.scm | 9 ++++++---
> gnu/services/xorg.scm | 4 +++-
> gnu/system.scm | 31 ++++++++++++++++---------------
> 5 files changed, 50 insertions(+), 33 deletions(-)
>
> diff --git a/gnu/services/dbus.scm b/gnu/services/dbus.scm
> index af1a1e4c3a..e7b3dac166 100644
> --- a/gnu/services/dbus.scm
> +++ b/gnu/services/dbus.scm
> @@ -2,6 +2,7 @@
> ;;; Copyright © 2013, 2014, 2015, 2016, 2017, 2019, 2020 Ludovic Courtès <ludo <at> gnu.org>
> ;;; Copyright © 2015 Sou Bunnbu <iyzsong <at> gmail.com>
> ;;; Copyright © 2021 Maxime Devos <maximedevos <at> telenet.be>
> +;;; Copyright © 2021 Brice Waegeneire <brice <at> waegenei.re>
> ;;;
> ;;; This file is part of GNU Guix.
> ;;;
> @@ -21,6 +22,7 @@
> (define-module (gnu services dbus)
> #:use-module (gnu services)
> #:use-module (gnu services shepherd)
> + #:use-module (gnu system setuid)
> #:use-module (gnu system shadow)
> #:use-module (gnu system pam)
> #:use-module ((gnu packages glib) #:select (dbus))
> @@ -156,10 +158,12 @@ includes the @code{etc/dbus-1/system.d} directories of each package listed in
> (shell (file-append shadow "/sbin/nologin")))))
>
> (define dbus-setuid-programs
> - ;; Return the file name of the setuid program that we need.
> + ;; Return a list of <setuid-program> for the program that we need.
> (match-lambda
> (($ <dbus-configuration> dbus services)
> - (list (file-append dbus "/libexec/dbus-daemon-launch-helper")))))
> + (list (setuid-program
> + (program (file-append
> + dbus "/libexec/dbus-daemon-launch-helper")))))))
Ooh, nice job updating all these other places to use the
<setuid-program> record also!
> (define (dbus-activation config)
> "Return an activation gexp for D-Bus using @var{config}."
> @@ -335,8 +339,9 @@ tuples, are all set as environment variables when the bus daemon launches it."
> (define polkit-setuid-programs
> (match-lambda
> (($ <polkit-configuration> polkit)
> - (list (file-append polkit "/lib/polkit-1/polkit-agent-helper-1")
> - (file-append polkit "/bin/pkexec")))))
> + (map file-like->setuid-program
> + (list (file-append polkit "/lib/polkit-1/polkit-agent-helper-1")
> + (file-append polkit "/bin/pkexec"))))))
>
> (define polkit-service-type
> (service-type (name 'polkit)
> diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm
> index cd800fcc2b..6297b8eb0b 100644
> --- a/gnu/services/desktop.scm
> +++ b/gnu/services/desktop.scm
> @@ -12,6 +12,7 @@
> ;;; Copyright © 2019 David Wilson <david <at> daviwil.com>
> ;;; Copyright © 2020 Tobias Geerinckx-Rice <me <at> tobias.gr>
> ;;; Copyright © 2020 Reza Alizadeh Majd <r.majd <at> pantherx.org>
> +;; Copyright © 2021 Brice Waegeneire <brice <at> waegenei.re>
> ;;;
> ;;; This file is part of GNU Guix.
> ;;;
> @@ -40,6 +41,7 @@
> #:use-module ((gnu system file-systems)
> #:select (%elogind-file-systems file-system))
> #:use-module (gnu system)
> + #:use-module (gnu system setuid)
> #:use-module (gnu system shadow)
> #:use-module (gnu system pam)
> #:use-module (gnu packages glib)
> @@ -1034,14 +1036,15 @@ rules."
>
> (define (enlightenment-setuid-programs enlightenment-desktop-configuration)
> (match-record enlightenment-desktop-configuration
> - <enlightenment-desktop-configuration>
> - (enlightenment)
> - (list (file-append enlightenment
> - "/lib/enlightenment/utils/enlightenment_sys")
> - (file-append enlightenment
> - "/lib/enlightenment/utils/enlightenment_system")
> - (file-append enlightenment
> - "/lib/enlightenment/utils/enlightenment_ckpasswd"))))
> + <enlightenment-desktop-configuration>
> + (enlightenment)
> + (map file-like->setuid-program
> + (list (file-append enlightenment
> + "/lib/enlightenment/utils/enlightenment_sys")
> + (file-append enlightenment
> + "/lib/enlightenment/utils/enlightenment_system")
> + (file-append enlightenment
> + "/lib/enlightenment/utils/enlightenment_ckpasswd")))))
>
> (define enlightenment-desktop-service-type
> (service-type
> @@ -1204,8 +1207,11 @@ or setting its password with passwd.")))
> ;; Allow desktop users to also mount NTFS and NFS file systems
> ;; without root.
> (simple-service 'mount-setuid-helpers setuid-program-service-type
> - (list (file-append nfs-utils "/sbin/mount.nfs")
> - (file-append ntfs-3g "/sbin/mount.ntfs-3g")))
> + (map (lambda (program)
> + (setuid-program
> + (program program)))
> + (list (file-append nfs-utils "/sbin/mount.nfs")
> + (file-append ntfs-3g "/sbin/mount.ntfs-3g"))))
>
> ;; The global fontconfig cache directory can sometimes contain
> ;; stale entries, possibly referencing fonts that have been GC'd,
> diff --git a/gnu/services/docker.scm b/gnu/services/docker.scm
> index be85316180..ef551480aa 100644
> --- a/gnu/services/docker.scm
> +++ b/gnu/services/docker.scm
> @@ -4,6 +4,7 @@
> ;;; Copyright © 2020, 2021 Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
> ;;; Copyright © 2020 Efraim Flashner <efraim <at> flashner.co.il>
> ;;; Copyright © 2020 Jesse Dowell <jessedowell <at> gmail.com>
> +;;; Copyright © 2021 Brice Waegeneire <brice <at> waegenei.re>
> ;;;
> ;;; This file is part of GNU Guix.
> ;;;
> @@ -26,6 +27,7 @@
> #:use-module (gnu services base)
> #:use-module (gnu services dbus)
> #:use-module (gnu services shepherd)
> + #:use-module (gnu system setuid)
> #:use-module (gnu system shadow)
> #:use-module (gnu packages docker)
> #:use-module (gnu packages linux) ;singularity
> @@ -195,9 +197,10 @@ bundles in Docker containers.")
> "-helper")))
> '("action" "mount" "start")))))
>
> - (list (file-append helpers "/singularity-action-helper")
> - (file-append helpers "/singularity-mount-helper")
> - (file-append helpers "/singularity-start-helper")))
> + (map file-like->setuid-program
> + (list (file-append helpers "/singularity-action-helper")
> + (file-append helpers "/singularity-mount-helper")
> + (file-append helpers "/singularity-start-helper"))))
>
> (define singularity-service-type
> (service-type (name 'singularity)
> diff --git a/gnu/services/xorg.scm b/gnu/services/xorg.scm
> index 8ffea3b9dd..d95f8beb7a 100644
> --- a/gnu/services/xorg.scm
> +++ b/gnu/services/xorg.scm
> @@ -8,6 +8,7 @@
> ;;; Copyright © 2020 shtwzrd <shtwzrd <at> protonmail.com>
> ;;; Copyright © 2020 Jakub Kądziołka <kuba <at> kadziolka.net>
> ;;; Copyright © 2020 Alex Griffin <a <at> ajgrf.com>
> +;;; Copyright © 2021 Brice Waegeneire <brice <at> waegenei.re>
> ;;;
> ;;; This file is part of GNU Guix.
> ;;;
> @@ -29,6 +30,7 @@
> #:use-module (gnu services)
> #:use-module (gnu services shepherd)
> #:use-module (gnu system pam)
> + #:use-module (gnu system setuid)
> #:use-module (gnu system keyboard)
> #:use-module (gnu services base)
> #:use-module (gnu services dbus)
> @@ -681,7 +683,7 @@ reboot_cmd " shepherd "/sbin/reboot\n"
> #:allow-empty-passwords? empty?)))))
>
> (define screen-locker-setuid-programs
> - (compose list screen-locker-program))
> + (compose list file-like->setuid-program screen-locker-program))
>
> (define screen-locker-service-type
> (service-type (name 'screen-locker)
> diff --git a/gnu/system.scm b/gnu/system.scm
> index 96b45ede96..8a70f86457 100644
> --- a/gnu/system.scm
> +++ b/gnu/system.scm
> @@ -1074,22 +1074,23 @@ use 'plain-file' instead~%")
> (define %setuid-programs
> ;; Default set of setuid-root programs.
> (let ((shadow (@ (gnu packages admin) shadow)))
> - (list (file-append shadow "/bin/passwd")
> - (file-append shadow "/bin/sg")
> - (file-append shadow "/bin/su")
> - (file-append shadow "/bin/newgrp")
> - (file-append shadow "/bin/newuidmap")
> - (file-append shadow "/bin/newgidmap")
> - (file-append inetutils "/bin/ping")
> - (file-append inetutils "/bin/ping6")
> - (file-append sudo "/bin/sudo")
> - (file-append sudo "/bin/sudoedit")
> - (file-append fuse "/bin/fusermount")
> + (map file-like->setuid-program
> + (list (file-append shadow "/bin/passwd")
> + (file-append shadow "/bin/sg")
> + (file-append shadow "/bin/su")
> + (file-append shadow "/bin/newgrp")
> + (file-append shadow "/bin/newuidmap")
> + (file-append shadow "/bin/newgidmap")
> + (file-append inetutils "/bin/ping")
> + (file-append inetutils "/bin/ping6")
> + (file-append sudo "/bin/sudo")
> + (file-append sudo "/bin/sudoedit")
> + (file-append fuse "/bin/fusermount")
>
> - ;; To allow mounts with the "user" option, "mount" and "umount" must
> - ;; be setuid-root.
> - (file-append util-linux "/bin/mount")
> - (file-append util-linux "/bin/umount"))))
> + ;; To allow mounts with the "user" option, "mount" and "umount" must
> + ;; be setuid-root.
> + (file-append util-linux "/bin/mount")
> + (file-append util-linux "/bin/umount")))))
>
> (define %sudoers-specification
> ;; Default /etc/sudoers contents: 'root' and all members of the 'wheel'
This looks very good. The comments I made were minor (my name, some
indentation stuff). Otherwise else I think it looks good to merge.
With those changes (indentation stuff, and then my name change) I think
it's good to push! This will be a great thing to get in... then
hopefully postfix can come next!
GNU bug tracking system
Copyright (C) 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson.