From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 00/12] Add "least authority" program wrapper Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 17 Apr 2022 21:02:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= X-Debbugs-Original-To: guix-patches@gnu.org Received: via spool by submit@debbugs.gnu.org id=B.16502292867432 (code B ref -1); Sun, 17 Apr 2022 21:02:02 +0000 Received: (at submit) by debbugs.gnu.org; 17 Apr 2022 21:01:26 +0000 Received: from localhost ([127.0.0.1]:37383 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC1O-0001vn-0d for submit@debbugs.gnu.org; Sun, 17 Apr 2022 17:01:26 -0400 Received: from lists.gnu.org ([209.51.188.17]:53320) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC1M-0001vg-8o for submit@debbugs.gnu.org; Sun, 17 Apr 2022 17:01:24 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:60028) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngC1J-0005Os-VL for guix-patches@gnu.org; Sun, 17 Apr 2022 17:01:24 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:58326) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngC1J-0008EY-Mm; Sun, 17 Apr 2022 17:01:21 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:Date:Subject:To:From:in-reply-to: references; bh=FvJpE7nukYqYvkiFQWBCQjnHoU335xkw3YOLTcuc+aw=; b=aKZniBCTJZe6GR ppm7r8KU23456/5tqZO5GhVWgBxRyc49yjed3cq7wRZVbtBwiR/Rlb6qlrB67fAxjtUKj7xyCwPAk MqRR0FaGkbxI6s7MYkRNNHTrdHqLJf0ykOW8FYiOTaeh4s6cOWfAZu7QZOsSgC8PgyQ1qniHQR79d 00chtfOC+7NeVh8bxESEGPJZvpSNbIVhRGk7Awa8wFqQRZapa2sSWHBkm/mVwU1S0PPmAJB4zJxSn N7jHqgBbW936UBBSrZTeC4M4flAfs9xycveP73bteKNNUc/Cehgi3OpQA98q19qsAUMlo/wcg7Omd bMkTgnZ5Z/ktKmupC5Fg==; Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38868 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ngC1H-0004Hq-To; Sun, 17 Apr 2022 17:01:20 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Sun, 17 Apr 2022 23:01:07 +0200 Message-Id: <20220417210107.27263-1-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Hello Guix! So we have this fancy ‘make-forkexec-constructor/container’ thing to spawn Shepherd services in a container: https://guix.gnu.org/en/blog/2017/running-system-services-in-containers/ It’s nice, but it doesn’t compose. What if you want an inetd-style service *and* have it run in a container? We certainly don’t want to end up defining ‘make-inetd-constructor/container’ and so on. Instead, the new (guix least-authority) module provides a way to create “least-authority wrappers” for a given program: the wrapper forks[*] a process that lives in separate namespaces, with ‘call-with-container’, sets up bind mounts and everything in the child, and executes the program in that environment. ([*] I considered using unshare(2) instead of forking but that doesn’t quite work, notably because the process itself would remain in the same PID namespace as its parent.) Subsequent patches change most, but not all, users of ‘make-forkexec-constructor/container’ to ‘least-authority-wrapper’. One situation where ‘make-forkexec-constructor/container’ cannot be replaced yet is when we rely on #:pid-file, as is the case for Tor (‘make-forkexec-constructor/container’ goes to great lengths to read PID files in the container and be happy with a PID that is only valid within that namespace.) The remaining users are Jami and Pagekite; that is left as an exercise to the reader. :-) I have plans to use ‘least-authority-wrapper’ in other contexts, in particular as the basis of a new package transformation option. Thoughts? Ludo’. Ludovic Courtès (12): gexp: Add 'references-file'. file-systems: Avoid load-time warnings when attempting to load (guix store). linux-container: 'call-with-container' relays SIGTERM and SIGINT. Add (guix least-authority). services: dicod: Rewrite using 'least-authority-wrapper'. services: dicod: Use 'make-inetd-constructor'. services: bitlbee: Use 'make-inetd-constructor'. services: ipfs: Adjust for Shepherd 0.9. services: ipfs: Use 'least-authority-wrapper'. services: wesnothd: Grant write access to /var/run/wesnothd. services: wesnothd: Use 'least-authority-wrapper'. services: quassel: Use 'least-authority-wrapper'. Makefile.am | 1 + gnu/build/linux-container.scm | 15 ++-- gnu/build/shepherd.scm | 3 +- gnu/services/base.scm | 22 ------ gnu/services/dict.scm | 61 ++++++++++------ gnu/services/games.scm | 33 +++++++-- gnu/services/messaging.scm | 105 +++++++++++++++++---------- gnu/services/networking.scm | 118 +++++++++++++++--------------- gnu/system/file-systems.scm | 5 +- gnu/tests/messaging.scm | 21 +----- guix/gexp.scm | 43 +++++++++++ guix/least-authority.scm | 131 ++++++++++++++++++++++++++++++++++ tests/gexp.scm | 18 +++++ 13 files changed, 403 insertions(+), 173 deletions(-) create mode 100644 guix/least-authority.scm base-commit: 950f3e4f98add14f645dc4c9f8c512cac7b8a779 -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 02/12] file-systems: Avoid load-time warnings when attempting to load (guix store). Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 17 Apr 2022 21:06:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.16502295487897 (code B ref 54997); Sun, 17 Apr 2022 21:06:02 +0000 Received: (at 54997) by debbugs.gnu.org; 17 Apr 2022 21:05:48 +0000 Received: from localhost ([127.0.0.1]:37401 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5a-000235-M1 for submit@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:47 -0400 Received: from eggs.gnu.org ([209.51.188.92]:39438) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5Y-00022P-H3 for 54997@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:44 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:58428) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngC5S-0000V8-H6; Sun, 17 Apr 2022 17:05:39 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=tCEcYbLVy9R+D55+gDP9TNw5g86IRjUi6cluKsFFGHM=; b=VQpzhMcr7b7aBkN/cown CUhZsoVAFUvW8IZFVs5JNk0b09QyKuyiXADT12Krqeob3o+5iDNKMhGaQhljBJ2OIBZzqtly3f5BC sYSzuxr296TziNUsVtuD2nk4MJw/KUNV8nrFYGbRffWNBp56216yxs6OD75GqK6xxJ1mS6QqYsQ9h 9cPDk4ffegz949sL40pbgDPfEhbhSCKMlReSrCNWucJ+oqSCfhix5bwMtTmzYk+aGqCF7lagBnPqD HaV8CMCSfYdTaQdwO2SuEF57v5/MgyG53yQkZkpDJSG998Dox+ZlVF+JWIUDRHCG1wiNWjXwM8ESc dPm4N/Md3rNR7w==; Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38870 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ngC5R-000268-In; Sun, 17 Apr 2022 17:05:38 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Sun, 17 Apr 2022 23:04:43 +0200 Message-Id: <20220417210453.27884-2-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220417210453.27884-1-ludo@gnu.org> References: <20220417210453.27884-1-ludo@gnu.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) This makes sure warnings like "incompatible bytecode version" don't go through when looking for (guix store). * gnu/system/file-systems.scm (%store-prefix): Parameterize 'current-warning-port' around 'resolve-module' call. --- gnu/system/file-systems.scm | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/gnu/system/file-systems.scm b/gnu/system/file-systems.scm index 437f8da898..f8f4276283 100644 --- a/gnu/system/file-systems.scm +++ b/gnu/system/file-systems.scm @@ -1,5 +1,5 @@ ;;; GNU Guix --- Functional package management for GNU -;;; Copyright © 2013-2021 Ludovic Courtès +;;; Copyright © 2013-2022 Ludovic Courtès ;;; Copyright © 2020 Google LLC ;;; Copyright © 2020 Jakub Kądziołka ;;; Copyright © 2020, 2021 Maxim Cournoyer @@ -272,7 +272,8 @@ (define (%store-prefix) ;; Note: If we have (guix store database) in the search path and we do *not* ;; have (guix store) proper, 'resolve-module' returns an empty (guix store) ;; with one sub-module. - (cond ((and=> (resolve-module '(guix store) #:ensure #f) + (cond ((and=> (parameterize ((current-warning-port (%make-void-port "w0"))) + (resolve-module '(guix store) #:ensure #f)) (lambda (store) (module-variable store '%store-prefix))) => -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 01/12] gexp: Add 'references-file'. References: <20220417210107.27263-1-ludo@gnu.org> In-Reply-To: <20220417210107.27263-1-ludo@gnu.org> Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 17 Apr 2022 21:06:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.16502295507927 (code B ref 54997); Sun, 17 Apr 2022 21:06:02 +0000 Received: (at 54997) by debbugs.gnu.org; 17 Apr 2022 21:05:50 +0000 Received: from localhost ([127.0.0.1]:37409 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5c-00023K-0C for submit@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:49 -0400 Received: from eggs.gnu.org ([209.51.188.92]:39436) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5Y-00022O-H3 for 54997@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:45 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:58426) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngC5R-0000Uy-Cc; Sun, 17 Apr 2022 17:05:37 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:Date:Subject:To:From:in-reply-to: references; bh=wbpXxlHeJZdI+lfL7OeHJxEDNXMLl91/Te59oUDq9Vk=; b=gmXw2AhRnWgnYn R+gRkp4FYtd3li8SFrdEf+NbR7XlLXX2UuqvCcvVPXNN4nBPdIirPn17Tz8kEX1Rrfbh8xf9HuRns L/sXu4m/OZUzInfJlgC3SvOJi6yrmuD7t04TR318ZSlgf1KZiuLr5k4XsGx3FbwICvAW2xgUEou3R KHQsUx6WCi9sA/sB7uZ+QkHyKe+h9Yb2Leoh/NftlPWURHzY7T2LO8bbqUv1viZXFQ5gceu9wowCg 0ihMxAL7ULwOMY97zjyypSdBE/zDAeOsGygk/Pxx3+d5gO2O6UZyKTs6SjEP4v8SD2aYRfMA+qvLW K9wyek48YpQricuOjFBg==; Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38870 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ngC4u-000268-9q; Sun, 17 Apr 2022 17:05:24 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Sun, 17 Apr 2022 23:04:42 +0200 Message-Id: <20220417210453.27884-1-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/base.scm (references-file): Remove. * guix/gexp.scm (references-file): New procedure. * tests/gexp.scm ("references-file"): New test. --- gnu/services/base.scm | 22 ---------------------- guix/gexp.scm | 43 +++++++++++++++++++++++++++++++++++++++++++ tests/gexp.scm | 18 ++++++++++++++++++ 3 files changed, 61 insertions(+), 22 deletions(-) diff --git a/gnu/services/base.scm b/gnu/services/base.scm index 5d7c69a9cd..182badd97f 100644 --- a/gnu/services/base.scm +++ b/gnu/services/base.scm @@ -219,8 +219,6 @@ (define-module (gnu services base) pam-limits-service-type pam-limits-service - references-file - %base-services)) ;;; Commentary: @@ -1768,26 +1766,6 @@ (define (guix-activation config) (substitute-key-authorization authorized-keys guix) #~#f)))) -(define* (references-file item #:optional (name "references")) - "Return a file that contains the list of references of ITEM." - (if (struct? item) ;lowerable object - (computed-file name - (with-extensions (list guile-gcrypt) ;for store-copy - (with-imported-modules (source-module-closure - '((guix build store-copy))) - #~(begin - (use-modules (guix build store-copy)) - - (call-with-output-file #$output - (lambda (port) - (write (map store-info-item - (call-with-input-file "graph" - read-reference-graph)) - port)))))) - #:options `(#:local-build? #f - #:references-graphs (("graph" ,item)))) - (plain-file name "()"))) - (define guix-service-type (service-type (name 'guix) diff --git a/guix/gexp.scm b/guix/gexp.scm index 9fdb7a30be..9ef7622062 100644 --- a/guix/gexp.scm +++ b/guix/gexp.scm @@ -118,6 +118,7 @@ (define-module (guix gexp) mixed-text-file file-union directory-union + references-file imported-files imported-modules @@ -2173,6 +2174,48 @@ (define log-port #:resolve-collision (ungexp resolve-collision))))))))) +(define* (references-file item #:optional (name "references") + #:key guile) + "Return a file that contains the list of direct and indirect references (the +closure) of ITEM." + (if (struct? item) ;lowerable object + (computed-file name + (gexp (begin + (use-modules (ice-9 rdelim) + (ice-9 match)) + + (define (drop-lines port n) + ;; Drop N lines read from PORT. + (let loop ((n n)) + (unless (zero? n) + (read-line port) + (loop (- n 1))))) + + (define (read-graph port) + ;; Return the list of references read from + ;; PORT. This is a stripped-down version of + ;; 'read-reference-graph'. + (let loop ((items '())) + (match (read-line port) + ((? eof-object?) + items) + ((? string? item) + (let ((deriver (read-line port)) + (count + (string->number (read-line port)))) + (drop-lines port count) + (loop (cons item items))))))) + + (call-with-output-file (ungexp output) + (lambda (port) + (write (call-with-input-file "graph" + read-graph) + port))))) + #:guile guile + #:options `(#:local-build? #t + #:references-graphs (("graph" ,item)))) + (plain-file name "()"))) + ;;; ;;; Syntactic sugar. diff --git a/tests/gexp.scm b/tests/gexp.scm index c80ca13fab..35bd99e6d4 100644 --- a/tests/gexp.scm +++ b/tests/gexp.scm @@ -1606,6 +1606,24 @@ (define (contents=? file str) (not (member (derivation-file-name native) refs)) (member (derivation-file-name cross) refs)))))) +(test-assertm "references-file" + (let* ((exp #~(symlink #$%bootstrap-guile #$output)) + (computed (computed-file "computed" exp + #:guile %bootstrap-guile)) + (refs (references-file computed "refs" + #:guile %bootstrap-guile))) + (mlet* %store-monad ((drv0 (lower-object %bootstrap-guile)) + (drv1 (lower-object computed)) + (drv2 (lower-object refs))) + (mbegin %store-monad + (built-derivations (list drv2)) + (mlet %store-monad ((refs ((store-lift requisites) + (list (derivation->output-path drv1))))) + (return (lset= string=? + (call-with-input-file (derivation->output-path drv2) + read) + refs))))))) + (test-assert "lower-object & gexp-input-error?" (guard (c ((gexp-input-error? c) (gexp-error-invalid-input c))) -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 03/12] linux-container: 'call-with-container' relays SIGTERM and SIGINT. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 17 Apr 2022 21:06:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.16502295517949 (code B ref 54997); Sun, 17 Apr 2022 21:06:02 +0000 Received: (at 54997) by debbugs.gnu.org; 17 Apr 2022 21:05:51 +0000 Received: from localhost ([127.0.0.1]:37418 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5d-00023n-Qn for submit@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:50 -0400 Received: from eggs.gnu.org ([209.51.188.92]:39442) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5Y-00022Q-IU for 54997@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:45 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:58430) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngC5T-0000VD-3g; Sun, 17 Apr 2022 17:05:39 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=KQY2OhpYVR32wlhD9kgHENqTHQ9s/ec3P+TbLHhnwgU=; b=Pb8jPn6zMh8UsbHsWHy8 jQDIYoFBuzGFJDzTwDeKllxocjba5fBRIfFlEpNAtEtlQjRaOYoD/EmwrYycqXf81ieov7HmjGUTO xTqnF8syHQ9EpMmRsliBtWZaiEtTdmq1IvmEYVwy9dId3cMfOmxeWkLMpfG2ZUzRDbiXM6uCF20Ne Jl7/WXWh3VC/Plu1C7CJBRnB3He29YaZBnS6FldRsNav8VbFQIrnA4URj8+KNJCZUWEY9mhOfdu/k x4GOSPkYu/hSZ5OCS6DBPpomJJErXPmBwwForZwI+r+f6ggMd4nCQvqRCy9cPrd7cgA0YW5uuXcXO hjd43C6qZLuwgw==; Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38870 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ngC5S-000268-NP; Sun, 17 Apr 2022 17:05:38 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Sun, 17 Apr 2022 23:04:44 +0200 Message-Id: <20220417210453.27884-3-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220417210453.27884-1-ludo@gnu.org> References: <20220417210453.27884-1-ludo@gnu.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/build/linux-container.scm (call-with-container): Add #:relayed-signals and honor it. --- gnu/build/linux-container.scm | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm index bdeca2cdb9..c19029aa65 100644 --- a/gnu/build/linux-container.scm +++ b/gnu/build/linux-container.scm @@ -303,6 +303,7 @@ (define (call-with-temporary-directory proc) (define* (call-with-container mounts thunk #:key (namespaces %namespaces) (host-uids 1) (guest-uid 0) (guest-gid 0) + (relayed-signals (list SIGINT SIGTERM)) (process-spawned-hook (const #t))) "Run THUNK in a new container process and return its exit status; call PROCESS-SPAWNED-HOOK with the PID of the new process that has been spawned. @@ -320,6 +321,9 @@ (define* (call-with-container mounts thunk #:key (namespaces %namespaces) GUEST-UID and GUEST-GID specify the first UID (respectively GID) that host UIDs (respectively GIDs) map to in the namespace. +RELAYED-SIGNALS is the list of signals that are \"relayed\" to the container +process when caught by its parent. + Note that if THUNK needs to load any additional Guile modules, the relevant module files must be present in one of the mappings in MOUNTS and the Guile load path must be adjusted as needed." @@ -328,11 +332,12 @@ (define* (call-with-container mounts thunk #:key (namespaces %namespaces) (let ((pid (run-container root mounts namespaces host-uids thunk #:guest-uid guest-uid #:guest-gid guest-gid))) - ;; Catch SIGINT and kill the container process. - (sigaction SIGINT - (lambda (signum) - (false-if-exception - (kill pid SIGKILL)))) + (define (relay-signal signal) + (false-if-exception (kill pid signal))) + + (for-each (lambda (signal) + (sigaction signal relay-signal)) + relayed-signals) (process-spawned-hook pid) (match (waitpid pid) -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 04/12] Add (guix least-authority). Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 17 Apr 2022 21:06:03 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.16502295517956 (code B ref 54997); Sun, 17 Apr 2022 21:06:03 +0000 Received: (at 54997) by debbugs.gnu.org; 17 Apr 2022 21:05:51 +0000 Received: from localhost ([127.0.0.1]:37420 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5e-00024A-TD for submit@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:51 -0400 Received: from eggs.gnu.org ([209.51.188.92]:39446) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5Y-00022R-S4 for 54997@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:45 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:58432) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngC5T-0000VY-N8; Sun, 17 Apr 2022 17:05:39 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=d6/DPBbhkS1XwGbod43NES4lGvcR+/kUYIR+TVHhgW0=; b=RsDYF7s8GZ8jX+t7Wxnq WerDTerkqnvXcdbM2aXruSKHNDNeorIlQYa7t1q+KXzDA3HncgpWTVdN+IDKxoFBkLb3309DgiagG /RfnDFGrYaIfoq5qXog86XMdooeEqPi00VNalUCNOSk3uhb+SwAY3uUl7Qmu9De6MZigmdnRdU5SM 3KisbyxjcQfyNlsxl7VJYrDP82SjkocOCNIzA9N8xAcH9V677acDvS53idAJTEjs/YZQftnrL/G0f ESlAG5d/CLnlMSP3aTMxzlKTekoRmVILUOoWVf2mmT/QX14cv+S9Ntk/CWUq7PAVqzvrBUUxTI+2u mykJAiA6aGPlPg==; Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38870 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ngC5T-000268-AS; Sun, 17 Apr 2022 17:05:39 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Sun, 17 Apr 2022 23:04:45 +0200 Message-Id: <20220417210453.27884-4-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220417210453.27884-1-ludo@gnu.org> References: <20220417210453.27884-1-ludo@gnu.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * guix/least-authority.scm: New file. * Makefile.am (MODULES): Add it. * gnu/build/shepherd.scm (default-mounts): Make public. --- Makefile.am | 1 + gnu/build/shepherd.scm | 3 +- guix/least-authority.scm | 131 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 134 insertions(+), 1 deletion(-) create mode 100644 guix/least-authority.scm diff --git a/Makefile.am b/Makefile.am index fecce7c6f7..d0d58da4e3 100644 --- a/Makefile.am +++ b/Makefile.am @@ -130,6 +130,7 @@ MODULES = \ guix/cache.scm \ guix/cve.scm \ guix/workers.scm \ + guix/least-authority.scm \ guix/ipfs.scm \ guix/build-system.scm \ guix/build-system/android-ndk.scm \ diff --git a/gnu/build/shepherd.scm b/gnu/build/shepherd.scm index d52e53eb78..f4caefce3c 100644 --- a/gnu/build/shepherd.scm +++ b/gnu/build/shepherd.scm @@ -31,7 +31,8 @@ (define-module (gnu build shepherd) exec-command %precious-signals) #:autoload (shepherd system) (unblock-signals) - #:export (make-forkexec-constructor/container + #:export (default-mounts + make-forkexec-constructor/container fork+exec-command/container)) ;;; Commentary: diff --git a/guix/least-authority.scm b/guix/least-authority.scm new file mode 100644 index 0000000000..806c47508f --- /dev/null +++ b/guix/least-authority.scm @@ -0,0 +1,131 @@ +;;; GNU Guix --- Functional package management for GNU +;;; Copyright © 2022 Ludovic Courtès +;;; +;;; This file is part of GNU Guix. +;;; +;;; GNU Guix is free software; you can redistribute it and/or modify it +;;; under the terms of the GNU General Public License as published by +;;; the Free Software Foundation; either version 3 of the License, or (at +;;; your option) any later version. +;;; +;;; GNU Guix is distributed in the hope that it will be useful, but +;;; WITHOUT ANY WARRANTY; without even the implied warranty of +;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +;;; GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License +;;; along with GNU Guix. If not, see . + +(define-module (guix least-authority) + #:use-module (guix gexp) + #:use-module (guix modules) + #:use-module ((guix store) #:select (%store-prefix)) + #:autoload (gnu build linux-container) (%namespaces) + #:autoload (gnu system file-systems) (file-system-mapping + file-system-mapping-source + spec->file-system + file-system->spec + file-system-mapping->bind-mount) + #:export (least-authority-wrapper)) + +;;; Commentary: +;;; +;;; This module provides tools to execute programs with the least authority +;;; necessary, using Linux namespaces. +;;; +;;; Code: + +(define %precious-variables + ;; Environment variables preserved by the wrapper by default. + '("HOME" "USER" "LOGNAME" "DISPLAY" "XAUTHORITY" "TERM" "TZ" "PAGER")) + +(define* (least-authority-wrapper program + #:key (name "pola-wrapper") + (guest-uid 1000) + (guest-gid 1000) + (mappings '()) + (namespaces %namespaces) + (directory "/") + (preserved-environment-variables + %precious-variables)) + "Return a wrapper of PROGRAM that executes it with the least authority. + +PROGRAM is executed in separate namespaces according to NAMESPACES, a list of +symbols; it turns with GUEST-UID and GUEST-GID. MAPPINGS is a list of + records indicating directories mirrored inside the +execution environment of PROGRAM. DIRECTORY is the working directory of the +wrapped process. Each environment listed in PRESERVED-ENVIRONMENT-VARIABLES +is preserved; other environment variables are erased." + (define code + (with-imported-modules (source-module-closure + '((gnu system file-systems) + (gnu build shepherd) + (gnu build linux-container))) + #~(begin + (use-modules (gnu system file-systems) + (gnu build linux-container) + ((gnu build shepherd) #:select (default-mounts)) + (srfi srfi-1)) + + (define variables + (filter-map (lambda (variable) + (let ((value (getenv variable))) + (and value + (string-append variable "=" value)))) + '#$preserved-environment-variables)) + + (define (read-file file) + (call-with-input-file file read)) + + (define references + (delete-duplicates + (append-map read-file + '#$(map references-file + (cons program + (map file-system-mapping-source + mappings)))))) + + (define (store? file-system) + (string=? (file-system-mount-point file-system) + #$(%store-prefix))) + + (define mounts + (append (map (lambda (item) + (file-system-mapping->bind-mount + (file-system-mapping (source item) + (target item)))) + references) + (remove store? + (default-mounts + #:namespaces '#$namespaces)) + (map spec->file-system + '#$(map (compose file-system->spec + file-system-mapping->bind-mount) + mappings)))) + + (define (reify-exit-status status) + (cond ((status:exit-val status) => exit) + ((or (status:term-sig status) + (status:stop-sig status)) + => (lambda (signal) + (format (current-error-port) + "~a terminated with signal ~a~%" + #$program signal) + (exit 126))))) + + ;; Note: 'call-with-container' creates a sub-process that this one + ;; waits for. This might seem suboptimal but unshare(2) isn't + ;; really applicable: the process would still run in the same PID + ;; namespace. + + (reify-exit-status + (call-with-container mounts + (lambda () + (chdir #$directory) + (environ variables) + (apply execl #$program #$program (cdr (command-line)))) + #:guest-uid #$guest-uid + #:guest-gid #$guest-gid + #:namespaces '#$namespaces))))) + + (program-file name code)) -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 06/12] services: dicod: Use 'make-inetd-constructor'. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 17 Apr 2022 21:06:03 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.16502295577971 (code B ref 54997); Sun, 17 Apr 2022 21:06:03 +0000 Received: (at 54997) by debbugs.gnu.org; 17 Apr 2022 21:05:57 +0000 Received: from localhost ([127.0.0.1]:37422 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5k-00024U-O4 for submit@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:56 -0400 Received: from eggs.gnu.org ([209.51.188.92]:39472) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5a-00022V-CN for 54997@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:46 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:58436) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngC5U-0000Vk-TK; Sun, 17 Apr 2022 17:05:41 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=MQpPXdmT27Sc0jQcJN7CCKM6M2Rthov0aXprrffF8VE=; b=h7juhjTWv/dHtYXB+umq vpWTNtfdkkA3QcXC202Pq/L0HJ+RoIOL2tTxUcW9b1E+KUhZYOhWn7y3/ae9LBSxq5THXpCWwe3Fb PeIGoRVK07nCxeuqfWsqbM6cAK2P8k44a60z6NdWoYhf3ZR+dS0oVkOvxUDXeOuSCDvR5WCV38zDA JBOrFNy8h2sZA1ol+VAe+MOW0FI0PJZGHHkwCd63cpx0jv6zivK3d8J/1GZZML3g9gla5Pfc79mAH YHuqqgSqMjmts7lBUZSXK1+yKGNUZBoh/ylwKfR7z/bDH+R7v6278Y84UjG0bi/AmqIMfiWeJzqVY hB0D9vGv8mNpUA==; Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38870 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ngC5U-000268-Gr; Sun, 17 Apr 2022 17:05:40 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Sun, 17 Apr 2022 23:04:47 +0200 Message-Id: <20220417210453.27884-6-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220417210453.27884-1-ludo@gnu.org> References: <20220417210453.27884-1-ludo@gnu.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/dict.scm (dicod-shepherd-service): Use 'make-inetd-constructor' in the 'start' method when available. --- gnu/services/dict.scm | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/gnu/services/dict.scm b/gnu/services/dict.scm index 62b21f8d53..109917c05c 100644 --- a/gnu/services/dict.scm +++ b/gnu/services/dict.scm @@ -146,6 +146,7 @@ (define %dicod-activation (define (dicod-shepherd-service config) (let* ((dicod.conf (dicod-configuration-file config)) + (interfaces (dicod-configuration-interfaces config)) (dicod (least-authority-wrapper (file-append (dicod-configuration-dico config) "/bin/dicod") @@ -165,10 +166,19 @@ (define (dicod-shepherd-service config) (provision '(dicod)) (requirement '(user-processes)) (documentation "Run the dicod daemon.") - (start #~(make-forkexec-constructor - (list #$dicod "--foreground" - (string-append "--config=" #$dicod.conf)) - #:user "dicod" #:group "dicod")) + (start #~(if (and (defined? 'make-inetd-constructor) + #$(= 1 (length interfaces))) ;XXX + (make-inetd-constructor + (list #$dicod "--inetd" "--foreground" + (string-append "--config=" #$dicod.conf)) + (addrinfo:addr + (car (getaddrinfo #$(first interfaces) "dict"))) + #:user "dicod" #:group "dicod" + #:service-name-stem "dicod") + (make-forkexec-constructor + (list #$dicod "--foreground" + (string-append "--config=" #$dicod.conf)) + #:user "dicod" #:group "dicod"))) (stop #~(make-kill-destructor)))))) (define dicod-service-type -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 05/12] services: dicod: Rewrite using 'least-authority-wrapper'. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 17 Apr 2022 21:06:03 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.16502295577978 (code B ref 54997); Sun, 17 Apr 2022 21:06:03 +0000 Received: (at 54997) by debbugs.gnu.org; 17 Apr 2022 21:05:57 +0000 Received: from localhost ([127.0.0.1]:37424 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5l-00024W-0W for submit@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:57 -0400 Received: from eggs.gnu.org ([209.51.188.92]:39466) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5a-00022U-C7 for 54997@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:47 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:58434) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngC5U-0000Vj-9z; Sun, 17 Apr 2022 17:05:41 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=C/R40NJJCuw3AQnu9NbuQVkDnge+l5uFaKySskrcw5Q=; b=DPx7eqS2muLdQOD+DjnB ncDd5vqHOHz5gqDHpYZmiMtCooS7acnBUqvX4hglEqR4/ppIdPVH8EEuT3rJkBI8ljcKHpPNU8UwN KKNQgyexyBE9Lxjq29dBI8/uZnoh1lwzuQ1p260WzPIkFpGGal8upLIvUPpRHYl1Zj8yv3yNaKHq6 eisBygy54Ix6a2H4L0vgGfLAh8zNGZS5Um8RRJ+1zCCZRnuBYtsFF5Pws7oU2mloHVWbXLiLGEOH7 kNxXJFyo/mvTLaJxSy5lmEGWK3UdD3yF5Mzk68iMFKwqe8ZydN98Pll0qSDMPjTZJf42P+JUz9Bxe mJiVnhs1rCuYtQ==; Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38870 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ngC5T-000268-Tr; Sun, 17 Apr 2022 17:05:40 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Sun, 17 Apr 2022 23:04:46 +0200 Message-Id: <20220417210453.27884-5-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220417210453.27884-1-ludo@gnu.org> References: <20220417210453.27884-1-ludo@gnu.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/dict.scm (dicod-shepherd-service): Rewrite using 'least-authority-wrapper' plus 'make-forkexec-constructor' instead of 'make-forkexec-constructor/container'. --- gnu/services/dict.scm | 51 ++++++++++++++++++++++++------------------- 1 file changed, 29 insertions(+), 22 deletions(-) diff --git a/gnu/services/dict.scm b/gnu/services/dict.scm index a97ad8f608..62b21f8d53 100644 --- a/gnu/services/dict.scm +++ b/gnu/services/dict.scm @@ -1,6 +1,6 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2016 Sou Bunnbu -;;; Copyright © 2016, 2017, 2018, 2020 Ludovic Courtès +;;; Copyright © 2016, 2017, 2018, 2020, 2022 Ludovic Courtès ;;; Copyright © 2017 Huang Ying ;;; ;;; This file is part of GNU Guix. @@ -22,12 +22,15 @@ (define-module (gnu services dict) #:use-module (guix gexp) #:use-module (guix records) #:use-module (guix modules) + #:use-module (guix least-authority) #:use-module (gnu services) #:use-module (gnu services shepherd) #:use-module (gnu system shadow) #:use-module ((gnu packages admin) #:select (shadow)) #:use-module (gnu packages dico) #:use-module (gnu packages dictionaries) + #:autoload (gnu build linux-container) (%namespaces) + #:autoload (gnu system file-systems) (file-system-mapping) #:use-module (srfi srfi-1) #:use-module (srfi srfi-26) #:use-module (ice-9 match) @@ -142,27 +145,31 @@ (define %dicod-activation (chown rundir (passwd:uid user) (passwd:gid user))))) (define (dicod-shepherd-service config) - (let ((dicod (file-append (dicod-configuration-dico config) - "/bin/dicod")) - (dicod.conf (dicod-configuration-file config))) - (with-imported-modules (source-module-closure - '((gnu build shepherd) - (gnu system file-systems))) - (list (shepherd-service - (provision '(dicod)) - (requirement '(user-processes)) - (documentation "Run the dicod daemon.") - (modules '((gnu build shepherd) - (gnu system file-systems))) - (start #~(make-forkexec-constructor/container - (list #$dicod "--foreground" - (string-append "--config=" #$dicod.conf)) - #:user "dicod" #:group "dicod" - #:mappings (list (file-system-mapping - (source "/var/run/dicod") - (target source) - (writable? #t))))) - (stop #~(make-kill-destructor))))))) + (let* ((dicod.conf (dicod-configuration-file config)) + (dicod (least-authority-wrapper + (file-append (dicod-configuration-dico config) + "/bin/dicod") + #:name "dicod" + #:mappings (list (file-system-mapping + (source "/var/run/dicod") + (target source) + (writable? #t)) + (file-system-mapping + (source "/dev/log") + (target source)) + (file-system-mapping + (source dicod.conf) + (target source))) + #:namespaces (delq 'net %namespaces)))) + (list (shepherd-service + (provision '(dicod)) + (requirement '(user-processes)) + (documentation "Run the dicod daemon.") + (start #~(make-forkexec-constructor + (list #$dicod "--foreground" + (string-append "--config=" #$dicod.conf)) + #:user "dicod" #:group "dicod")) + (stop #~(make-kill-destructor)))))) (define dicod-service-type (service-type -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 07/12] services: bitlbee: Use 'make-inetd-constructor'. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 17 Apr 2022 21:06:04 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.16502295577986 (code B ref 54997); Sun, 17 Apr 2022 21:06:04 +0000 Received: (at 54997) by debbugs.gnu.org; 17 Apr 2022 21:05:57 +0000 Received: from localhost ([127.0.0.1]:37426 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5l-00024d-C4 for submit@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:57 -0400 Received: from eggs.gnu.org ([209.51.188.92]:39476) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5a-00022W-LM for 54997@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:48 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:58438) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngC5V-0000W0-GF; Sun, 17 Apr 2022 17:05:41 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=hqz/X8pTaIpKmynCFVw6ehRqbeudnNNz6KcSmFlF8kU=; b=oMFApLoR2pG10Qb7FTUu Yg0Y47XCAWtgAJ6T/HcIVLsvax/T94dNCciZd9+5l6HPFeA92+RpmYgaGTe31yS9sH1JRW8+6zTan XakUxrfC18407Kma54YpdyP3aSJTJxZKXmhTFg28eKd6b4Eiazsp+OIf8DmLz8TbbpugD0lhSKd1p zfz4bsKPxwhVGK1tRGWb78KYnI9J8jAZaawtfJc2By73FGyJCfJomVzl3q5OISnl4HuIXRnPyx1aH F5ut0O449ovli8fyY5s7KGI+1TSGNtAZIAFu1+Zmt8bYQeo/Z83RagpeBl05Qga8Uv0fs0JCrjNRy UXDOttZgyVPOvg==; Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38870 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ngC5V-000268-3t; Sun, 17 Apr 2022 17:05:41 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Sun, 17 Apr 2022 23:04:48 +0200 Message-Id: <20220417210453.27884-7-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220417210453.27884-1-ludo@gnu.org> References: <20220417210453.27884-1-ludo@gnu.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/messaging.scm (bitlbee-shepherd-service): Add call to 'least-authority-wrapper'. In 'start' method, use 'make-inetd-constructor' when available. * gnu/tests/messaging.scm (run-bitlbee-test)["valid PID"]: Remove test. --- gnu/services/messaging.scm | 63 ++++++++++++++++++++++++++++---------- gnu/tests/messaging.scm | 21 +------------ 2 files changed, 48 insertions(+), 36 deletions(-) diff --git a/gnu/services/messaging.scm b/gnu/services/messaging.scm index 4bceb1d37a..7fdd8cf285 100644 --- a/gnu/services/messaging.scm +++ b/gnu/services/messaging.scm @@ -1,7 +1,7 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2017, 2018 Clément Lassieur ;;; Copyright © 2017 Mathieu Othacehe -;;; Copyright © 2015, 2017, 2018, 2019, 2020 Ludovic Courtès +;;; Copyright © 2015, 2017-2020, 2022 Ludovic Courtès ;;; Copyright © 2018 Pierre-Antoine Rouby ;;; ;;; This file is part of GNU Guix. @@ -28,11 +28,14 @@ (define-module (gnu services messaging) #:use-module (gnu services shepherd) #:use-module (gnu services configuration) #:use-module (gnu system shadow) + #:autoload (gnu build linux-container) (%namespaces) + #:use-module ((gnu system file-systems) #:select (file-system-mapping)) #:use-module (guix gexp) #:use-module (guix modules) #:use-module (guix records) #:use-module (guix packages) #:use-module (guix deprecation) + #:use-module (guix least-authority) #:use-module (srfi srfi-1) #:use-module (srfi srfi-35) #:use-module (ice-9 match) @@ -821,7 +824,18 @@ (define bitlbee-shepherd-service DaemonInterface = " interface " DaemonPort = " (number->string port) " PluginDir = " plugins "/lib/bitlbee -" extra-settings))) +" extra-settings)) + (bitlbee* (least-authority-wrapper + (file-append bitlbee "/sbin/bitlbee") + #:name "bitlbee" + #:mappings (list (file-system-mapping + (source "/var/lib/bitlbee") + (target source) + (writable? #t)) + (file-system-mapping + (source conf) + (target conf))) + #:namespaces (delq 'net %namespaces)))) (with-imported-modules (source-module-closure '((gnu build shepherd) @@ -836,20 +850,37 @@ (define bitlbee-shepherd-service (modules '((gnu build shepherd) (gnu system file-systems))) - (start #~(make-forkexec-constructor/container - (list #$(file-append bitlbee "/sbin/bitlbee") - "-n" "-F" "-u" "bitlbee" "-c" #$conf) - - ;; Allow 'bitlbee-purple' to use libpurple plugins. - #:environment-variables - (list (string-append "PURPLE_PLUGIN_PATH=" - #$plugins "/lib/purple-2")) - - #:pid-file "/var/run/bitlbee.pid" - #:mappings (list (file-system-mapping - (source "/var/lib/bitlbee") - (target source) - (writable? #t))))) + (start #~(if (defined? 'make-inetd-constructor) + + (make-inetd-constructor + (list #$bitlbee* "-I" + "-u" "bitlbee" "-c" #$conf) + (addrinfo:addr + (car (getaddrinfo #$interface + #$(number->string port) + (logior AI_NUMERICHOST + AI_NUMERICSERV)))) + #:service-name-stem "bitlbee" + + ;; Allow 'bitlbee-purple' to use libpurple plugins. + #:environment-variables + (list (string-append "PURPLE_PLUGIN_PATH=" + #$plugins "/lib/purple-2"))) + + (make-forkexec-constructor/container + (list #$(file-append bitlbee "/sbin/bitlbee") + "-n" "-F" "-u" "bitlbee" "-c" #$conf) + + ;; Allow 'bitlbee-purple' to use libpurple plugins. + #:environment-variables + (list (string-append "PURPLE_PLUGIN_PATH=" + #$plugins "/lib/purple-2")) + + #:pid-file "/var/run/bitlbee.pid" + #:mappings (list (file-system-mapping + (source "/var/lib/bitlbee") + (target source) + (writable? #t)))))) (stop #~(make-kill-destructor))))))))) (define %bitlbee-accounts diff --git a/gnu/tests/messaging.scm b/gnu/tests/messaging.scm index 202a1c2f73..1e26c0ddea 100644 --- a/gnu/tests/messaging.scm +++ b/gnu/tests/messaging.scm @@ -1,6 +1,6 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2017, 2018 Clément Lassieur -;;; Copyright © 2017, 2018, 2021 Ludovic Courtès +;;; Copyright © 2017-2018, 2021-2022 Ludovic Courtès ;;; Copyright © 2018 Efraim Flashner ;;; ;;; This file is part of GNU Guix. @@ -198,25 +198,6 @@ (define marionette (start-service 'bitlbee)) marionette)) - (test-equal "valid PID" - #$(file-append bitlbee "/sbin/bitlbee") - (marionette-eval - '(begin - (use-modules (srfi srfi-1) - (gnu services herd)) - - (let ((bitlbee - (find (lambda (service) - (equal? '(bitlbee) - (live-service-provision service))) - (current-services)))) - (and (pk 'bitlbee-service bitlbee) - (let ((pid (live-service-running bitlbee))) - (readlink (string-append "/proc/" - (number->string pid) - "/exe")))))) - marionette)) - (test-assert "connect" (let* ((address (make-socket-address AF_INET INADDR_LOOPBACK 6667)) -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 08/12] services: ipfs: Adjust for Shepherd 0.9. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 17 Apr 2022 21:06:04 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.16502295587993 (code B ref 54997); Sun, 17 Apr 2022 21:06:04 +0000 Received: (at 54997) by debbugs.gnu.org; 17 Apr 2022 21:05:58 +0000 Received: from localhost ([127.0.0.1]:37428 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5l-00024l-Qe for submit@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:58 -0400 Received: from eggs.gnu.org ([209.51.188.92]:39480) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5b-00022Y-Oj for 54997@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:48 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:58440) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngC5W-0000WA-2u; Sun, 17 Apr 2022 17:05:42 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=0pgjMwjdOy4O50Emcy/6rmMMZOHshbrFdP+RNSSj450=; b=NAyKD2hz8QqmjIzpOd4Q 9qt/haZ2S2AvWaXLHSknwIYgY/Z1A5LocSz27efCnVIThvXnsi9JCk0Rv+5x9OoDdai/bqEJcPpNK EUS/8vTaJW8Hhc/ao0aU6DaCIDEzdq9qHJJVVxDiZ57ju5RLGbjAzvEwdVjPi3VAJuCuzcO9ntYWK gbD20DmXyRl+E4ubmqGd2EJK2YaSOH2sbPQypK3fv1x9yWzUDUSlRWwfFk0DubBtGuyV1jpHhL7BJ +Y9OmTwv/NiAWPlawIOqrjT/TJFDoMl8/nbnC4cZWLj6pQH+jAN6dDoKbm75iytiyxjuywec1xn1j DmKA1g6t0IM3hw==; Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38870 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ngC5V-000268-N0; Sun, 17 Apr 2022 17:05:41 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Sun, 17 Apr 2022 23:04:49 +0200 Message-Id: <20220417210453.27884-8-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220417210453.27884-1-ludo@gnu.org> References: <20220417210453.27884-1-ludo@gnu.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) This is a followup to e1f0c88ea221d846b5a533c4dc88e99e953af63e. * gnu/services/networking.scm (%ipfs-activation)[shepherd&co]: New variable. [container-gexp]: Use it. --- gnu/services/networking.scm | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm index 5bb8638930..b302be5aaf 100644 --- a/gnu/services/networking.scm +++ b/gnu/services/networking.scm @@ -2074,12 +2074,19 @@ (define inner-gexp #$@(map (cute apply set-config!-gexp <>) settings))) (define inner-script (program-file "ipfs-activation-inner" inner-gexp)) + + (define shepherd&co + ;; 'make-forkexec-constructor/container' needs version 0.9 for + ;; #:supplementary-groups. + (cons shepherd-0.9 + (list (lookup-package-input shepherd-0.9 "guile-fibers")))) + ;; Run ipfs init and ipfs config from a container, ;; in case the IPFS daemon was compromised at some point ;; and ~/.ipfs is now a symlink to somewhere outside ;; %ipfs-home. (define container-gexp - (with-extensions (list shepherd) + (with-extensions shepherd&co (with-imported-modules (source-module-closure '((gnu build shepherd) (gnu system file-systems))) -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 10/12] services: wesnothd: Grant write access to /var/run/wesnothd. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 17 Apr 2022 21:06:05 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.16502295588000 (code B ref 54997); Sun, 17 Apr 2022 21:06:05 +0000 Received: (at 54997) by debbugs.gnu.org; 17 Apr 2022 21:05:58 +0000 Received: from localhost ([127.0.0.1]:37430 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5m-00024s-4O for submit@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:58 -0400 Received: from eggs.gnu.org ([209.51.188.92]:39488) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5c-00022c-El for 54997@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:49 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:58444) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngC5X-0000WQ-9F; Sun, 17 Apr 2022 17:05:43 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=lhnIdYueYMKsP0FP9RoKNHZvyfi11Q1eoeAAtVW/754=; b=JIOLPXDCZdDZkN5eAO1j oXDYPVpngMXf2vwANhx1tWBSSzGaGu2zelvayhHJ9dWRlnPxJ1x+kHqF7WwON7TjamPkPto7/nOOk sqbL0X7Z3P1/IraRdq+guPm0ZU5WVXhknMC5pK8TqsbZNHoULo9P7LmNE2ibmo58oS6hnjr4fa5Kw LsogkNkYgvJOk+hRKxdgoxQHJeqX4t/poyz7wjFpihBMGc4ikLUPrPNOCm8jjxBzP+D3LkZQlW8xN NkZebNdjo27Dfc7HOA/0YICIG6dj4GwGwH+YOhWZU0SKJWxPU9C+mrCQurda6R6j3IAxxBwBzYt33 uDoypE7JP8ViRQ==; Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38870 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ngC5W-000268-T2; Sun, 17 Apr 2022 17:05:43 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Sun, 17 Apr 2022 23:04:51 +0200 Message-Id: <20220417210453.27884-10-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220417210453.27884-1-ludo@gnu.org> References: <20220417210453.27884-1-ludo@gnu.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/games.scm (wesnothd-shepherd-service): Augment 'modules' field. Pass #:mappings argument to 'make-forkexec-constructor/container'. (wesnothd-activation): New variable. (wesnothd-service-type): Extend ACTIVATION-SERVICE-TYPE. --- gnu/services/games.scm | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/gnu/services/games.scm b/gnu/services/games.scm index b743f6a4b6..dc0bfbe9dc 100644 --- a/gnu/services/games.scm +++ b/gnu/services/games.scm @@ -1,5 +1,6 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2018 Arun Isaac +;;; Copyright © 2022 Ludovic Courtès ;;; ;;; This file is part of GNU Guix. ;;; @@ -57,18 +58,35 @@ (define wesnothd-shepherd-service (match-lambda (($ package port) (with-imported-modules (source-module-closure - '((gnu build shepherd))) + '((gnu build shepherd) + (gnu system file-systems))) (shepherd-service (documentation "The Battle for Wesnoth server") (provision '(wesnoth-daemon)) (requirement '(networking)) - (modules '((gnu build shepherd))) + (modules '((gnu build shepherd) + (gnu system file-systems))) (start #~(make-forkexec-constructor/container (list #$(file-append package "/bin/wesnothd") "-p" #$(number->string port)) + #:mappings (list (file-system-mapping + (source "/var/run/wesnothd") + (target source) + (writable? #t))) #:user "wesnothd" #:group "wesnothd")) (stop #~(make-kill-destructor))))))) +(define wesnothd-activation + (with-imported-modules '((guix build utils)) + #~(begin + (use-modules (guix build utils)) + + (let* ((user (getpw "wesnothd")) + (directory "/var/run/wesnothd")) + ;; wesnothd creates a Unix-domain socket in DIRECTORY. + (mkdir-p directory) + (chown directory (passwd:uid user) (passwd:gid user)))))) + (define wesnothd-service-type (service-type (name 'wesnothd) @@ -77,6 +95,8 @@ (define wesnothd-service-type (extensions (list (service-extension account-service-type (const %wesnothd-accounts)) + (service-extension activation-service-type + (const wesnothd-activation)) (service-extension shepherd-root-service-type (compose list wesnothd-shepherd-service)))) (default-value (wesnothd-configuration)))) -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 11/12] services: wesnothd: Use 'least-authority-wrapper'. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 17 Apr 2022 21:06:05 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.16502295598015 (code B ref 54997); Sun, 17 Apr 2022 21:06:05 +0000 Received: (at 54997) by debbugs.gnu.org; 17 Apr 2022 21:05:59 +0000 Received: from localhost ([127.0.0.1]:37434 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5m-000256-Qb for submit@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:59 -0400 Received: from eggs.gnu.org ([209.51.188.92]:39496) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5d-00022d-0q for 54997@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:50 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:58446) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngC5X-0000Wa-S9; Sun, 17 Apr 2022 17:05:43 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=Fs0Td2FhdDbA9Zx7+m4bcoGIq+I66Pyd3wX+b3zcZ+U=; b=Zxiy7ny65kDPR3uo1MJY 1is8khz9xxQxFXMw7kOJzMDd/R1HmbXLI69p931Qb8d4I8kp2NejPCcb4r75+U83J6hxH2W2of/li erR3IveDxkYRTQcLe1QhakR2IjPcCPSsWJBzFt8K8SWsQ9IR4CCrhCSpc6+IL9Qs1OVeFduBQk6Mi CED5xKcg7+QXBgwR2gQDf3NJoXBQN3oeZLuwumm0o/S+DLG6i+DxJMqIHD8F+mYXpIgPE03JpHTpl 7Ct7schbd/Vzpg8RrzZGfOoW3JggL12PY2n+QJ7qysCK2nHU7eVz8Ph62166LyqZn6ascytaw6EgY 2PYmWLNH+6mZjA==; Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38870 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ngC5X-000268-Fk; Sun, 17 Apr 2022 17:05:43 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Sun, 17 Apr 2022 23:04:52 +0200 Message-Id: <20220417210453.27884-11-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220417210453.27884-1-ludo@gnu.org> References: <20220417210453.27884-1-ludo@gnu.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/games.scm (wesnothd-shepherd-service): Use 'least-authority-wrapper' instead of 'make-forkexec-constructor/container'. --- gnu/services/games.scm | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/gnu/services/games.scm b/gnu/services/games.scm index dc0bfbe9dc..6c2af44b49 100644 --- a/gnu/services/games.scm +++ b/gnu/services/games.scm @@ -23,6 +23,9 @@ (define-module (gnu services games) #:use-module (gnu packages admin) #:use-module (gnu packages games) #:use-module (gnu system shadow) + #:use-module ((gnu system file-systems) #:select (file-system-mapping)) + #:use-module (gnu build linux-container) + #:autoload (guix least-authority) (least-authority-wrapper) #:use-module (guix gexp) #:use-module (guix modules) #:use-module (guix records) @@ -57,22 +60,20 @@ (define %wesnothd-accounts (define wesnothd-shepherd-service (match-lambda (($ package port) - (with-imported-modules (source-module-closure - '((gnu build shepherd) - (gnu system file-systems))) + (let ((wesnothd (least-authority-wrapper + (file-append package "/bin/wesnothd") + #:name "wesnothd" + #:mappings (list (file-system-mapping + (source "/var/run/wesnothd") + (target source) + (writable? #t))) + #:namespaces (delq 'net %namespaces)))) (shepherd-service (documentation "The Battle for Wesnoth server") (provision '(wesnoth-daemon)) (requirement '(networking)) - (modules '((gnu build shepherd) - (gnu system file-systems))) - (start #~(make-forkexec-constructor/container - (list #$(file-append package "/bin/wesnothd") - "-p" #$(number->string port)) - #:mappings (list (file-system-mapping - (source "/var/run/wesnothd") - (target source) - (writable? #t))) + (start #~(make-forkexec-constructor + (list #$wesnothd "-p" #$(number->string port)) #:user "wesnothd" #:group "wesnothd")) (stop #~(make-kill-destructor))))))) -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 09/12] services: ipfs: Use 'least-authority-wrapper'. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 17 Apr 2022 21:06:05 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.16502295598022 (code B ref 54997); Sun, 17 Apr 2022 21:06:05 +0000 Received: (at 54997) by debbugs.gnu.org; 17 Apr 2022 21:05:59 +0000 Received: from localhost ([127.0.0.1]:37436 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5n-00025E-64 for submit@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:59 -0400 Received: from eggs.gnu.org ([209.51.188.92]:39484) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5b-00022Z-RY for 54997@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:50 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:58442) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngC5W-0000WB-Me; Sun, 17 Apr 2022 17:05:42 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=KxaDcRI/s/OmdSnaAoayJmj06Soqk6ikskfeRXujx90=; b=relhP20yC46mTm32Bo1r hzBxrmyWxvzCh0fY4537Ccy+ozZNKN9ZFVL1oDT5wu1nupg1aQ+sIPh8/0FgyKwTAiRpfVNK+wkAH 5uqrqUG1bs588BLLFU3c8D7S/eVkYSGrH9AIBwO7PJvsYIaB8sUhgo8jc5qRSzdLh4W+aT19XVG2U dA+DF7tbumQFyZHw+ae1jSCUKJZLe5/fK0h6SoY02slDterTjwl9/sYGwhiHQ5F3fwh63a1V8usiX UwlTFi6DZfgr8miljNks8ys1s4mF7DGPwmcTxh0HycsGTYa6gyxrLLst1eppoqRsHE0PGPYXnOjLi tG8rA1Rlw1V1Aw==; Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38870 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ngC5W-000268-9z; Sun, 17 Apr 2022 17:05:42 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Sun, 17 Apr 2022 23:04:50 +0200 Message-Id: <20220417210453.27884-9-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220417210453.27884-1-ludo@gnu.org> References: <20220417210453.27884-1-ludo@gnu.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/networking.scm (ipfs-binary): Call 'least-authority-wrapper'. (%ipfs-home-mapping): Remove surrounding gexp. (ipfs-shepherd-service)[exec-command]: New procedure. [ipfs-config-command, set-config!-gexp, shepherd&co] [container-gexp, container-script]: Remove. [inner-gexp]: Use 'exec-command'. --- gnu/services/networking.scm | 123 +++++++++++++++++------------------- 1 file changed, 58 insertions(+), 65 deletions(-) diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm index b302be5aaf..4708ade0ca 100644 --- a/gnu/services/networking.scm +++ b/gnu/services/networking.scm @@ -1,5 +1,5 @@ ;;; GNU Guix --- Functional package management for GNU -;;; Copyright © 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021 Ludovic Courtès +;;; Copyright © 2013-2022 Ludovic Courtès ;;; Copyright © 2015 Mark H Weaver ;;; Copyright © 2016, 2018, 2020 Efraim Flashner ;;; Copyright © 2016 John Darrington @@ -43,6 +43,7 @@ (define-module (gnu services networking) #:use-module (gnu services dbus) #:use-module (gnu system shadow) #:use-module (gnu system pam) + #:use-module ((gnu system file-systems) #:select (file-system-mapping)) #:use-module (gnu packages admin) #:use-module (gnu packages base) #:use-module (gnu packages bash) @@ -59,6 +60,7 @@ (define-module (gnu services networking) #:use-module (gnu packages gnome) #:use-module (gnu packages ipfs) #:use-module (gnu build linux-container) + #:autoload (guix least-authority) (least-authority-wrapper) #:use-module (guix gexp) #:use-module (guix records) #:use-module (guix modules) @@ -2018,13 +2020,20 @@ (define %ipfs-accounts (system? #t)))) (define (ipfs-binary config) - (file-append (ipfs-configuration-package config) "/bin/ipfs")) + (define command + (file-append (ipfs-configuration-package config) "/bin/ipfs")) + + (least-authority-wrapper + command + #:name "ipfs" + #:mappings (list %ipfs-home-mapping) + #:namespaces (delq 'net %namespaces))) (define %ipfs-home-mapping - #~(file-system-mapping - (source #$%ipfs-home) - (target #$%ipfs-home) - (writable? #t))) + (file-system-mapping + (source %ipfs-home) + (target %ipfs-home) + (writable? #t))) (define %ipfs-environment #~(list #$(string-append "HOME=" %ipfs-home))) @@ -2033,82 +2042,66 @@ (define (ipfs-shepherd-service config) "Return a for IPFS with CONFIG." (define ipfs-daemon-command #~(list #$(ipfs-binary config) "daemon")) - (list - (with-imported-modules (source-module-closure - '((gnu build shepherd) - (gnu system file-systems))) - (shepherd-service - (provision '(ipfs)) - ;; While IPFS is most useful when the machine is connected - ;; to the network, only loopback is required for starting - ;; the service. - (requirement '(loopback)) - (documentation "Connect to the IPFS network") - (modules '((gnu build shepherd) - (gnu system file-systems))) - (start #~(make-forkexec-constructor/container - #$ipfs-daemon-command - #:namespaces '#$(fold delq %namespaces '(user net)) - #:mappings (list #$%ipfs-home-mapping) - #:log-file "/var/log/ipfs.log" - #:user "ipfs" - #:group "ipfs" - #:environment-variables #$%ipfs-environment)) - (stop #~(make-kill-destructor)))))) + + (list (shepherd-service + (provision '(ipfs)) + ;; While IPFS is most useful when the machine is connected + ;; to the network, only loopback is required for starting + ;; the service. + (requirement '(loopback)) + (documentation "Connect to the IPFS network") + (start #~(make-forkexec-constructor + #$ipfs-daemon-command + #:log-file "/var/log/ipfs.log" + #:user "ipfs" #:group "ipfs" + #:environment-variables #$%ipfs-environment)) + (stop #~(make-kill-destructor))))) (define (%ipfs-activation config) "Return an activation gexp for IPFS with CONFIG" - (define (ipfs-config-command setting value) - #~(#$(ipfs-binary config) "config" #$setting #$value)) - (define (set-config!-gexp setting value) - #~(system* #$@(ipfs-config-command setting value))) + (define (exec-command . args) + ;; Exec the given ifps command with the right authority. + #~(let ((pid (primitive-fork))) + (if (zero? pid) + (dynamic-wind + (const #t) + (lambda () + ;; Run ipfs init and ipfs config from a container, + ;; in case the IPFS daemon was compromised at some point + ;; and ~/.ipfs is now a symlink to somewhere outside + ;; %ipfs-home. + (let ((pw (getpwnam "ipfs"))) + (setgroups '#()) + (setgid (passwd:gid pw)) + (setuid (passwd:uid pw)) + (environ #$%ipfs-environment) + (execl #$(ipfs-binary config) #$@args))) + (lambda () + (primitive-exit 127))) + (waitpid pid)))) + (define settings `(("Addresses.API" ,(ipfs-configuration-api config)) ("Addresses.Gateway" ,(ipfs-configuration-gateway config)))) + (define inner-gexp #~(begin (umask #o077) ;; Create $HOME/.ipfs structure - (system* #$(ipfs-binary config) "init") + #$(exec-command "ipfs" "init") ;; Apply settings - #$@(map (cute apply set-config!-gexp <>) settings))) + #$@(map (match-lambda + ((setting value) + (exec-command "ipfs" "config" setting value))) + settings))) + (define inner-script (program-file "ipfs-activation-inner" inner-gexp)) - (define shepherd&co - ;; 'make-forkexec-constructor/container' needs version 0.9 for - ;; #:supplementary-groups. - (cons shepherd-0.9 - (list (lookup-package-input shepherd-0.9 "guile-fibers")))) - - ;; Run ipfs init and ipfs config from a container, - ;; in case the IPFS daemon was compromised at some point - ;; and ~/.ipfs is now a symlink to somewhere outside - ;; %ipfs-home. - (define container-gexp - (with-extensions shepherd&co - (with-imported-modules (source-module-closure - '((gnu build shepherd) - (gnu system file-systems))) - #~(begin - (use-modules (gnu build shepherd) - (gnu system file-systems)) - (let* ((constructor - (make-forkexec-constructor/container - (list #$inner-script) - #:namespaces '#$(fold delq %namespaces '(user)) - #:mappings (list #$%ipfs-home-mapping) - #:user "ipfs" - #:group "ipfs" - #:environment-variables #$%ipfs-environment)) - (pid (constructor))) - (waitpid pid)))))) ;; The activation may happen from the initrd, which uses ;; a statically-linked guile, while the guix container ;; procedures require a working dynamic-link. - (define container-script - (program-file "ipfs-activation-container" container-gexp)) - #~(system* #$container-script)) + #~(system* #$inner-script)) (define ipfs-service-type (service-type -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 12/12] services: quassel: Use 'least-authority-wrapper'. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 17 Apr 2022 21:06:06 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.16502295608029 (code B ref 54997); Sun, 17 Apr 2022 21:06:06 +0000 Received: (at 54997) by debbugs.gnu.org; 17 Apr 2022 21:06:00 +0000 Received: from localhost ([127.0.0.1]:37438 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5n-00025L-P7 for submit@debbugs.gnu.org; Sun, 17 Apr 2022 17:06:00 -0400 Received: from eggs.gnu.org ([209.51.188.92]:39506) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC5d-00022g-KA for 54997@debbugs.gnu.org; Sun, 17 Apr 2022 17:05:50 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:58448) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngC5Y-0000Wi-EW; Sun, 17 Apr 2022 17:05:44 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=3JvzXej9xh9iqV8fsnLduF9DnXG51SXcve0a7fRlY0U=; b=kJTPUmXGQfA/lMRs3JGx fKkn4nbbyBxAJP50lBLakQxrwcvjvfPG5Celi1p/aVm6sCTQG0N6w3mGs28frfyEEA4m7va51QImI MxMkVw3QeuAvoL15EaNeurv2VDNeIQiRu/DiCe+HsOVYzFQHfxUOu6BqQ+MmuLL6DhwGUH23XtZYk xpSt1QP6aRw8pgNoCXLAOrxkm0uQdPQ7dD3cCkU1TG2lDPLzwI8fjBGnPXPtCSjD/GMUgx+REyzTx Bz+iFA6BKqYRk0GahtvO87eS2syncxeHVJZ1Hy0DudYsuME54ykdaeVtOkDz+V1tDj9IMrNaxSBsD V+Vlm4QAkXC3GQ==; Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38870 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ngC5Y-000268-2P; Sun, 17 Apr 2022 17:05:44 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Sun, 17 Apr 2022 23:04:53 +0200 Message-Id: <20220417210453.27884-12-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220417210453.27884-1-ludo@gnu.org> References: <20220417210453.27884-1-ludo@gnu.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/messaging.scm (quassel-shepherd-service): Use 'least-authority-wrapper' instead of 'make-forkexec-constructor/container'. --- gnu/services/messaging.scm | 42 ++++++++++++++++++++------------------ 1 file changed, 22 insertions(+), 20 deletions(-) diff --git a/gnu/services/messaging.scm b/gnu/services/messaging.scm index 7fdd8cf285..05bf6e784b 100644 --- a/gnu/services/messaging.scm +++ b/gnu/services/messaging.scm @@ -939,29 +939,31 @@ (define-record-type* (define quassel-shepherd-service (match-lambda (($ quassel interface port loglevel) - (with-imported-modules (source-module-closure - '((gnu build shepherd) - (gnu system file-systems))) + (let ((quassel (least-authority-wrapper + (file-append quassel "/bin/quasselcore") + #:name "quasselcore" + #:mappings (list (file-system-mapping + (source "/var/lib/quassel") + (target source) + (writable? #t)) + (file-system-mapping + (source "/var/log/quassel") + (target source) + (writable? #t))) + ;; XXX: The daemon needs to live in the main user + ;; namespace, as root, so it can access /var/lib/quassel + ;; owned by "quasselcore". + #:namespaces (fold delq %namespaces '(net user))))) (list (shepherd-service (provision '(quassel)) (requirement '(user-processes networking)) - (modules '((gnu build shepherd) - (gnu system file-systems))) - (start #~(make-forkexec-constructor/container - (list #$(file-append quassel "/bin/quasselcore") - "--configdir=/var/lib/quassel" - "--logfile=/var/log/quassel/core.log" - (string-append "--loglevel=" #$loglevel) - (string-append "--port=" (number->string #$port)) - (string-append "--listen=" #$interface)) - #:mappings (list (file-system-mapping - (source "/var/lib/quassel") - (target source) - (writable? #t)) - (file-system-mapping - (source "/var/log/quassel") - (target source) - (writable? #t))))) + (start #~(make-forkexec-constructor + (list #$quassel + "--configdir=/var/lib/quassel" + "--logfile=/var/log/quassel/core.log" + (string-append "--loglevel=" #$loglevel) + (string-append "--port=" (number->string #$port)) + (string-append "--listen=" #$interface)))) (stop #~(make-kill-destructor)))))))) (define %quassel-account -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 09/12] services: ipfs: Use 'least-authority-wrapper'. Resent-From: Maxime Devos Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Mon, 18 Apr 2022 09:09:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Ludovic =?UTF-8?Q?Court=C3=A8s?= , 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165027289212386 (code B ref 54997); Mon, 18 Apr 2022 09:09:02 +0000 Received: (at 54997) by debbugs.gnu.org; 18 Apr 2022 09:08:12 +0000 Received: from localhost ([127.0.0.1]:37955 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngNMh-0003Di-U5 for submit@debbugs.gnu.org; Mon, 18 Apr 2022 05:08:12 -0400 Received: from albert.telenet-ops.be ([195.130.137.90]:44854) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngNMf-0003DS-M7 for 54997@debbugs.gnu.org; Mon, 18 Apr 2022 05:08:10 -0400 Received: from ptr-bvsjgyhxw7psv60dyze.18120a2.ip6.access.telenet.be ([IPv6:2a02:1811:8c09:9d00:3c5f:2eff:feb0:ba5a]) by albert.telenet-ops.be with bizsmtp id L9872700N4UW6Th06987CP; Mon, 18 Apr 2022 11:08:07 +0200 Message-ID: <4eac7fd571ddafd46bcadfa2ef5c6b3e41a162ab.camel@telenet.be> From: Maxime Devos Date: Mon, 18 Apr 2022 11:08:02 +0200 In-Reply-To: <20220417210453.27884-9-ludo@gnu.org> References: <20220417210453.27884-1-ludo@gnu.org> <20220417210453.27884-9-ludo@gnu.org> Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-fdJc32RJnBTAjvBynDkw" User-Agent: Evolution 3.38.3-1 MIME-Version: 1.0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telenet.be; s=r22; t=1650272888; bh=Uu6qMmTFWD4NT/PmY8CQdTMPIHsBrQL7ewShocJXefU=; h=Subject:From:To:Date:In-Reply-To:References; b=NVGGr9XsMAI+P/GKDyGmTbnQCqyvzyTnDvzOiRkXGMldqABdHEdF/tIb+9tdMCA86 KYgqXSRWFjCrlqUgG9gtv5rggtYZJgdp7miCCX5yl2Xpp7YrjOyzO53UTEfPMKl/Mj KJyhj940LX6fsHbv6JZ1DL3TSmBfUv1cKc8q+9VH7nZryjQC4YWKJ1COA2GDyAsJWM /dBupYrY88SgY1/HziW6UCxw6P3fpp9QAHRL7hqDRvDtpQe7J2vCqCUJ0pAWt29sw/ YDaFbztb0rh89I6fJ5UhjGRz5vKwH71Lz+AEg7jhoUy+Z6BP54VkuMdC/JQ1U8HorV Xbgj12sakWs9A== X-Spam-Score: -0.0 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) --=-fdJc32RJnBTAjvBynDkw Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Ludovic Court=C3=A8s schreef op zo 17-04-2022 om 23:04 [+0200]: > [...] > =C2=A0 > =C2=A0(define (ipfs-binary config) > -=C2=A0 (file-append (ipfs-configuration-package config) "/bin/ipfs")) > +=C2=A0 (define command > +=C2=A0=C2=A0=C2=A0 (file-append (ipfs-configuration-package config) "/bi= n/ipfs")) > + > +=C2=A0 (least-authority-wrapper > +=C2=A0=C2=A0 command > +=C2=A0=C2=A0 #:name "ipfs" > +=C2=A0=C2=A0 #:mappings (list %ipfs-home-mapping) > +=C2=A0=C2=A0 #:namespaces (delq 'net %namespaces))) To simplify things later, could #:user "ipfs" and #:group "ipfs" be added to the least-authority wrapper (and implemented in the 'least- authority procedre)? Then ... > + (define (exec-command . args) > + ;; Exec the given ifps command with the right authority. > + #~(let ((pid (primitive-fork))) > + (if (zero? pid) > + (dynamic-wind > + (const #t) > + (lambda () > + ;; Run ipfs init and ipfs config from a container, > + ;; in case the IPFS daemon was compromised at some point > + ;; and ~/.ipfs is now a symlink to somewhere outside > + ;; %ipfs-home. > + (let ((pw (getpwnam "ipfs"))) > + (setgroups '#()) > + (setgid (passwd:gid pw)) > + (setuid (passwd:uid pw)) > + (environ #$%ipfs-environment) > + (execl #$(ipfs-binary config) #$@args))) > + (lambda () > + (primitive-exit 127))) > + (waitpid pid)))) would become simpler as it wouldn't need to fork, exec, waitpid and dynamic-wind. Alternatively, if associating a user and group with a pola wrapper is problematic (*), what do you think of defining a 'system*/with-capabilities' or 'invoke/with-capabilities' in a central location? Greetings, Maxime. --=-fdJc32RJnBTAjvBynDkw Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- iI0EABYKADUWIQTB8z7iDFKP233XAR9J4+4iGRcl7gUCYl0qchccbWF4aW1lZGV2 b3NAdGVsZW5ldC5iZQAKCRBJ4+4iGRcl7gqKAP9bcMlihKJ4zbJ6MMt090nH9tQD AWoJHwOrti+8q7jsZQEAhHs2tQxxY2kw28WCL+GuTCgcae+z5aI0xbbe/RrpAw8= =bdj/ -----END PGP SIGNATURE----- --=-fdJc32RJnBTAjvBynDkw-- From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 12/12] services: quassel: Use 'least-authority-wrapper'. Resent-From: Maxime Devos Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Mon, 18 Apr 2022 09:13:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Ludovic =?UTF-8?Q?Court=C3=A8s?= , 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165027313412795 (code B ref 54997); Mon, 18 Apr 2022 09:13:02 +0000 Received: (at 54997) by debbugs.gnu.org; 18 Apr 2022 09:12:14 +0000 Received: from localhost ([127.0.0.1]:37971 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngNQc-0003KJ-I1 for submit@debbugs.gnu.org; Mon, 18 Apr 2022 05:12:14 -0400 Received: from albert.telenet-ops.be ([195.130.137.90]:50344) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngNQa-0003K9-Ve for 54997@debbugs.gnu.org; Mon, 18 Apr 2022 05:12:13 -0400 Received: from ptr-bvsjgyhxw7psv60dyze.18120a2.ip6.access.telenet.be ([IPv6:2a02:1811:8c09:9d00:3c5f:2eff:feb0:ba5a]) by albert.telenet-ops.be with bizsmtp id L9CC270014UW6Th069CC3U; Mon, 18 Apr 2022 11:12:12 +0200 Message-ID: From: Maxime Devos Date: Mon, 18 Apr 2022 11:12:11 +0200 In-Reply-To: <20220417210453.27884-12-ludo@gnu.org> References: <20220417210453.27884-1-ludo@gnu.org> <20220417210453.27884-12-ludo@gnu.org> Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-9Oa709g4ZSL/cqQPtRgV" User-Agent: Evolution 3.38.3-1 MIME-Version: 1.0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telenet.be; s=r22; t=1650273132; bh=X+XbU2HZYPCaAJFwp3lmqLKhVvi9TeLM/l0njkKNSgM=; h=Subject:From:To:Date:In-Reply-To:References; b=RhfKGQbEOQy8vgDupKjfgMlALsXJPF3p2XUYVW/3ImmsPyM6jHOAYLVERIINtQz9q gYUo7hSUM8acAZK9jslPZJOIMPk8ZbLQ9R+fK1XPgl7HFO3nwbmBZuJnLH2JpqLg6x fTgLgoA+nww8xjvwDYB1PMorilqxZYi9oljwMmoap1TiCVCAPn3diwDOsML0ygcWuP mnIS33ATKJlc1jK0qxqI+Mrp0kF1r6LYOZhHNUG8h/vBJooIA83RprwTOizDJJ7SOH pxVoGEt21XB+cUoWtV73FqlqNCmcjv/JLGug0W32F0IZ9O3N0TGQLTYbGvpIwG6TNV aePJWuaAeE85g== X-Spam-Score: -0.0 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) --=-9Oa709g4ZSL/cqQPtRgV Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 THVkb3ZpYyBDb3VydMOocyBzY2hyZWVmIG9wIHpvIDE3LTA0LTIwMjIgb20gMjM6MDQgWyswMjAw XToKPiArwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCA7OyBYWFg6IFRo ZSBkYWVtb24gbmVlZHMgdG8gbGl2ZSBpbiB0aGUgbWFpbiB1c2VyCj4gK8KgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgOzsgbmFtZXNwYWNlLCBhcyByb290LCBzbyBpdCBj YW4gYWNjZXNzIC92YXIvbGliL3F1YXNzZWwKPiArwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoCA7OyBvd25lZCBieSAicXVhc3NlbGNvcmUiLgoKVGhlIHByZXZpb3VzIGNv ZGUgZGlkIG5vdCBoYXZlIHRoaXMgY29tbWVudCwgd2FzIHRoZSBvbGQgY29kZSBicm9rZW4gb3IK aXMgdGhpcyBhIGxpbWl0YXRpb24gb2YgbGVhc3QtYXV0aG9yaXR5LXdyYXBwZXI/CgpHcmVldGlu Z3MsCk1heGltZS4K --=-9Oa709g4ZSL/cqQPtRgV Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- iI0EABYKADUWIQTB8z7iDFKP233XAR9J4+4iGRcl7gUCYl0raxccbWF4aW1lZGV2 b3NAdGVsZW5ldC5iZQAKCRBJ4+4iGRcl7oj3AQDqlD5Uwhs+Y8i7CRnB2Q41Zaf5 q7/BgNetmN3ELCqrnQD8CXDyF7zPdStGdezD6kppGabu0qYkymQ/JKzkixnb1gg= =wXdF -----END PGP SIGNATURE----- --=-9Oa709g4ZSL/cqQPtRgV-- From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 07/12] services: bitlbee: Use 'make-inetd-constructor'. Resent-From: Maxime Devos Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Mon, 18 Apr 2022 09:15:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Ludovic =?UTF-8?Q?Court=C3=A8s?= , 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165027324512980 (code B ref 54997); Mon, 18 Apr 2022 09:15:01 +0000 Received: (at 54997) by debbugs.gnu.org; 18 Apr 2022 09:14:05 +0000 Received: from localhost ([127.0.0.1]:37976 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngNSM-0003NE-SF for submit@debbugs.gnu.org; Mon, 18 Apr 2022 05:14:05 -0400 Received: from michel.telenet-ops.be ([195.130.137.88]:43540) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngNSL-0003Mg-Fu for 54997@debbugs.gnu.org; Mon, 18 Apr 2022 05:14:01 -0400 Received: from ptr-bvsjgyhxw7psv60dyze.18120a2.ip6.access.telenet.be ([IPv6:2a02:1811:8c09:9d00:3c5f:2eff:feb0:ba5a]) by michel.telenet-ops.be with bizsmtp id L9Dz2700U4UW6Th069E0Fl; Mon, 18 Apr 2022 11:14:00 +0200 Message-ID: From: Maxime Devos Date: Mon, 18 Apr 2022 11:13:59 +0200 In-Reply-To: <20220417210453.27884-7-ludo@gnu.org> References: <20220417210453.27884-1-ludo@gnu.org> <20220417210453.27884-7-ludo@gnu.org> Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-1xx4y5G3ffqkl+CYyAPi" User-Agent: Evolution 3.38.3-1 MIME-Version: 1.0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telenet.be; s=r22; t=1650273240; bh=Ws3HcWK18kQg47q8/RpOX5eHllwUfTs9jX1eJsvgHpw=; h=Subject:From:To:Date:In-Reply-To:References; b=DBGnUPvntN1cfVvdvYWexXXqy1Pq5QojV2dHObR78IgdqhXxFF+mvmQyWwwh7APEt vJdcCxLJCdZA+6Tz7E9uxbFbHWs4x9fo3i/V/3OO3ucdSXPd7StaX8T2jwzGr8tss0 7GmfmNZE4tHO5aHELjUctrkeY2BTto51h+6bVgSX7HG8gSqYOcL+LaJSGEjcW8+QKs DhhLkVyHf7g0tr8XGT/S/8J/sAOUW4Vl+VGuLG06OKfNnix91z6AnBXAo2BsBgCpZo DcqM78V0BEDqzJ8Uq+V83YpKzSH9Lbr8iuB3oERO9RGMjBiBecB6ROKSFaeZhc38s2 jiUZYCYzwqILg== X-Spam-Score: -0.0 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) --=-1xx4y5G3ffqkl+CYyAPi Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Ludovic Court=C3=A8s schreef op zo 17-04-2022 om 23:04 [+0200]: > +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 (start #~(if (defined? 'make-inetd-constructor) This is for compatibility with reconfiguring on old Shepherds I presume? I would add a comment here ;; Only use 'make-inetd-constructor' if it exists in the current, ;; Shepherd, possibly we are reconfiguring on an old Shepherd that ;; does not yet have 'make-inetd-constructor'. Greetings, Maxime. --=-1xx4y5G3ffqkl+CYyAPi Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- iI0EABYKADUWIQTB8z7iDFKP233XAR9J4+4iGRcl7gUCYl0r1xccbWF4aW1lZGV2 b3NAdGVsZW5ldC5iZQAKCRBJ4+4iGRcl7mvnAP9eCEiQR1vY646yqYyxe3Tp771k MMQK/sn8klYSqHTdtwD9Ghyo3LI2z6eESXQVB8OqwnHrTaY9yT4cbd0CgJQs5As= =qAoD -----END PGP SIGNATURE----- --=-1xx4y5G3ffqkl+CYyAPi-- From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 04/12] Add (guix least-authority). Resent-From: Maxime Devos Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Mon, 18 Apr 2022 09:16:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Ludovic =?UTF-8?Q?Court=C3=A8s?= , 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165027335416501 (code B ref 54997); Mon, 18 Apr 2022 09:16:01 +0000 Received: (at 54997) by debbugs.gnu.org; 18 Apr 2022 09:15:54 +0000 Received: from localhost ([127.0.0.1]:37982 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngNU9-0004Hi-CL for submit@debbugs.gnu.org; Mon, 18 Apr 2022 05:15:53 -0400 Received: from albert.telenet-ops.be ([195.130.137.90]:54818) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngNU7-0004F5-BJ for 54997@debbugs.gnu.org; Mon, 18 Apr 2022 05:15:51 -0400 Received: from ptr-bvsjgyhxw7psv60dyze.18120a2.ip6.access.telenet.be ([IPv6:2a02:1811:8c09:9d00:3c5f:2eff:feb0:ba5a]) by albert.telenet-ops.be with bizsmtp id L9Fq2700C4UW6Th069FqUo; Mon, 18 Apr 2022 11:15:50 +0200 Message-ID: From: Maxime Devos Date: Mon, 18 Apr 2022 11:15:50 +0200 In-Reply-To: <20220417210453.27884-4-ludo@gnu.org> References: <20220417210453.27884-1-ludo@gnu.org> <20220417210453.27884-4-ludo@gnu.org> Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-2r719HKHCkGpPAdI0rlT" User-Agent: Evolution 3.38.3-1 MIME-Version: 1.0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telenet.be; s=r22; t=1650273350; bh=DiSYryTVwJYcDk7gEsdeC7T7YGyNrza1E8exZmesl+g=; h=Subject:From:To:Date:In-Reply-To:References; b=G9IhNxUgg4s0ZT1Q84GHTnt4tpMLA8+7rOQgBfaRPYTAn4P9vU0b0l126RE+6CRHL OWnByjAufiNLhXHnJ3BIztJ7Gh22ClX//n+vjXJKvf/GEao/4YoEHW/7qpG1m7BCib cAKhtrDKg2yRoJ9YauIs6En8E/uqEy8M5LQEFwD1gwxDpx83SlEdwFZ3HFmbymgw+3 xlQuNXJFGqjSK3WkO20IaQk82AVt2dek7gSb5Nsxk4XgYPXFilWWfJZEg7mnL5CS4+ SH55l2eeh9NsPOeuQyXiKKK47QpiXH/btz3OmKadM8df5N0MSV4b9BnUsawaT+jJTX IRrCDB+B3pIjA== X-Spam-Score: -0.0 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) --=-2r719HKHCkGpPAdI0rlT Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Ludovic Court=C3=A8s schreef op zo 17-04-2022 om 23:04 [+0200]: > +(define %precious-variables > +=C2=A0 ;; Environment variables preserved by the wrapper by default. > +=C2=A0 '("HOME" "USER" "LOGNAME" "DISPLAY" "XAUTHORITY" "TERM" "TZ" "PAG= ER")) This appears to be duplicated from (guix profiles), so there seems to be a risk here of them going out-of-sync; would it make send for (guix profiles) to read (guix least-authority) here? Greetings, Maxime. --=-2r719HKHCkGpPAdI0rlT Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- iI0EABYKADUWIQTB8z7iDFKP233XAR9J4+4iGRcl7gUCYl0sRhccbWF4aW1lZGV2 b3NAdGVsZW5ldC5iZQAKCRBJ4+4iGRcl7j8cAP9SKNouw4e5cuyIJgUn+kBOFICs FDCVAqT2prwAP+R3jQD+Kh5PrbA9Fw62XCyWgJ1qxSKFdJ3AXn1TX2ZfZOW1Hww= =hkm6 -----END PGP SIGNATURE----- --=-2r719HKHCkGpPAdI0rlT-- From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 04/12] Add (guix least-authority). Resent-From: Maxime Devos Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Mon, 18 Apr 2022 09:19:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Ludovic =?UTF-8?Q?Court=C3=A8s?= , 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165027353221833 (code B ref 54997); Mon, 18 Apr 2022 09:19:02 +0000 Received: (at 54997) by debbugs.gnu.org; 18 Apr 2022 09:18:52 +0000 Received: from localhost ([127.0.0.1]:38001 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngNX2-0005g4-0X for submit@debbugs.gnu.org; Mon, 18 Apr 2022 05:18:52 -0400 Received: from michel.telenet-ops.be ([195.130.137.88]:49848) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngNX0-0005fw-Az for 54997@debbugs.gnu.org; Mon, 18 Apr 2022 05:18:50 -0400 Received: from ptr-bvsjgyhxw7psv60dyze.18120a2.ip6.access.telenet.be ([IPv6:2a02:1811:8c09:9d00:3c5f:2eff:feb0:ba5a]) by michel.telenet-ops.be with bizsmtp id L9Jp2700D4UW6Th069JphD; Mon, 18 Apr 2022 11:18:49 +0200 Message-ID: From: Maxime Devos Date: Mon, 18 Apr 2022 11:18:49 +0200 In-Reply-To: <20220417210453.27884-4-ludo@gnu.org> References: <20220417210453.27884-1-ludo@gnu.org> <20220417210453.27884-4-ludo@gnu.org> Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-m2fqEtaZWV+8IEG5NUp8" User-Agent: Evolution 3.38.3-1 MIME-Version: 1.0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telenet.be; s=r22; t=1650273529; bh=5NHovfZKjcJxiyoN2Bc1oV/PvR/VK0WGegZbtH/WWaQ=; h=Subject:From:To:Date:In-Reply-To:References; b=WdF9SQ8yjsoJSjKzbEd6bt7D1x++P0nwAQVY7we507xBG2X5jvTnb0z2kSNmit2Ne f64qcSRUJh7OYRb7BusDVujnaSj1yzNsuO1pBO8UwdmNF8Je4JIEDrgYv3U3/Xk5Pu psPO4KxOKJxOiRLU2b921ZTfzeRXzrMKtHEVkLa+yfixckMJht1mVVfawy/8dQ/4iT lvVLvIoCmzMZwIwg6/RVgMyVqLGAAAy6ttsVaNWzn19KGQGUzfGvH2sMNALlQFZTD+ gbbBRM3R2HBk+K8T3dVQKcPR49lJg2z5aMF1D+SeOTgPseg6wltWUpbrA3vrtzCUto 5H+E8sYmKBH8w== X-Spam-Score: -0.0 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) --=-m2fqEtaZWV+8IEG5NUp8 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 THVkb3ZpYyBDb3VydMOocyBzY2hyZWVmIG9wIHpvIDE3LTA0LTIwMjIgb20gMjM6MDQgWyswMjAw XToKPiArKGRlZmluZSogKGxlYXN0LWF1dGhvcml0eS13cmFwcGVyIHByb2dyYW0KPiArwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgICM6a2V5IChuYW1lICJwb2xhLXdyYXBwZXIiKQo+ICvCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgKGd1ZXN0LXVpZCAx MDAwKQo+ICvCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqAgKGd1ZXN0LWdpZCAxMDAwKQo+ICvCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgKG1hcHBpbmdz ICcoKSkKPiArwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgIChuYW1lc3BhY2VzICVuYW1lc3BhY2VzKQo+ICvCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAg KGRpcmVjdG9yeSAiLyIpCj4gK8KgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCAocHJlc2VydmVkLWVudmlyb25tZW50LXZhcmlh Ymxlcwo+ICvCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoCAlcHJlY2lvdXMtdmFyaWFibGVzKSkKCkNvdWxkIHRoZXJlIGJl IGFuIG9wdGlvbiB0byBkZWZpbmUgZW52aXJvbm1lbnQgdmFyaWFibGVzPyAgRS5nLiBzZXQKR1VJ WF9MT0NQQVRIIGZvciBHdWlsZSBwYWNrYWdlcyB0aGF0IG5lZWQgbG9jYWxlIGRhdGEgdG8gcmVh ZCBub24tQVNDSUkKZmlsZSBuYW1lcy4gIEFzIGlzLCBpdCBzZWVtcyBsaWtlIGFuIGVudmlyb25t ZW50LXNldHRpbmcgd3JhcHBlciBoYXMgdG8KYmUgaW5zZXJ0ZWQgaW5zaWRlIHRoZSBwb2xhIHdy YXBwZXIgdG8gZG8gdGhpcy4KCkdyZWV0aW5ncywKTWF4aW1lLiAK --=-m2fqEtaZWV+8IEG5NUp8 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- iI0EABYKADUWIQTB8z7iDFKP233XAR9J4+4iGRcl7gUCYl0s+RccbWF4aW1lZGV2 b3NAdGVsZW5ldC5iZQAKCRBJ4+4iGRcl7ozyAQC7WElwDoy8fLphK1vPuDjEiXnE UZMfs+qKpNvCFxtFDQD/dms9vF+wpyFA8xQdt29L3XBJYYq1tfaHE3f4ytwEGQg= =zY+o -----END PGP SIGNATURE----- --=-m2fqEtaZWV+8IEG5NUp8-- From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 00/12] Add "least authority" program wrapper Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Tue, 19 Apr 2022 22:01:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Maxime Devos Cc: 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165040560413840 (code B ref 54997); Tue, 19 Apr 2022 22:01:01 +0000 Received: (at 54997) by debbugs.gnu.org; 19 Apr 2022 22:00:04 +0000 Received: from localhost ([127.0.0.1]:44345 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngvtE-0003bA-3l for submit@debbugs.gnu.org; Tue, 19 Apr 2022 18:00:04 -0400 Received: from eggs.gnu.org ([209.51.188.92]:34170) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngvtB-0003Zs-F9 for 54997@debbugs.gnu.org; Tue, 19 Apr 2022 18:00:02 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:50082) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngvt5-0005XN-8U; Tue, 19 Apr 2022 17:59:55 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:In-Reply-To:Date:References:Subject:To: From; bh=On7j6ZTRsaejUMj3ZNWWpZG9S9TcLZRnfWwB2TLN4L8=; b=dsHU0Fy7DS8E4LNNuUCU LU4nZ7dRuBSnvRq8Eg+R98gu3mv1ubrjXoOmLF26b6JtdAMF9wV8xtrTny4/4qIIPKJtzH4p69MIa BkN/Cj6xUi12G+d/jZGXuDsR8UwG6KGwj/TIca+TMuPeb8v8q3+1xtuohI2B2UG7tR6B+CqnBE5Ua 7a5KnkSBV41WMf7e83kFc/gqpMflApDBjNTyr1JKCvrRgzQIyvnfcpnt94LXJU6/UpXDMtxO24HXo H/uWiU/WO9hHiSdna/E3updv2F/Sa90xLoLsGMwnuDWMjwzU2ofgYVz7JF7CCX+mQmcdxrtZaOwPj zcdJVXcqEP6z9g==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:63789 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngvt4-0008OY-Rh; Tue, 19 Apr 2022 17:59:55 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= References: <20220417210453.27884-1-ludo@gnu.org> <20220417210453.27884-12-ludo@gnu.org> Date: Tue, 19 Apr 2022 23:59:53 +0200 In-Reply-To: (Maxime Devos's message of "Mon, 18 Apr 2022 11:12:11 +0200") Message-ID: <878rs0raxy.fsf_-_@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Hi Maxime, Maxime Devos skribis: > Ludovic Court=C3=A8s schreef op zo 17-04-2022 om 23:04 [+0200]: >> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ;; XXX: The daemon need= s to live in the main user >> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ;; namespace, as root, = so it can access /var/lib/quassel >> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ;; owned by "quasselcor= e". > > The previous code did not have this comment, was the old code broken or > is this a limitation of least-authority-wrapper? It=E2=80=99s just that =E2=80=98make-forkexec-constructor/container=E2=80= =99 does it by default: --8<---------------cut here---------------start------------->8--- (define (default-namespaces args) ;; Most daemons are here to talk to the network, and most of them expect = to ;; run under a non-zero UID. (fold delq %namespaces '(net user))) --8<---------------cut here---------------end--------------->8--- =E2=80=98least-authority-wrapper=E2=80=99 is stricter by defaulting to =E2= =80=98%namespaces=E2=80=99. Ludo=E2=80=99. From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 00/12] Add "least authority" program wrapper Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Tue, 19 Apr 2022 22:03:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Maxime Devos Cc: 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165040575614149 (code B ref 54997); Tue, 19 Apr 2022 22:03:02 +0000 Received: (at 54997) by debbugs.gnu.org; 19 Apr 2022 22:02:36 +0000 Received: from localhost ([127.0.0.1]:44352 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngvvf-0003g9-MP for submit@debbugs.gnu.org; Tue, 19 Apr 2022 18:02:35 -0400 Received: from eggs.gnu.org ([209.51.188.92]:34590) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngvve-0003fw-1L for 54997@debbugs.gnu.org; Tue, 19 Apr 2022 18:02:34 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:50164) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngvvY-00064v-FB; Tue, 19 Apr 2022 18:02:28 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:In-Reply-To:Date:References:Subject:To: From; bh=AvZwtU8uJWDpPKX1GYzuJ+rYQ0CiMmf9k8BqZgW4yx4=; b=JP8VBNr6va5LvR1Vm32H OrjMzdXrnED83yrV+WAP49hVXg/OTv5ZvcQROmFfd6JN1OF0EGgmvChYt0zH0E0OULZxqH3xbOBOB WCepuUEdjGwpzYbYXpZXmSG349V8zthQjsjCZbpk9sIANlARdInKqH4peelQ3c8r4WEPbPdDE9zZy HHjKv4kM6r0BIuRfZ2ExufrR9k/MQBmivrQRK23qWc4BOaMSDGTo1k8YkOInpSXvzHdyJouWxNu3o l3+WqpUNkQxVclgEqSQX3BBdp+Ru6cUgB0aCi+v72rObM+wTPehDTfZ4jsZlfI8/37qVDUeiHOHBF sngctScv47zRiw==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:65127 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngvvY-0000Ih-2k; Tue, 19 Apr 2022 18:02:28 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= References: <20220417210453.27884-1-ludo@gnu.org> <20220417210453.27884-9-ludo@gnu.org> <4eac7fd571ddafd46bcadfa2ef5c6b3e41a162ab.camel@telenet.be> Date: Wed, 20 Apr 2022 00:02:26 +0200 In-Reply-To: <4eac7fd571ddafd46bcadfa2ef5c6b3e41a162ab.camel@telenet.be> (Maxime Devos's message of "Mon, 18 Apr 2022 11:08:02 +0200") Message-ID: <8735i8ratp.fsf_-_@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Maxime Devos skribis: > Ludovic Court=C3=A8s schreef op zo 17-04-2022 om 23:04 [+0200]: >> [...] >> =C2=A0 >> =C2=A0(define (ipfs-binary config) >> -=C2=A0 (file-append (ipfs-configuration-package config) "/bin/ipfs")) >> +=C2=A0 (define command >> +=C2=A0=C2=A0=C2=A0 (file-append (ipfs-configuration-package config) "/b= in/ipfs")) >> + >> +=C2=A0 (least-authority-wrapper >> +=C2=A0=C2=A0 command >> +=C2=A0=C2=A0 #:name "ipfs" >> +=C2=A0=C2=A0 #:mappings (list %ipfs-home-mapping) >> +=C2=A0=C2=A0 #:namespaces (delq 'net %namespaces))) > > To simplify things later, could #:user "ipfs" and #:group "ipfs" be > added to the least-authority wrapper (and implemented in the 'least- > authority procedre)? Then ... To me it=E2=80=99s setuid/setgid is beyond the scope of =E2=80=98least-authority-wrapper=E2=80=99. And indeed, this place is the o= nly one that needs it. > would become simpler as it wouldn't need to fork, exec, waitpid and > dynamic-wind. Alternatively, if associating a user and group with a > pola wrapper is problematic (*), what do you think of defining a > 'system*/with-capabilities' or 'invoke/with-capabilities' in a central > location? I=E2=80=99m not sure what these procedures would do. I think we should build the house one brick at a time; this is the first brick but I=E2=80=99m sure there=E2=80=99ll be others as we gain more exper= ience and clearer use cases. Ludo=E2=80=99. From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 00/12] Add "least authority" program wrapper Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Tue, 19 Apr 2022 22:04:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Maxime Devos Cc: 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165040580514240 (code B ref 54997); Tue, 19 Apr 2022 22:04:01 +0000 Received: (at 54997) by debbugs.gnu.org; 19 Apr 2022 22:03:25 +0000 Received: from localhost ([127.0.0.1]:44357 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngvwS-0003hc-WA for submit@debbugs.gnu.org; Tue, 19 Apr 2022 18:03:25 -0400 Received: from eggs.gnu.org ([209.51.188.92]:34684) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngvwR-0003hP-9R for 54997@debbugs.gnu.org; Tue, 19 Apr 2022 18:03:23 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:50190) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngvwM-00068Z-2N; Tue, 19 Apr 2022 18:03:18 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:In-Reply-To:Date:References:Subject:To: From; bh=CJ5gXqcZrZFWdZXMcYoSNWmNHO0LQO/ou8CL8k78TBU=; b=k9BxHslnlCZu92shbEtZ 5OpLgOYzlQgMhO2kLjhEGBWz2ZhaY3jC0hpNT2k4OnPIGcjSk3m17T4ptUfku7mo5VRAnUlFF6XId hvokT/sbhgE4r5AlVvXuFQUmP98IfcrRFkDjHTNInDGo/sOVHw5mSE2mvM3yojSVC/Q4lE7M+5lAg +10XD5JKv9tuqKVguA7D/26DgHykm1SkUV0AiQUIHxhAfAbT2uPApQmaApANyl6VHglRLlFapadJ8 oHCHhC3Hl2ySvASnh24i7q8DhYaPIxwVW8utYBlu7f2TcJHkHzrz+aaEz1Jd3OcJqF77w9ltlmkWN jqvHbBbVaMLUzA==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:50721 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngvwL-0002Ef-97; Tue, 19 Apr 2022 18:03:17 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= References: <20220417210453.27884-1-ludo@gnu.org> <20220417210453.27884-7-ludo@gnu.org> Date: Wed, 20 Apr 2022 00:03:16 +0200 In-Reply-To: (Maxime Devos's message of "Mon, 18 Apr 2022 11:13:59 +0200") Message-ID: <87y200pw7v.fsf_-_@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Maxime Devos skribis: > Ludovic Court=C3=A8s schreef op zo 17-04-2022 om 23:04 [+0200]: >> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0 (start #~(if (defined? 'make-inetd-constructor) > > This is for compatibility with reconfiguring on old Shepherds I > presume? Yes. > I would add a comment here > > ;; Only use 'make-inetd-constructor' if it exists in the current, > ;; Shepherd, possibly we are reconfiguring on an old Shepherd that > ;; does not yet have 'make-inetd-constructor'. Will do; probably something shorter because the same pattern occurs every time we use Shepherd 0.9 features. From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 00/12] Add "least authority" program wrapper Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Tue, 19 Apr 2022 22:05:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Maxime Devos Cc: 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165040587714354 (code B ref 54997); Tue, 19 Apr 2022 22:05:02 +0000 Received: (at 54997) by debbugs.gnu.org; 19 Apr 2022 22:04:37 +0000 Received: from localhost ([127.0.0.1]:44362 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngvxd-0003jS-9d for submit@debbugs.gnu.org; Tue, 19 Apr 2022 18:04:37 -0400 Received: from eggs.gnu.org ([209.51.188.92]:34918) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngvxb-0003jF-Cd for 54997@debbugs.gnu.org; Tue, 19 Apr 2022 18:04:35 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:50208) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngvxW-0006E7-4s; Tue, 19 Apr 2022 18:04:30 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:In-Reply-To:Date:References:Subject:To: From; bh=MZPYSxyWV0xnk6Rnl2NWZxsj3il9nXhEmnG/IkKdlzc=; b=F53qNk8YwLLptDY+dvK3 ZPMwonkPnnyFwb1sPKcbRBqpVRjRK+zZ/xbsPm2aY6X2Rg7rfHSlAajc1OMFY7CLW1MkWPnN+E4ii chL7bzg63p+w+miSTk4YwdFJGbn/CfsfZMyCKR1LuVwcQbofSC2DsRnspoAlFIpC/ZdZ4SO0SZ7rx xKw+ZohTSaPworo3+H2tJzZWJdtVi+t/sDD9tysnLiOagGJZEZd9JT815hdamtZqPtX/6A+yb+aoX l1wuSOXCk2s5wnpQ8gaSl/iSJt2qKPW9D9z2xuWvCmxHqxDH8MX6d7X+BYLkT6EFxNJnwt8fOAPDJ aDYvFPbZxXc5Ew==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:62409 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngvxV-0000pc-Of; Tue, 19 Apr 2022 18:04:29 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= References: <20220417210453.27884-1-ludo@gnu.org> <20220417210453.27884-4-ludo@gnu.org> Date: Wed, 20 Apr 2022 00:04:28 +0200 In-Reply-To: (Maxime Devos's message of "Mon, 18 Apr 2022 11:15:50 +0200") Message-ID: <87tuaopw5v.fsf_-_@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Maxime Devos skribis: > Ludovic Court=C3=A8s schreef op zo 17-04-2022 om 23:04 [+0200]: >> +(define %precious-variables >> +=C2=A0 ;; Environment variables preserved by the wrapper by default. >> +=C2=A0 '("HOME" "USER" "LOGNAME" "DISPLAY" "XAUTHORITY" "TERM" "TZ" "PA= GER")) > > This appears to be duplicated from (guix profiles), so there seems to > be a risk here of them going out-of-sync; would it make send for > (guix profiles) to read (guix least-authority) here? It is duplicated, but OTOH the use case is different. So I think it=E2=80= =99s OK to have a different definition here. (Perhaps eventually we=E2=80=99ll do something fancier, like preserving XAUTHORITY and DISPLAY if and only if we=E2=80=99re running an X11 program.) Ludo=E2=80=99. From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 00/12] Add "least authority" program wrapper Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Tue, 19 Apr 2022 22:06:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Maxime Devos Cc: 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165040596014500 (code B ref 54997); Tue, 19 Apr 2022 22:06:01 +0000 Received: (at 54997) by debbugs.gnu.org; 19 Apr 2022 22:06:00 +0000 Received: from localhost ([127.0.0.1]:44367 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngvyy-0003lo-K4 for submit@debbugs.gnu.org; Tue, 19 Apr 2022 18:06:00 -0400 Received: from eggs.gnu.org ([209.51.188.92]:35154) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngvyw-0003lY-8c for 54997@debbugs.gnu.org; Tue, 19 Apr 2022 18:05:58 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:50226) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngvyp-0006iW-Tn; Tue, 19 Apr 2022 18:05:52 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:In-Reply-To:Date:References:Subject:To: From; bh=SCJmgLdJ5XSitFviwcBI0bITarW4/QKGvawy+12qPZA=; b=Z+bMtKf2EyO7mUGvChbY ApQzbSV5VvP/tw+a47AROrCjVhi/k9jHeaJZJKlqt5lKm3aKEQnRKQOHbJav9emdNZRoOUTORPPmd i3Fxqo1WBR/59h0ImEEGiWQeE+uNJ+B04xmcQb7+YbS+95jo6hGh6DAVcceUU1F1W6Hvp7kLujVAe GlLJ2TbWP6oVoGrtllaqDxpeT7Y2C08FGYWGXGIjsyjtu8m9DoaNqWXxReXpWUQetnk8kVINDlNXu IrWBbDzabH0XRfOJrWN4iF8PdnfnTJ6a8F9TVtHqFrxK4sk0mLVe21grMfD60qWabTVuV0RoXrlXI 1P+71e3SQzqANQ==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:59273 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngvyO-0000zL-TQ; Tue, 19 Apr 2022 18:05:51 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= References: <20220417210453.27884-1-ludo@gnu.org> <20220417210453.27884-4-ludo@gnu.org> Date: Wed, 20 Apr 2022 00:05:23 +0200 In-Reply-To: (Maxime Devos's message of "Mon, 18 Apr 2022 11:18:49 +0200") Message-ID: <87pmlcpw4c.fsf_-_@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: base64 X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) TWF4aW1lIERldm9zIDxtYXhpbWVkZXZvc0B0ZWxlbmV0LmJlPiBza3JpYmlzOg0KDQo+IEx1ZG92 aWMgQ291cnTDqHMgc2NocmVlZiBvcCB6byAxNy0wNC0yMDIyIG9tIDIzOjA0IFsrMDIwMF06DQo+ PiArKGRlZmluZSogKGxlYXN0LWF1dGhvcml0eS13cmFwcGVyIHByb2dyYW0NCj4+ICvCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqAgIzprZXkgKG5hbWUgInBvbGEtd3JhcHBlciIpDQo+PiArwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIChndWVzdC11aWQg MTAwMCkNCj4+ICvCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqAgKGd1ZXN0LWdpZCAxMDAwKQ0KPj4gK8KgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCAobWFw cGluZ3MgJygpKQ0KPj4gK8KgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCAobmFtZXNwYWNlcyAlbmFtZXNwYWNlcykNCj4+ICvC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqAgKGRpcmVjdG9yeSAiLyIpDQo+PiArwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIChwcmVzZXJ2ZWQtZW52aXJv bm1lbnQtdmFyaWFibGVzDQo+PiArwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgJXByZWNpb3VzLXZhcmlhYmxlcykpDQo+ DQo+IENvdWxkIHRoZXJlIGJlIGFuIG9wdGlvbiB0byBkZWZpbmUgZW52aXJvbm1lbnQgdmFyaWFi bGVzPyAgRS5nLiBzZXQNCj4gR1VJWF9MT0NQQVRIIGZvciBHdWlsZSBwYWNrYWdlcyB0aGF0IG5l ZWQgbG9jYWxlIGRhdGEgdG8gcmVhZCBub24tQVNDSUkNCj4gZmlsZSBuYW1lcy4gIEFzIGlzLCBp dCBzZWVtcyBsaWtlIGFuIGVudmlyb25tZW50LXNldHRpbmcgd3JhcHBlciBoYXMgdG8NCj4gYmUg aW5zZXJ0ZWQgaW5zaWRlIHRoZSBwb2xhIHdyYXBwZXIgdG8gZG8gdGhpcy4NCg0KWWVzLCBnb29k IHBvaW50LiAgSeKAmW0gdGVtcHRlZCB0byB3YWl0IHVudGlsIHRoZSBmaXJzdCB1c2UgY2FzZSBj b21lcyB1cA0KdGhvdWdoLiAgOi0pDQoNClRoYW5rcyBmb3IgdGFraW5nIGEgbG9vayENCg== From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 01/12] gexp: Add 'references-file'. Resent-From: Thiago Jung Bauermann Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Fri, 22 Apr 2022 05:13:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Ludovic =?UTF-8?Q?Court=C3=A8s?= Cc: 54997@debbugs.gnu.org X-Debbugs-Original-Cc: 54997@debbugs.gnu.org, guix-patches@gnu.org Received: via spool by submit@debbugs.gnu.org id=B.16506043549259 (code B ref -1); Fri, 22 Apr 2022 05:13:02 +0000 Received: (at submit) by debbugs.gnu.org; 22 Apr 2022 05:12:34 +0000 Received: from localhost ([127.0.0.1]:51284 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nhlar-0002PG-KR for submit@debbugs.gnu.org; Fri, 22 Apr 2022 01:12:34 -0400 Received: from lists.gnu.org ([209.51.188.17]:41042) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nhlap-0002P7-Jr for submit@debbugs.gnu.org; Fri, 22 Apr 2022 01:12:32 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:37568) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nhlap-00067W-7s for guix-patches@gnu.org; Fri, 22 Apr 2022 01:12:31 -0400 Received: from mx.kolabnow.com ([212.103.80.153]:28296) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nhlal-0001VR-QE; Fri, 22 Apr 2022 01:12:29 -0400 Received: from localhost (unknown [127.0.0.1]) by mx.kolabnow.com (Postfix) with ESMTP id 555F741124; Fri, 22 Apr 2022 07:12:20 +0200 (CEST) Authentication-Results: ext-mx-out003.mykolab.com (amavisd-new); dkim=pass (4096-bit key) reason="pass (just generated, assumed good)" header.d=kolabnow.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kolabnow.com; h= content-transfer-encoding:content-type:content-type:mime-version :message-id:in-reply-to:date:date:subject:subject:from:from :references:received:received:received; s=dkim20160331; t= 1650604339; x=1652418740; bh=IO7T1ko6xqVQQDghgRkRCEojlXT1LulNIjg ex+OJ45k=; b=kaZfz7akQto5JrZLQ/+6r/FGqfuy7wbmz7gY0mH6CzRdgx7Lv/3 d38PINruTNQYO7KxEGaj2eei5JCFUS1Xpo781I/GsEjudZWU9VS+/0mXwhTwP8OD YOQJScgrKfjMOxcALCbL5vBIQlKF7QI2uVHXUwOFEG3XqkOcIAW9PXqopjmzxfLX padMFfPcCrDWwpIxd0w2BbZya/GyeIoQsvsBsDe7aOJE/AyjF6fL4A6Ia+82EcBc 2UcK/YsUBsue6cXU/LHvwiz62c5JBClgHg918tvjgBn9kjtv/GMlf+3JgAibTlSo e+tGQmSeFKwSJG4PlfkAazoNyFX6gKQqfAzsWD3+lXoo6806JOtuhaIEqMI0UkDt ghySzYDJeQ21dxo5Lj1Emjdh041/QavGa37dKT8NYxABqhdggd5bu0ebyGKAo1pS 7q8V+TRhsYBEyyPkQb7hASTnkDrSx6SOkNwcmGyjbgCGKEJJUXvD+8VcgBVF86VW vgaZAzTFSJfe1CndftHnbJ56oQto0Jusak+t0Xzs738lZ9pJnrGM9/dKYUMvaD8U /bY50robgApAVtH3zzWaiAkZYi4kNUwd8aPAS7JHdb96kRcBmQZDPpWBGoRM4dDn FwnSnJ4sD+8jrs98wcz8lAYE+mMc4X0RWzB82SnEf0DWNwlbm0U2H1FU= X-Virus-Scanned: amavisd-new at mykolab.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-10 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mx.kolabnow.com ([127.0.0.1]) by localhost (ext-mx-out003.mykolab.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H22eG3UAzbvG; Fri, 22 Apr 2022 07:12:19 +0200 (CEST) Received: from int-mx003.mykolab.com (unknown [10.9.13.3]) by mx.kolabnow.com (Postfix) with ESMTPS id 1760740D72; Fri, 22 Apr 2022 07:12:18 +0200 (CEST) Received: from ext-subm001.mykolab.com (unknown [10.9.6.1]) by int-mx003.mykolab.com (Postfix) with ESMTPS id 2D7313794; Fri, 22 Apr 2022 07:12:17 +0200 (CEST) References: <20220417210107.27263-1-ludo@gnu.org> <20220417210453.27884-1-ludo@gnu.org> From: Thiago Jung Bauermann Date: Fri, 22 Apr 2022 02:01:39 -0300 In-reply-to: <20220417210453.27884-1-ludo@gnu.org> Message-ID: <871qxpvh04.fsf@kolabnow.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Received-SPF: pass client-ip=212.103.80.153; envelope-from=bauermann@kolabnow.com; helo=mx.kolabnow.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-Spam-Score: -1.4 (-) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -2.4 (--) Hello Ludo, This is an awesome series! It will be yet another strength of Guix to have many services as possible (and even desktop apps, hopefully) isolated. I have one question: Ludovic Court=C3=A8s writes: > + (define (read-graph port) > + ;; Return the list of references read from > + ;; PORT. This is a stripped-down version= of > + ;; 'read-reference-graph'. > + (let loop ((items '())) > + (match (read-line port) > + ((? eof-object?) > + items) > + ((? string? item) > + (let ((deriver (read-line port)) > + (count > + (string->number (read-line po= rt)))) > + (drop-lines port count) > + (loop (cons item items))))))) I'm sure I'm being dense, but I don't see how =E2=80=98item=E2=80=99 can ch= ange between iterations of this loop. Which in my mind means that =E2=80=98read-graph=E2= =80=99 can only return a list where the original =E2=80=98item=E2=80=99 argument from =E2=80=98references-file=E2=80=99 is repeated many times over. I ran the te= sts/gexp.scm test and all tests pass, so this code must be working... --=20 Thanks Thiago From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 00/12] Add "least authority" program wrapper Resent-From: Maxime Devos Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Fri, 22 Apr 2022 14:41:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Ludovic =?UTF-8?Q?Court=C3=A8s?= Cc: 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165063840811321 (code B ref 54997); Fri, 22 Apr 2022 14:41:02 +0000 Received: (at 54997) by debbugs.gnu.org; 22 Apr 2022 14:40:08 +0000 Received: from localhost ([127.0.0.1]:54495 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nhuRt-0002vq-Pd for submit@debbugs.gnu.org; Fri, 22 Apr 2022 10:40:08 -0400 Received: from andre.telenet-ops.be ([195.130.132.53]:41392) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nhuRr-0002ve-3j for 54997@debbugs.gnu.org; Fri, 22 Apr 2022 10:39:51 -0400 Received: from ptr-bvsjgyhxw7psv60dyze.18120a2.ip6.access.telenet.be ([IPv6:2a02:1811:8c09:9d00:3c5f:2eff:feb0:ba5a]) by andre.telenet-ops.be with bizsmtp id Mqfo270114UW6Th01qfprM; Fri, 22 Apr 2022 16:39:49 +0200 Message-ID: <616af1474c44d6c1caf71fa1f9d263ff46462201.camel@telenet.be> From: Maxime Devos Date: Fri, 22 Apr 2022 16:39:43 +0200 In-Reply-To: <8735i8ratp.fsf_-_@gnu.org> References: <20220417210453.27884-1-ludo@gnu.org> <20220417210453.27884-9-ludo@gnu.org> <4eac7fd571ddafd46bcadfa2ef5c6b3e41a162ab.camel@telenet.be> <8735i8ratp.fsf_-_@gnu.org> Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-xkGL+UE0u7QPcDTujc1H" User-Agent: Evolution 3.38.3-1 MIME-Version: 1.0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telenet.be; s=r22; t=1650638389; bh=glsM28O1B54L4UFJF4Gu0pJhiNXRCnm5Ws6wBV4YNwc=; h=Subject:From:To:Cc:Date:In-Reply-To:References; b=FA8bwoMYExSo3V21WJwDQNbEzsZnu9m0QPAkHz0/Wd9SUG3xtsPKoAjOZwNKoWDd+ cbZgVLh1gjme45bOUuFbg2Ki0FK2z43kSdgn7PWTLbp0ubh1o1hD0uMLj1rrPds3KB QPea9PZacwkv+vRYwsI4F/zDEmP7338A0EFFKBpmCXbQk51wXeNUr8WwaP0UXCo+vU lrHHCawMNhl1yy/RrrBiyp/5BjgDSr8no1icgdY/nh9IcQfHglqbxMHI5MWd4tOy1h RA2z0Rd9BEA/NKutDheWqFKGBYIP6MiZ+gEAOStsIN4KhM48do+jB/4nGA9XjOEhTG tS2H+mHYVYwJg== X-Spam-Score: -0.0 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) --=-xkGL+UE0u7QPcDTujc1H Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Ludovic Court=C3=A8s schreef op wo 20-04-2022 om 00:02 [+0200]: > > would become simpler as it wouldn't need to fork, exec, waitpid and > > dynamic-wind.=C2=A0 Alternatively, if associating a user and group with > > a > > pola wrapper is problematic (*), what do you think of defining a > > 'system*/with-capabilities' or 'invoke/with-capabilities' in a > > central > > location? >=20 > I=E2=80=99m not sure what these procedures would do. >=20 > I think we should build the house one brick at a time; this is the > first brick but I=E2=80=99m sure there=E2=80=99ll be others as we gain mo= re > experience and clearer use cases. This system*/with-capabilities brick would do the primitive- fork+setuid+setgid+execl thing: (define (system*/with-capabilities command #:key user group extra- groups environment) ;; Exec the given command with the right authority. (let ((pid (primitive-fork))) (if (zero? pid) (dynamic-wind (const #t) (lambda () (let ((pw (getpwnam "ipfs"))) ; TODO use 'user' and 'group', and don't change user/group when already this user/group (setgroups '#()) (setgid (passwd:gid pw)) (setuid (passwd:uid pw)) (environ environment) (apply execl command))) (lambda () (primitive-exit 127))) (waitpid pid))))) This would make this functionality available outside the ipfs service as well. Over time, it could be extended to support more kinds of ambient authority, e.g. namespaces, POSIX =E2=80=98capabilities=E2=80=99, c= apability masks to disallow gaining capabilities by runningsetuid binaries, the file system hierarchy (with bind mounts), removing all users and groups (on the Hurd), ... Many of these are supported by 'least-authority-wrapper' but these POLA wrappers require creating an additional process which seems a bit unoptimal to me (memory- and latency-wise). Also, having to do fork, waitpid and primitive-fork seems rather low- level to me, so I prefer moving this code into somewhere like (gnu build SOMEWHERE) or to keep the old make-forkexec-constructor/container code. Greetinsgs, Maxime. --=-xkGL+UE0u7QPcDTujc1H Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- iI0EABYKADUWIQTB8z7iDFKP233XAR9J4+4iGRcl7gUCYmK+LxccbWF4aW1lZGV2 b3NAdGVsZW5ldC5iZQAKCRBJ4+4iGRcl7lfjAPwOb8rRVbIKCwU+IST9lYnmN3P3 wlsYxC8ttytRHwo84QD/X/Yrav9MciSAp6fxdWaWviXJcHndzknX7YhFDE5GVAk= =RY56 -----END PGP SIGNATURE----- --=-xkGL+UE0u7QPcDTujc1H-- From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 00/12] Add "least authority" program wrapper Resent-From: Maxime Devos Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Fri, 22 Apr 2022 15:03:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Ludovic =?UTF-8?Q?Court=C3=A8s?= , 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165063973614040 (code B ref 54997); Fri, 22 Apr 2022 15:03:02 +0000 Received: (at 54997) by debbugs.gnu.org; 22 Apr 2022 15:02:16 +0000 Received: from localhost ([127.0.0.1]:54517 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nhunY-0003eN-1d for submit@debbugs.gnu.org; Fri, 22 Apr 2022 11:02:16 -0400 Received: from baptiste.telenet-ops.be ([195.130.132.51]:53228) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nhunV-0003eC-3Z for 54997@debbugs.gnu.org; Fri, 22 Apr 2022 11:02:14 -0400 Received: from ptr-bvsjgyhxw7psv60dyze.18120a2.ip6.access.telenet.be ([IPv6:2a02:1811:8c09:9d00:3c5f:2eff:feb0:ba5a]) by baptiste.telenet-ops.be with bizsmtp id Mr2B270074UW6Th01r2B1T; Fri, 22 Apr 2022 17:02:11 +0200 Message-ID: <22c9f92c9855e36b23ec70ba53fc6cf85c918527.camel@telenet.be> From: Maxime Devos Date: Fri, 22 Apr 2022 17:02:03 +0200 In-Reply-To: <20220417210107.27263-1-ludo@gnu.org> References: <20220417210107.27263-1-ludo@gnu.org> Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-tJaLiYp9djfAD8tH+eCk" User-Agent: Evolution 3.38.3-1 MIME-Version: 1.0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telenet.be; s=r22; t=1650639731; bh=PulMUkwVs5MHkPdn+dFsEdLJmKs2/3TQw8zpmwFFPBc=; h=Subject:From:To:Date:In-Reply-To:References; b=QtZ68L+QhszfylyF6EZ6ihjJ8OEbs9N95FDiXMPb7PkPMdp40m1jD6hr2gIvR9ZWY k7YS61zU1BjE9sHcietFCZTJ6ODvboEoog/HwLNDAGbkiTXl9q+JuKw4sjbZg1rOLH dyBwjqdfU0kImZi6MUef5qivkqnT6pUCpyxq419Wcl4Jajc4gd3/dK9QdtLzrsut93 YbbCXY20GCHWxGLUrj9QgYloB5E7OeAZ3VENHJN63io4ZtJt1GwGqLVVO6QGr1Dga0 d2gecfYa5tBPtWavf9HxgIMn2Pp/W9ZEOS7YVaRnEhiJBIffpdO0mqJM55UeYgFueE Qp1U2cQ9ZoiTg== X-Spam-Score: -0.0 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) --=-tJaLiYp9djfAD8tH+eCk Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Ludovic Court=C3=A8s schreef op zo 17-04-2022 om 23:01 [+0200]: > Hello Guix! >=20 > So we have this fancy =E2=80=98make-forkexec-constructor/container=E2=80= =99 thing > to spawn Shepherd services in a container: >=20 > =C2=A0 https://guix.gnu.org/en/blog/2017/running-system-services-in-conta= iners/ >=20 > It=E2=80=99s nice, but it doesn=E2=80=99t compose.=C2=A0 What if you want= an inetd-style > service *and* have it run in a container?=C2=A0 We certainly don=E2=80=99= t want to > end up defining =E2=80=98make-inetd-constructor/container=E2=80=99 and so= on. Currently, it doesn't compose, but can it be made composable? More concretely, maybe there could be a set of =E2=80=98process procedures= =E2=80=99 implementable by record types: ;; Inspired by , ;; with some differences (define (subprocess-start/separate process) ...) ; run it in a separate = process (define (subprocess-start/replace process) ...) ; run it with 'exec' (define (subprocess-kill process) ...) (define (subprocess-wait process) ...) (define (subprocess-status process) ...) ;; Basic process constructor, doesn't do containers (define (command-process ...) ...) ;; Container (define (contain inner #:key container-stuff ...) subprocess-start/separate: (run-container ... (lambda () (subprocess-st= art/replace inner))) other procedures ... return the record) Then make-inetd-constructor could be changed to accept a lambda producing 'subprocess' records. By passing it a subprocess wrapped by 'contain', it = would automatically support container things: (define (make-inetd-constructor/container-command command* ...) (make-inetd-constructor (lambda () (contain (command-process comand*))) .= ..)) Greetings, Maxime. --=-tJaLiYp9djfAD8tH+eCk Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- iI0EABYKADUWIQTB8z7iDFKP233XAR9J4+4iGRcl7gUCYmLDaxccbWF4aW1lZGV2 b3NAdGVsZW5ldC5iZQAKCRBJ4+4iGRcl7uOLAQCi9Lr0I3X6G9IONhGC47M27KLn kIEok/pwDe7zDrsn4gD/djKF+dMXUW6FG4YZFQR/9YygHh9GXjvV333oDyKzVwY= =kY+Z -----END PGP SIGNATURE----- --=-tJaLiYp9djfAD8tH+eCk-- From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 04/12] Add (guix least-authority). Resent-From: Thiago Jung Bauermann Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Fri, 22 Apr 2022 20:29:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Ludovic =?UTF-8?Q?Court=C3=A8s?= Cc: 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.16506593218237 (code B ref 54997); Fri, 22 Apr 2022 20:29:01 +0000 Received: (at 54997) by debbugs.gnu.org; 22 Apr 2022 20:28:41 +0000 Received: from localhost ([127.0.0.1]:54758 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nhztQ-00028n-Te for submit@debbugs.gnu.org; Fri, 22 Apr 2022 16:28:41 -0400 Received: from mx.kolabnow.com ([212.103.80.154]:13964) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nhztK-00028I-RZ for 54997@debbugs.gnu.org; Fri, 22 Apr 2022 16:28:40 -0400 Received: from localhost (unknown [127.0.0.1]) by mx.kolabnow.com (Postfix) with ESMTP id C77529D7; Fri, 22 Apr 2022 22:28:28 +0200 (CEST) Authentication-Results: ext-mx-out001.mykolab.com (amavisd-new); dkim=pass (4096-bit key) reason="pass (just generated, assumed good)" header.d=kolabnow.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kolabnow.com; h= content-transfer-encoding:content-type:content-type:mime-version :message-id:in-reply-to:date:date:subject:subject:from:from :references:received:received:received; s=dkim20160331; t= 1650659308; x=1652473709; bh=LQfO0iFRaB3BBLLv6TkObZcBKC2CdURo1Ij VJSw+TDo=; b=Hcfz08DYoj27d/dB42NIez5QzCBoogfDL+DyU+hd2RfDIEdAeW+ Rd/shMhlKBzd8pJ9FbyTxteCE82OPDbwa37Y0mAfcJTsyxzKVDPH+76WXR/n2Pgx UZ5a/aEpqFiXnoQj4rxRBUqHUxHePL3GwS/nng3IiRJc/itC7hT7iTns+EkrMFPP OFWzVWUpNcdOF5yjuYzv4kGRvWVnXg8kpr37H+59nj0mOEG592DXoLqQuxrCJfQ2 fBDJwup1vwh1fhG6CTLMKypp8bxlA4LYIv4t8rELtnTfh1ClVNXK7sPaElr3sQ0w X6/7ilbYksxcntgk1HlfUrd5Ribk6UW8TEGZu9vaNRfKhkW6UWI9r2zxTEFa6cvd wkYZWC3n/LWIyJcTsmCSqq9LBJkVNN+BhIEBGbF6ynol/MoWpUi6AROCep2CJjDm GC9GDDeDO7rXHem56kGcdoYIpHP/jSQSZyOSbzB3AJmVHa3teC/liOcOVExBINwG 6EHVqO0Qjxid0qII5WDhpDcFaoLFBd2BCmW4XeN0gG5FkwLSmvPfwvwFjoRSHr7n hOQGdw44FAU+dDq72bGk9HgRorkUtoy5X1GksRj4GTCM99XnhvOLF9trUNf8vI6M 83FZmKm/kCFzK38ALmojzAnopCmDfHdQFUlIjWZf1r+9lp321isaKf+0= X-Virus-Scanned: amavisd-new at mykolab.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-10 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mx.kolabnow.com ([127.0.0.1]) by localhost (ext-mx-out001.mykolab.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z7Iqh3jRVOZq; Fri, 22 Apr 2022 22:28:28 +0200 (CEST) Received: from int-mx003.mykolab.com (unknown [10.9.13.3]) by mx.kolabnow.com (Postfix) with ESMTPS id 9E75763E; Fri, 22 Apr 2022 22:28:27 +0200 (CEST) Received: from ext-subm003.mykolab.com (unknown [10.9.6.3]) by int-mx003.mykolab.com (Postfix) with ESMTPS id 08ACB37D1; Fri, 22 Apr 2022 22:28:26 +0200 (CEST) References: <20220417210453.27884-1-ludo@gnu.org> <20220417210453.27884-4-ludo@gnu.org> From: Thiago Jung Bauermann Date: Fri, 22 Apr 2022 17:10:19 -0300 In-reply-to: <20220417210453.27884-4-ludo@gnu.org> Message-ID: <87h76klv6j.fsf@kolabnow.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -0.0 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Hello, Ludovic Court=C3=A8s writes: > + (reify-exit-status > + (call-with-container mounts > + (lambda () > + (chdir #$directory) > + (environ variables) > + (apply execl #$program #$program (cdr (command-line)))) I'm a bit concerned about running arbitrary commands as PID 1 of process namespaces. A process running as PID 1 (even in a child namespace) is a special case and is treated differently by the Linux kernel than any other process, so it needs to be a program that has been designed to work in that situation. There are two differences from regular processes: 1. PID 1 inherits orphan processes and needs to wait() on them when they quit, in order to avoid accumulating zombie processes in the system. 2. Unlike regular processes, PID 1 doesn't have default signal handlers. Both of these aspects are described in more detail here: https://github.com/krallin/tini/issues/8#issuecomment-146135930 So to avoid an accumulation of zombie processes and other signal-related problems, I suggest adding a =E2=80=9C(init-program ,tini)=E2=80=9D paramet= er to =E2=80=98least-authority-wrapper=E2=80=99 and executing =E2=80=98program=E2= =80=99 as a subprocess of =E2=80=98tini=E2=80=99 or whatever was passed as the #:init-program (perhap= s #f could mean running =E2=80=98program=E2=80=99 directly as PID 1). I mention this because I'm currently dealing with a problem that has exactly this root cause: I'm working on updating the public-inbox package to the latest version, and the testsuite is failing because it tests that lei's daemon process is correctly terminated. But that doesn't work because =E2=80=9Cguix build=E2=80=9D doesn't use a proper init= program as PID 1 and thus the daemon process goes to zombie state and the testsuite thinks that it didn't go away. I'm hoping to send a patch to fix that issue. --=20 Thanks Thiago From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 00/12] Add "least authority" program wrapper Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Tue, 26 Apr 2022 20:18:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Thiago Jung Bauermann Cc: 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165100427631220 (code B ref 54997); Tue, 26 Apr 2022 20:18:01 +0000 Received: (at 54997) by debbugs.gnu.org; 26 Apr 2022 20:17:56 +0000 Received: from localhost ([127.0.0.1]:40621 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njRdE-00087T-Af for submit@debbugs.gnu.org; Tue, 26 Apr 2022 16:17:56 -0400 Received: from eggs.gnu.org ([209.51.188.92]:50312) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njRdB-00087E-Nc for 54997@debbugs.gnu.org; Tue, 26 Apr 2022 16:17:54 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:39996) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njRd5-00088A-DE; Tue, 26 Apr 2022 16:17:47 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:In-Reply-To:Date:References:Subject:To: From; bh=Vq/HzkxHuh1q9r5D+G5dNUMfsvOFNZg/beXmqq7DyGk=; b=mVnWnILQVRbq+UO+Qs5X 0ZYlEAGC5dfRvfeitaSzRIveLZSeoEHyFdbfwhM0X/zPGfiaCN8VR19TbVXcJ1k2JmPh/Vs6f3rJl 2PCxbx+ZyV/84UP379Vd37hInZDtgldFIQOrZHHe2uy61RcQNEV3uNqdlwHBIyxcbLyF3li7tEv+r wgWForJSI7kRi6QLlObK/Ynejq14N2pigeyNA9rGTWu8siQn7sCTTTbSpL7jkoGA9YsrU9PbSRNkU 5s9BtpkmpGbRRs46efrByJXqxdH2FITJPnnUwUYkW+PXjOkkbOY6ZCzwdGmkbxDK1yPoTSYJUZWgE lqJoVTEU+blQ3g==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:64923 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njRd5-0003kb-1H; Tue, 26 Apr 2022 16:17:47 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= References: <20220417210107.27263-1-ludo@gnu.org> <20220417210453.27884-1-ludo@gnu.org> <871qxpvh04.fsf@kolabnow.com> Date: Tue, 26 Apr 2022 22:17:44 +0200 In-Reply-To: <871qxpvh04.fsf@kolabnow.com> (Thiago Jung Bauermann's message of "Fri, 22 Apr 2022 02:01:39 -0300") Message-ID: <874k2flhuf.fsf_-_@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Hi Thiago, Thiago Jung Bauermann skribis: > This is an awesome series! It will be yet another strength of Guix to > have many services as possible (and even desktop apps, hopefully) > isolated. Thanks. :-) > Ludovic Court=C3=A8s writes: > >> + (define (read-graph port) >> + ;; Return the list of references read fr= om >> + ;; PORT. This is a stripped-down versio= n of >> + ;; 'read-reference-graph'. >> + (let loop ((items '())) >> + (match (read-line port) >> + ((? eof-object?) >> + items) >> + ((? string? item) >> + (let ((deriver (read-line port)) >> + (count >> + (string->number (read-line p= ort)))) >> + (drop-lines port count) >> + (loop (cons item items))))))) > > I'm sure I'm being dense, but I don't see how =E2=80=98item=E2=80=99 can = change between > iterations of this loop. Each iteration reads a new line from PORT, an input port on a text file. The file is created by guix-daemon and has a format like this: FILE DERIVER NUMBER-OF-REFERENCES REF1 ... REFN where each FILE is a store item (see store-copy.scm for details). Here we only care about FILE and REF*. > Which in my mind means that =E2=80=98read-graph=E2=80=99 can only return = a list where > the original =E2=80=98item=E2=80=99 argument from =E2=80=98references-fil= e=E2=80=99 is repeated many > times over. I ran the tests/gexp.scm test and all tests pass, so this > code must be working... I think it does! :-) It wouldn=E2=80=99t hurt to add a call to =E2=80=98delete-duplicates=E2=80=99 though. Ludo=E2=80=99. From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 00/12] Add "least authority" program wrapper Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Tue, 26 Apr 2022 20:23:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Maxime Devos Cc: 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165100457231774 (code B ref 54997); Tue, 26 Apr 2022 20:23:02 +0000 Received: (at 54997) by debbugs.gnu.org; 26 Apr 2022 20:22:52 +0000 Received: from localhost ([127.0.0.1]:40626 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njRhz-0008GN-VJ for submit@debbugs.gnu.org; Tue, 26 Apr 2022 16:22:52 -0400 Received: from eggs.gnu.org ([209.51.188.92]:51056) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njRhz-0008G7-95 for 54997@debbugs.gnu.org; Tue, 26 Apr 2022 16:22:51 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:40044) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njRhs-0000Ss-Ba; Tue, 26 Apr 2022 16:22:45 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:In-Reply-To:Date:References:Subject:To: From; bh=rwtO2rUFrDv11BVw4JezOZk0iKGnH5F1RFCnJxfoCvU=; b=XjgRX1/4ZK+pwlC0/I+i qYdBajVPSqMUEUy3j2ctz8v+DAUq1LBEbb3dPOOR6Zxtur2n34r5XxK7maw5iNfeJcVqqIcs+H8ZE h7OCPlWWZM32z0jgy/AhrLzX104mydmjc5U0mvTkq1DtERZ60gadohVnV7pLeY8mZJ6b8rVNtKoja z/LlkLnOna2psXi4dEQG3dPPoWHfrSMCB+ZQez1nYT0Gr7ihvIntnPzJHlV7teEq87pqQ5gmz5iAL /ZL2SWIIViJBwT4w9q2Sur6LS1g3eb8j8+lSp297XlfOUNOaU+2Ue2mqoeFwpZEi6+JidjBhMp+Mv 25Xxaodg/kH7Yg==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:56361 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njRhr-0004Eq-Ur; Tue, 26 Apr 2022 16:22:44 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= References: <20220417210107.27263-1-ludo@gnu.org> <22c9f92c9855e36b23ec70ba53fc6cf85c918527.camel@telenet.be> Date: Tue, 26 Apr 2022 22:22:42 +0200 In-Reply-To: <22c9f92c9855e36b23ec70ba53fc6cf85c918527.camel@telenet.be> (Maxime Devos's message of "Fri, 22 Apr 2022 17:02:03 +0200") Message-ID: <87y1zrk31p.fsf_-_@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Hi Maxime, Maxime Devos skribis: > Ludovic Court=C3=A8s schreef op zo 17-04-2022 om 23:01 [+0200]: >> Hello Guix! >>=20 >> So we have this fancy =E2=80=98make-forkexec-constructor/container=E2=80= =99 thing >> to spawn Shepherd services in a container: >>=20 >> =C2=A0 https://guix.gnu.org/en/blog/2017/running-system-services-in-cont= ainers/ >>=20 >> It=E2=80=99s nice, but it doesn=E2=80=99t compose.=C2=A0 What if you wan= t an inetd-style >> service *and* have it run in a container?=C2=A0 We certainly don=E2=80= =99t want to >> end up defining =E2=80=98make-inetd-constructor/container=E2=80=99 and s= o on. > > Currently, it doesn't compose, but can it be made composable? > More concretely, maybe there could be a set of =E2=80=98process procedure= s=E2=80=99 > implementable by record types: > > ;; Inspired by , > ;; with some differences > (define (subprocess-start/separate process) ...) ; run it in a separat= e process > (define (subprocess-start/replace process) ...) ; run it with 'exec' > (define (subprocess-kill process) ...) > (define (subprocess-wait process) ...) > (define (subprocess-status process) ...) > > ;; Basic process constructor, doesn't do containers > (define (command-process ...) ...) > > ;; Container > (define (contain inner #:key container-stuff ...) > subprocess-start/separate: (run-container ... (lambda () (subprocess-= start/replace inner))) > other procedures ... > return the record) > > Then make-inetd-constructor could be changed to accept a lambda producing > 'subprocess' records. By passing it a subprocess wrapped by 'contain', i= t would > automatically support container things: > > (define (make-inetd-constructor/container-command command* ...) > (make-inetd-constructor (lambda () (contain (command-process comand*)))= ...)) A (sub)process abstraction could be useful, indeed. But like you write, we=E2=80=99d need further changes in shepherd itself, w= hich makes it less appealing IMO. I like that the =E2=80=9CPOLA wrapper=E2=80= =9D allows us to deal with this aspect in a fairly orthogonal fashion. Thanks! Ludo=E2=80=99. From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 00/12] Add "least authority" program wrapper Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Tue, 26 Apr 2022 20:31:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Thiago Jung Bauermann Cc: 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.1651005058358 (code B ref 54997); Tue, 26 Apr 2022 20:31:02 +0000 Received: (at 54997) by debbugs.gnu.org; 26 Apr 2022 20:30:58 +0000 Received: from localhost ([127.0.0.1]:40632 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njRpp-00005f-Tk for submit@debbugs.gnu.org; Tue, 26 Apr 2022 16:30:58 -0400 Received: from eggs.gnu.org ([209.51.188.92]:52726) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njRpn-00005J-Tk for 54997@debbugs.gnu.org; Tue, 26 Apr 2022 16:30:56 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:40286) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njRpi-0001tV-4X; Tue, 26 Apr 2022 16:30:50 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:In-Reply-To:Date:References:Subject:To: From; bh=8gnKYy43UuDSnx9b9nemxvlNyZvrY0eErZIIx0QKF9Q=; b=bqPY+XDEB10d/pwjbjC5 XyomJPI4YkyuZFBl7OfDmOkpKyigAPyK1dzrdRbPFlMBckwL6FIPXVVNj+xmwJyG52P1DAwHUxrbW 5NeP+kusHtdT8trwmkjNNhBX7uM3zIEKHtwncN6I8wx+mwOh9wXDd4Ggb9BGski/qf8kKUeEpZ56Y vMJGBP68l3tfgZV6zxCXEARxODDM8eMfWBDCFypf3rT4q+Mu/43fEjoCUKn+sgllgFe0X/fL/Imhi o9Rbu5K2BzIo0CHtOLzwsKPe1JqX7WPHD/YQIT0Ti4aziEy1Y6SEslT3xbqrEM0ZMtqYqqIqZrt9I ofareUh4LSoA9g==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:51529 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njRph-0001CT-KZ; Tue, 26 Apr 2022 16:30:49 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= References: <20220417210453.27884-1-ludo@gnu.org> <20220417210453.27884-4-ludo@gnu.org> <87h76klv6j.fsf@kolabnow.com> Date: Tue, 26 Apr 2022 22:30:47 +0200 In-Reply-To: <87h76klv6j.fsf@kolabnow.com> (Thiago Jung Bauermann's message of "Fri, 22 Apr 2022 17:10:19 -0300") Message-ID: <87o80nk2o8.fsf_-_@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Hi! Thiago Jung Bauermann skribis: > I'm a bit concerned about running arbitrary commands as PID 1 of process > namespaces. A process running as PID 1 (even in a child namespace) is a > special case and is treated differently by the Linux kernel than any > other process, so it needs to be a program that has been designed to > work in that situation. There are two differences from regular > processes: > > 1. PID 1 inherits orphan processes and needs to wait() on them when they > quit, in order to avoid accumulating zombie processes in the system. > > 2. Unlike regular processes, PID 1 doesn't have default signal handlers. Good points. > Both of these aspects are described in more detail here: > > https://github.com/krallin/tini/issues/8#issuecomment-146135930 > > So to avoid an accumulation of zombie processes and other signal-related > problems, I suggest adding a =E2=80=9C(init-program ,tini)=E2=80=9D param= eter to > =E2=80=98least-authority-wrapper=E2=80=99 and executing =E2=80=98program= =E2=80=99 as a subprocess of > =E2=80=98tini=E2=80=99 or whatever was passed as the #:init-program (perh= aps #f could > mean running =E2=80=98program=E2=80=99 directly as PID 1). Hmm yes. It=E2=80=99s not great that the choice is between =E2=80=98unshar= e=E2=80=99=E2=80=94efficient but the process lives in the parent PID namespace=E2=80=94and =E2=80=98clon= e=E2=80=99=E2=80=94but then you have to fork twice. But yeah, you=E2=80=99re right. I=E2=80=99ll try what you suggest and send= a v2. > I mention this because I'm currently dealing with a problem that has > exactly this root cause: I'm working on updating the public-inbox > package to the latest version, and the testsuite is failing because it > tests that lei's daemon process is correctly terminated. But that > doesn't work because =E2=80=9Cguix build=E2=80=9D doesn't use a proper in= it program as > PID 1 and thus the daemon process goes to zombie state and the testsuite > thinks that it didn't go away. I'm hoping to send a patch to fix that > issue. Now that you mention it, this was discussed before: https://issues.guix.gnu.org/30948 I think we should do something about it in gnu-build-system.scm. Thanks for your feedback! Ludo=E2=80=99. From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 00/12] Add "least authority" program wrapper Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Tue, 26 Apr 2022 20:49:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Thiago Jung Bauermann Cc: 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.16510061102258 (code B ref 54997); Tue, 26 Apr 2022 20:49:02 +0000 Received: (at 54997) by debbugs.gnu.org; 26 Apr 2022 20:48:30 +0000 Received: from localhost ([127.0.0.1]:40649 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njS6o-0000aM-0S for submit@debbugs.gnu.org; Tue, 26 Apr 2022 16:48:30 -0400 Received: from eggs.gnu.org ([209.51.188.92]:56194) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njS6l-0000a7-9l for 54997@debbugs.gnu.org; Tue, 26 Apr 2022 16:48:28 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:40674) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njS6f-0004d3-CK; Tue, 26 Apr 2022 16:48:21 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:In-Reply-To:Date:References:Subject:To: From; bh=jY17lDhsRlthgcItRdb8bxbMJ5wb0sPCcrF/e3EatHU=; b=gE8DW4zwffVDstMdJ8Od z0hM6S2J6h4iV6lev3sjwQoZCTMeEKGxaQkiGxU/XC7VRNabOq1DG/dh/JAUPIMZYH6vHWh+Lzyen DZQH6y4IZNJUeFSlESB9VLLM6BQ/T4gJiXBwI/K8b/PrmLCR1GRT+uHGyHkyU9opTf3FPxusrIn4j DEPXRik0D1MRv8ZNtX8SBDT4buw9PwVEGgTt6EX6a04nqrWhj9cGKUo0B+CT0U4mQ8yphH03NixcT 74IDwJqWFt9vmitvybDvInvIHiThEnTHSm+ULvNkqKX1Wa8VudOTPV7TcDc4ZCXwf7AuFFrVqq8sd ecchqQFQcHZWXg==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:50952 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njS6e-0003sA-Vd; Tue, 26 Apr 2022 16:48:21 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= References: <20220417210453.27884-1-ludo@gnu.org> <20220417210453.27884-4-ludo@gnu.org> <87h76klv6j.fsf@kolabnow.com> Date: Tue, 26 Apr 2022 22:48:18 +0200 In-Reply-To: <87h76klv6j.fsf@kolabnow.com> (Thiago Jung Bauermann's message of "Fri, 22 Apr 2022 17:10:19 -0300") Message-ID: <878rrrk1v1.fsf_-_@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Thiago Jung Bauermann skribis: > I'm a bit concerned about running arbitrary commands as PID 1 of process > namespaces. A process running as PID 1 (even in a child namespace) is a > special case and is treated differently by the Linux kernel than any > other process, so it needs to be a program that has been designed to > work in that situation. There are two differences from regular > processes: > > 1. PID 1 inherits orphan processes and needs to wait() on them when they > quit, in order to avoid accumulating zombie processes in the system. > > 2. Unlike regular processes, PID 1 doesn't have default signal handlers. Actually right now =E2=80=98make-forkexec-constructor/container=E2=80=99 ru= ns processes as PID 1. AFAIK this hasn=E2=80=99t been a problem in practice, probably for two reas= ons: (1) we=E2=80=99re wrapping daemons that don=E2=80=99t fork (unlike Jenkins= =E2=80=A6), and (2) =E2=80=98call-with-container=E2=80=99 installs a SIGINT handler and probabl= y daemons also install SIGTERM and related handlers of their own. Anyway, it=E2=80=99s a class of problem that would be best avoided in the f= irst place! Ludo=E2=80=99. From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH v2 01/15] gexp: Add 'references-file'. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Wed, 27 Apr 2022 16:57:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165107861714642 (code B ref 54997); Wed, 27 Apr 2022 16:57:01 +0000 Received: (at 54997) by debbugs.gnu.org; 27 Apr 2022 16:56:57 +0000 Received: from localhost ([127.0.0.1]:44097 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyG-0003nv-IB for submit@debbugs.gnu.org; Wed, 27 Apr 2022 12:56:57 -0400 Received: from eggs.gnu.org ([209.51.188.92]:41142) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyE-0003nQ-Us for 54997@debbugs.gnu.org; Wed, 27 Apr 2022 12:56:55 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:60000) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njky9-00052q-EK; Wed, 27 Apr 2022 12:56:49 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=6C7LeNL03xVd+APXYMwW88t6a93WeJO2sRkdPIwKDwE=; b=BYtpsqMfot7vpl5DD09m ADXppDCTgfUvy9nJgww1rf4jEUuqGBl7/Ne0SvJWtNVJwnhhdW2BpBh8W3xmd9amQgBwtVvxBaX4Q wQJe9QY5wkazUw4IXiRy1flIwo3MpBdEDHv/EbQeZf+8lN2cMlrLAUncOKj0sGG7vh69Qo/bkhkEG c14L2kvguVK0WQiybT6NOkZMlGP+vtfCaMHSiu5DPzH21DpR7qHZeuvYymB5iCiRQktMr4EOJ22iW +IdLpAIg2YvqRVVkzcJUuzFPslwZhYX30286c2SsYsbYBPLdoj0JUeahq31KR7HbVKylxU9VQlJRv 4QfXjePv5qp++A==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:64439 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1njky8-0000Hl-VF; Wed, 27 Apr 2022 12:56:49 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Wed, 27 Apr 2022 18:56:21 +0200 Message-Id: <20220427165635.8015-2-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220427165635.8015-1-ludo@gnu.org> References: <878rrrk1v1.fsf_-_@gnu.org> <20220427165635.8015-1-ludo@gnu.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/base.scm (references-file): Remove. * guix/gexp.scm (references-file): New procedure. * tests/gexp.scm ("references-file"): New test. --- gnu/services/base.scm | 22 ---------------------- guix/gexp.scm | 44 +++++++++++++++++++++++++++++++++++++++++++ tests/gexp.scm | 18 ++++++++++++++++++ 3 files changed, 62 insertions(+), 22 deletions(-) diff --git a/gnu/services/base.scm b/gnu/services/base.scm index 5d7c69a9cd..182badd97f 100644 --- a/gnu/services/base.scm +++ b/gnu/services/base.scm @@ -219,8 +219,6 @@ (define-module (gnu services base) pam-limits-service-type pam-limits-service - references-file - %base-services)) ;;; Commentary: @@ -1768,26 +1766,6 @@ (define (guix-activation config) (substitute-key-authorization authorized-keys guix) #~#f)))) -(define* (references-file item #:optional (name "references")) - "Return a file that contains the list of references of ITEM." - (if (struct? item) ;lowerable object - (computed-file name - (with-extensions (list guile-gcrypt) ;for store-copy - (with-imported-modules (source-module-closure - '((guix build store-copy))) - #~(begin - (use-modules (guix build store-copy)) - - (call-with-output-file #$output - (lambda (port) - (write (map store-info-item - (call-with-input-file "graph" - read-reference-graph)) - port)))))) - #:options `(#:local-build? #f - #:references-graphs (("graph" ,item)))) - (plain-file name "()"))) - (define guix-service-type (service-type (name 'guix) diff --git a/guix/gexp.scm b/guix/gexp.scm index 9fdb7a30be..ef92223048 100644 --- a/guix/gexp.scm +++ b/guix/gexp.scm @@ -118,6 +118,7 @@ (define-module (guix gexp) mixed-text-file file-union directory-union + references-file imported-files imported-modules @@ -2173,6 +2174,49 @@ (define log-port #:resolve-collision (ungexp resolve-collision))))))))) +(define* (references-file item #:optional (name "references") + #:key guile) + "Return a file that contains the list of direct and indirect references (the +closure) of ITEM." + (if (struct? item) ;lowerable object + (computed-file name + (gexp (begin + (use-modules (srfi srfi-1) + (ice-9 rdelim) + (ice-9 match)) + + (define (drop-lines port n) + ;; Drop N lines read from PORT. + (let loop ((n n)) + (unless (zero? n) + (read-line port) + (loop (- n 1))))) + + (define (read-graph port) + ;; Return the list of references read from + ;; PORT. This is a stripped-down version of + ;; 'read-reference-graph'. + (let loop ((items '())) + (match (read-line port) + ((? eof-object?) + (delete-duplicates items)) + ((? string? item) + (let ((deriver (read-line port)) + (count + (string->number (read-line port)))) + (drop-lines port count) + (loop (cons item items))))))) + + (call-with-output-file (ungexp output) + (lambda (port) + (write (call-with-input-file "graph" + read-graph) + port))))) + #:guile guile + #:options `(#:local-build? #t + #:references-graphs (("graph" ,item)))) + (plain-file name "()"))) + ;;; ;;; Syntactic sugar. diff --git a/tests/gexp.scm b/tests/gexp.scm index c80ca13fab..35bd99e6d4 100644 --- a/tests/gexp.scm +++ b/tests/gexp.scm @@ -1606,6 +1606,24 @@ (define (contents=? file str) (not (member (derivation-file-name native) refs)) (member (derivation-file-name cross) refs)))))) +(test-assertm "references-file" + (let* ((exp #~(symlink #$%bootstrap-guile #$output)) + (computed (computed-file "computed" exp + #:guile %bootstrap-guile)) + (refs (references-file computed "refs" + #:guile %bootstrap-guile))) + (mlet* %store-monad ((drv0 (lower-object %bootstrap-guile)) + (drv1 (lower-object computed)) + (drv2 (lower-object refs))) + (mbegin %store-monad + (built-derivations (list drv2)) + (mlet %store-monad ((refs ((store-lift requisites) + (list (derivation->output-path drv1))))) + (return (lset= string=? + (call-with-input-file (derivation->output-path drv2) + read) + refs))))))) + (test-assert "lower-object & gexp-input-error?" (guard (c ((gexp-input-error? c) (gexp-error-invalid-input c))) -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH v2 00/15] Add "least authority" program wrapper Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: bauermann@kolabnow.com, maximedevos@telenet.be, guix-patches@gnu.org Resent-Date: Wed, 27 Apr 2022 16:57:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= , Thiago Jung Bauermann , Maxime Devos X-Debbugs-Original-Xcc: Thiago Jung Bauermann , Maxime Devos Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165107861714654 (code B ref 54997); Wed, 27 Apr 2022 16:57:01 +0000 Received: (at 54997) by debbugs.gnu.org; 27 Apr 2022 16:56:57 +0000 Received: from localhost ([127.0.0.1]:44101 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyH-0003o6-5x for submit@debbugs.gnu.org; Wed, 27 Apr 2022 12:56:57 -0400 Received: from eggs.gnu.org ([209.51.188.92]:41140) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyE-0003nP-SA for 54997@debbugs.gnu.org; Wed, 27 Apr 2022 12:56:55 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:59996) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njky8-00052f-Pj; Wed, 27 Apr 2022 12:56:48 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=iL3RD1B1BoNLfIKWvnuNl97WsFklxgQCCMaYNuauLD4=; b=CMwUELkPm6vnMfC8t5v7 0WCAsQEEKQchG3pIkabQZDLq6/8gZ0CabKrMoqoM0a3YL0UlfJ3eouIH0TgvZSJLvTr04yN5hsDti dfWIKy/q+FhBvTJO9s8hG1ajbGMaS5mI47l9X+6yXBzhItRkyZYb6uVV2y2cjRh97gU7J79Cuo5kx qtfYUrnGDqWOMJJlUQbcJGRsAfvOhAFYk4Gt3tZfsHZJt+Jh2hHcfRTf9kHSKFHM9RYPaJy6kfZbT 9/mSD5mTN6G1IZf840AxXyKGUIppeaP1auIpDhSmjYLhMlnRliYmdKn/tniDiBTs9ANRRkC6arq3i UbRZSbmWHxaV3A==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:64439 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1njky8-0000Hl-Ab; Wed, 27 Apr 2022 12:56:48 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Wed, 27 Apr 2022 18:56:20 +0200 Message-Id: <20220427165635.8015-1-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <878rrrk1v1.fsf_-_@gnu.org> References: <878rrrk1v1.fsf_-_@gnu.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Hi! Changes since v1: • Add ‘delete-duplicates’ call in ‘references-file’. • Work around unreliable signal delivery in Guile (note that this is not a new problem; I just happened to notice it). This part is unsatisfactory. The solution in the Shepherd is signalfd(2) on GNU/Linux, but using it requires quite a bit of infrastructure. • New #:child-is-pid1? parameter for ‘call-with-container’, set to #false by ‘least-authority-wrapper’. This is probably overkill for most cases (daemons that, unlike Jenkins, don’t run arbitrary user scripts are unlikely to leave zombies behind them), but safer. • Converted opendht service to ‘least-authority-wrapper’. I think it’s good to go. Thoughts? Thanks, Ludo’. Ludovic Courtès (15): gexp: Add 'references-file'. file-systems: Avoid load-time warnings when attempting to load (guix store). linux-container: 'call-with-container' relays SIGTERM and SIGINT. linux-container: Ensure signal-handling asyncs get a chance to run. linux-container: Add #:child-is-pid1? parameter to 'call-with-container'. Add (guix least-authority). services: dicod: Rewrite using 'least-authority-wrapper'. services: dicod: Use 'make-inetd-constructor'. services: bitlbee: Use 'make-inetd-constructor'. services: ipfs: Adjust for Shepherd 0.9. services: ipfs: Use 'least-authority-wrapper'. services: wesnothd: Grant write access to /var/run/wesnothd. services: wesnothd: Use 'least-authority-wrapper'. services: quassel: Use 'least-authority-wrapper'. services: opendht: Use 'least-authority-wrapper'. Makefile.am | 1 + gnu/build/linux-container.scm | 78 +++++++++++++++-- gnu/build/shepherd.scm | 3 +- gnu/services/base.scm | 22 ----- gnu/services/dict.scm | 61 ++++++++----- gnu/services/games.scm | 33 +++++-- gnu/services/messaging.scm | 105 ++++++++++++++-------- gnu/services/networking.scm | 158 +++++++++++++++++----------------- gnu/system/file-systems.scm | 5 +- gnu/tests/messaging.scm | 21 +---- guix/gexp.scm | 44 ++++++++++ guix/least-authority.scm | 135 +++++++++++++++++++++++++++++ tests/gexp.scm | 18 ++++ 13 files changed, 491 insertions(+), 193 deletions(-) create mode 100644 guix/least-authority.scm base-commit: 950f3e4f98add14f645dc4c9f8c512cac7b8a779 -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH v2 02/15] file-systems: Avoid load-time warnings when attempting to load (guix store). Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Wed, 27 Apr 2022 16:58:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165107864514788 (code B ref 54997); Wed, 27 Apr 2022 16:58:02 +0000 Received: (at 54997) by debbugs.gnu.org; 27 Apr 2022 16:57:25 +0000 Received: from localhost ([127.0.0.1]:44131 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyT-0003q9-N7 for submit@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:24 -0400 Received: from eggs.gnu.org ([209.51.188.92]:41146) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyF-0003nS-Jo for 54997@debbugs.gnu.org; Wed, 27 Apr 2022 12:56:56 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:60004) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njkyA-00052y-4g; Wed, 27 Apr 2022 12:56:50 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=tCEcYbLVy9R+D55+gDP9TNw5g86IRjUi6cluKsFFGHM=; b=WhlZ7yVaCgLznS6276Q8 KShLBAvfLOSBvOt3pXDKl/gB8maw0qucTxSfwkMFdacs/XQfAt4RLcHgYfN/s9R+Sgs1Wdr3cyzXJ KLOdY2dH2Bf74sjaOVxSoRz8GU5cwYzmmuIXqIUrHkat5xwx6TybXHv0kCQ29ZlcVSoOg15K3FcZI ickpB4UG+7s0eR0RN50mGiFTv9GlH3S109haNkdzvrs3SRZp2Xmb/XSrX3UNsXvLqT4VenGDmR2vc jGqfXfWlR7ATKet7lAna6AQ7PKzkzOYdA3WjkNRyftIaFiIvLMh9FxOmyiPaG8WRyEGPpBZj1oVHn FkJ9v9XRG1sW1g==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:64439 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1njky9-0000Hl-H5; Wed, 27 Apr 2022 12:56:49 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Wed, 27 Apr 2022 18:56:22 +0200 Message-Id: <20220427165635.8015-3-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220427165635.8015-1-ludo@gnu.org> References: <878rrrk1v1.fsf_-_@gnu.org> <20220427165635.8015-1-ludo@gnu.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) This makes sure warnings like "incompatible bytecode version" don't go through when looking for (guix store). * gnu/system/file-systems.scm (%store-prefix): Parameterize 'current-warning-port' around 'resolve-module' call. --- gnu/system/file-systems.scm | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/gnu/system/file-systems.scm b/gnu/system/file-systems.scm index 437f8da898..f8f4276283 100644 --- a/gnu/system/file-systems.scm +++ b/gnu/system/file-systems.scm @@ -1,5 +1,5 @@ ;;; GNU Guix --- Functional package management for GNU -;;; Copyright © 2013-2021 Ludovic Courtès +;;; Copyright © 2013-2022 Ludovic Courtès ;;; Copyright © 2020 Google LLC ;;; Copyright © 2020 Jakub Kądziołka ;;; Copyright © 2020, 2021 Maxim Cournoyer @@ -272,7 +272,8 @@ (define (%store-prefix) ;; Note: If we have (guix store database) in the search path and we do *not* ;; have (guix store) proper, 'resolve-module' returns an empty (guix store) ;; with one sub-module. - (cond ((and=> (resolve-module '(guix store) #:ensure #f) + (cond ((and=> (parameterize ((current-warning-port (%make-void-port "w0"))) + (resolve-module '(guix store) #:ensure #f)) (lambda (store) (module-variable store '%store-prefix))) => -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH v2 03/15] linux-container: 'call-with-container' relays SIGTERM and SIGINT. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Wed, 27 Apr 2022 16:58:03 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165107864514795 (code B ref 54997); Wed, 27 Apr 2022 16:58:03 +0000 Received: (at 54997) by debbugs.gnu.org; 27 Apr 2022 16:57:25 +0000 Received: from localhost ([127.0.0.1]:44133 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyi-0003qS-Qf for submit@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:25 -0400 Received: from eggs.gnu.org ([209.51.188.92]:41154) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyG-0003nT-8a for 54997@debbugs.gnu.org; Wed, 27 Apr 2022 12:56:56 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:60006) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njkyA-000538-PF; Wed, 27 Apr 2022 12:56:50 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=rOh90PzYsv1YqfC5TCbLeH1wIQOt1L2So7nKBq8+ymU=; b=WP0k3oUOYeyxKhjnc1hw 9U6nKu6J9cfOVSqlnwO+nQRKdHoshoHkixyzuR9cYdvNQ0K4t9chQq9fvV+6o8Y1U2jNhtoqtcD0x afnEiStlu8CillvDoKKZnvFxqVgxw3fUZGoqMtKRBiWX5d20v+i/0oo2trG0XpL6LSR6ZgWIRJawF YRuHSLuZ1Pvg9B0Gj2t6kuX3nAN9vKORb0eOFDd81kcXc6AkLwg/P4PhsxByGiXtsrDfLBMiC6vUS AMWYWFgh1Nugia25uA52QvIE2+xn+pBpiEyPjTq291BsNj+GyAbdpg9WOV6Cwr6knewjVuhr+2Mae HKZ+9Gaemm7wUA==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:64439 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1njkyA-0000Hl-Ah; Wed, 27 Apr 2022 12:56:50 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Wed, 27 Apr 2022 18:56:23 +0200 Message-Id: <20220427165635.8015-4-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220427165635.8015-1-ludo@gnu.org> References: <878rrrk1v1.fsf_-_@gnu.org> <20220427165635.8015-1-ludo@gnu.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/build/linux-container.scm (call-with-container): Add #:relayed-signals. [install-signal-handlers]: New procedure. Call it. --- gnu/build/linux-container.scm | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm index bdeca2cdb9..03c01439ce 100644 --- a/gnu/build/linux-container.scm +++ b/gnu/build/linux-container.scm @@ -303,6 +303,7 @@ (define (call-with-temporary-directory proc) (define* (call-with-container mounts thunk #:key (namespaces %namespaces) (host-uids 1) (guest-uid 0) (guest-gid 0) + (relayed-signals (list SIGINT SIGTERM)) (process-spawned-hook (const #t))) "Run THUNK in a new container process and return its exit status; call PROCESS-SPAWNED-HOOK with the PID of the new process that has been spawned. @@ -320,20 +321,27 @@ (define* (call-with-container mounts thunk #:key (namespaces %namespaces) GUEST-UID and GUEST-GID specify the first UID (respectively GID) that host UIDs (respectively GIDs) map to in the namespace. +RELAYED-SIGNALS is the list of signals that are \"relayed\" to the container +process when caught by its parent. + Note that if THUNK needs to load any additional Guile modules, the relevant module files must be present in one of the mappings in MOUNTS and the Guile load path must be adjusted as needed." + (define (install-signal-handlers pid) + ;; Install handlers that forward signals to PID. + (define (relay-signal signal) + (false-if-exception (kill pid signal))) + + (for-each (lambda (signal) + (sigaction signal relay-signal)) + relayed-signals)) + (call-with-temporary-directory (lambda (root) (let ((pid (run-container root mounts namespaces host-uids thunk #:guest-uid guest-uid #:guest-gid guest-gid))) - ;; Catch SIGINT and kill the container process. - (sigaction SIGINT - (lambda (signum) - (false-if-exception - (kill pid SIGKILL)))) - + (install-signal-handlers pid) (process-spawned-hook pid) (match (waitpid pid) ((_ . status) status)))))) -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH v2 04/15] linux-container: Ensure signal-handling asyncs get a chance to run. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Wed, 27 Apr 2022 16:58:03 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165107864514802 (code B ref 54997); Wed, 27 Apr 2022 16:58:03 +0000 Received: (at 54997) by debbugs.gnu.org; 27 Apr 2022 16:57:25 +0000 Received: from localhost ([127.0.0.1]:44135 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyj-0003qa-6d for submit@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:25 -0400 Received: from eggs.gnu.org ([209.51.188.92]:41158) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyG-0003nW-Nx for 54997@debbugs.gnu.org; Wed, 27 Apr 2022 12:56:57 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:60008) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njkyB-00053E-Ah; Wed, 27 Apr 2022 12:56:51 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=QbRALRKaqmLoEUVK2vFlTVf7B0r6S1MzPcNflli99eg=; b=hZWk9n6SdJZtvBenVWfN U7dWAPmN3Y+ehzVK0suGvT8dcVgpbbsm6lIUxOV50mgSBrnbrUQAAx86SnAhjn8/IQc9yvz0hlXP0 xFo8XgOx00BRi2bAVnT0zBRz6iDtLAENvkZn1Lp1qRvAEhiOA1/vSelEY+rYDsbvtLY6MhukST6Gf +jFHoobymihRAObLDIGs2w4F8u0Rzgg22FwU0UoGA9sltIjoeg3AQYOZIE58WLRv7s63g2Hs8M+gV gxXrHARmPuV2pFjmVrYlmEnokqPnIm/+tk1yxHnapFF9dUk2+pGt8ToWWDj0dzMYqEx4Yo+N+q29b 6bsFAOKTWxQL8A==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:64439 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1njkyA-0000Hl-Uq; Wed, 27 Apr 2022 12:56:51 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Wed, 27 Apr 2022 18:56:24 +0200 Message-Id: <20220427165635.8015-5-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220427165635.8015-1-ludo@gnu.org> References: <878rrrk1v1.fsf_-_@gnu.org> <20220427165635.8015-1-ludo@gnu.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Previously we could enter the blocking 'waitpid' call and miss an opportunity to run the signal handler async. * gnu/build/linux-container.scm (call-with-container) [periodically-schedule-asyncs]: New procedure. [install-signal-handlers]: Call it. --- gnu/build/linux-container.scm | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm index 03c01439ce..1fac8f4b92 100644 --- a/gnu/build/linux-container.scm +++ b/gnu/build/linux-container.scm @@ -327,11 +327,20 @@ (define* (call-with-container mounts thunk #:key (namespaces %namespaces) Note that if THUNK needs to load any additional Guile modules, the relevant module files must be present in one of the mappings in MOUNTS and the Guile load path must be adjusted as needed." + (define (periodically-schedule-asyncs) + ;; XXX: In Guile there's a time window where a signal-handling async could + ;; be queued without being processed by the time we enter a blocking + ;; syscall like waitpid(2) (info "(guile) Signals"). This terrible hack + ;; ensures pending asyncs get a chance to run periodically. + (sigaction SIGALRM (lambda _ (alarm 1))) + (alarm 1)) + (define (install-signal-handlers pid) ;; Install handlers that forward signals to PID. (define (relay-signal signal) (false-if-exception (kill pid signal))) + (periodically-schedule-asyncs) (for-each (lambda (signal) (sigaction signal relay-signal)) relayed-signals)) -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH v2 05/15] linux-container: Add #:child-is-pid1? parameter to 'call-with-container'. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Wed, 27 Apr 2022 16:58:04 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165107864614810 (code B ref 54997); Wed, 27 Apr 2022 16:58:04 +0000 Received: (at 54997) by debbugs.gnu.org; 27 Apr 2022 16:57:26 +0000 Received: from localhost ([127.0.0.1]:44137 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyj-0003qh-Gz for submit@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:25 -0400 Received: from eggs.gnu.org ([209.51.188.92]:41162) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyH-0003nY-9n for 54997@debbugs.gnu.org; Wed, 27 Apr 2022 12:56:57 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:60010) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njkyB-00053L-V5; Wed, 27 Apr 2022 12:56:51 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=0LVydHMmtuL6P5fuXcsSzQJKVSCpXHIOjVuhy0R2jSY=; b=r96BzlNl2Sw7IajVW1Ml nKKKoAgvUq+dGtkCdmVyP7pOByzEiMefcECATDBv5r4BxXIQoI4X/dS0xj6BKn8H3IA+tkBWzzFxE lQJUHj5kVkFKCeSjJ7n6EPnm7Xz2U8/SsPaE5g0ONNc3Zq9hlgEwSq6BhF5xJ9b4X+wNLyqjLzFg+ MBQxWL/nMxseJw5FCn5j/sRqzOlo/aAMZe5k3j/gIOBVgNQWspA6WJxUu3e2gXk1kt7/08niVc5di jL4VE0yIDbvYddib+R8OpywUiAaSRb8bjGLkiMvbx1j+UGUFM9dzh/4cYL/lEEWYJKxcgrZfM04m0 fOWrIAZeoWRNqA==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:64439 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1njkyB-0000Hl-Gg; Wed, 27 Apr 2022 12:56:51 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Wed, 27 Apr 2022 18:56:25 +0200 Message-Id: <20220427165635.8015-6-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220427165635.8015-1-ludo@gnu.org> References: <878rrrk1v1.fsf_-_@gnu.org> <20220427165635.8015-1-ludo@gnu.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/build/linux-container.scm (wait-child-process) (status->exit-status): New procedures. (call-with-container): Add #:child-is-pid1? parameter and honor it. [thunk*]: New variable. Pass it to 'run-container'. --- gnu/build/linux-container.scm | 49 ++++++++++++++++++++++++++++++++++- 1 file changed, 48 insertions(+), 1 deletion(-) diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm index 1fac8f4b92..a0c8174721 100644 --- a/gnu/build/linux-container.scm +++ b/gnu/build/linux-container.scm @@ -301,9 +301,28 @@ (define (call-with-temporary-directory proc) (lambda () (false-if-exception (delete-file-recursively tmp-dir)))))) +(define (wait-child-process) + "Wait for one child process and return a pair, like 'waitpid', or return #f +if there are no child processes left." + (catch 'system-error + (lambda () + (waitpid WAIT_ANY)) + (lambda args + (if (= ECHILD (system-error-errno args)) + #f + (apply throw args))))) + +(define (status->exit-status status) + "Reify STATUS as an exit status." + (or (status:exit-val status) + ;; See . + (+ 128 (or (status:term-sig status) + (status:stop-sig status))))) + (define* (call-with-container mounts thunk #:key (namespaces %namespaces) (host-uids 1) (guest-uid 0) (guest-gid 0) (relayed-signals (list SIGINT SIGTERM)) + (child-is-pid1? #t) (process-spawned-hook (const #t))) "Run THUNK in a new container process and return its exit status; call PROCESS-SPAWNED-HOOK with the PID of the new process that has been spawned. @@ -324,9 +343,37 @@ (define* (call-with-container mounts thunk #:key (namespaces %namespaces) RELAYED-SIGNALS is the list of signals that are \"relayed\" to the container process when caught by its parent. +When CHILD-IS-PID1? is true, and if NAMESPACES contains 'pid', then the child +process runs directly as PID 1. As such, it is responsible for (1) installing +signal handlers and (2) reaping terminated processes by calling 'waitpid'. +When CHILD-IS-PID1? is false, a new intermediate process is created instead +that takes this responsibility. + Note that if THUNK needs to load any additional Guile modules, the relevant module files must be present in one of the mappings in MOUNTS and the Guile load path must be adjusted as needed." + (define thunk* + (if (and (memq 'pid namespaces) + (not child-is-pid1?)) + (lambda () + ;; Behave like an init process: create a sub-process that calls + ;; THUNK, and wait for child processes. Furthermore, forward + ;; RELAYED-SIGNALS to the child process. + (match (primitive-fork) + (0 + (call-with-clean-exit thunk)) + (pid + (install-signal-handlers pid) + (let loop () + (match (wait-child-process) + ((child . status) + (if (= child pid) + (primitive-exit (status->exit-status status)) + (loop))) + (#f + (primitive-exit 128))))))) ;cannot happen + thunk)) + (define (periodically-schedule-asyncs) ;; XXX: In Guile there's a time window where a signal-handling async could ;; be queued without being processed by the time we enter a blocking @@ -347,7 +394,7 @@ (define (relay-signal signal) (call-with-temporary-directory (lambda (root) - (let ((pid (run-container root mounts namespaces host-uids thunk + (let ((pid (run-container root mounts namespaces host-uids thunk* #:guest-uid guest-uid #:guest-gid guest-gid))) (install-signal-handlers pid) -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH v2 12/15] services: wesnothd: Grant write access to /var/run/wesnothd. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Wed, 27 Apr 2022 16:58:04 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165107864614817 (code B ref 54997); Wed, 27 Apr 2022 16:58:04 +0000 Received: (at 54997) by debbugs.gnu.org; 27 Apr 2022 16:57:26 +0000 Received: from localhost ([127.0.0.1]:44139 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyj-0003qo-V6 for submit@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:26 -0400 Received: from eggs.gnu.org ([209.51.188.92]:41184) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyM-0003o9-7s for 54997@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:02 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:60024) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njkyG-00053a-B0; Wed, 27 Apr 2022 12:56:56 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=lhnIdYueYMKsP0FP9RoKNHZvyfi11Q1eoeAAtVW/754=; b=esz7Cd3A1MmXzzn8FT6V cQPVMWv5WrfAfraGhWF0+sC24mmqBYLyNJzfKFUI5C/SwZq8C8fj0rnoWhy7Ut2WTANP3C6crRiL+ fevhBYHiD5ZBNHBEgcb+AsWK3Ld9RuxpQde56XD2OcYXZvNsWUpdnGD4j+DJFaBzGzFGwg+YBkpPa UQqeLp029bfA+4sgJvN7wGfqxpoUga7PjnM5+9Ya4M9c/wVFJkEjsyZl/TbCm4B44Rvwd+tG1Yy1Q PPSS4/cGjUsRCrhJYsVYZWl4rSfm3Mw75wUj886YH82gVVAx8D6wbgJ3Ls5gWK4jxkbCeQaiP0Nww BQR77VmhlfjdWw==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:64439 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1njkyF-0000Hl-Sd; Wed, 27 Apr 2022 12:56:56 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Wed, 27 Apr 2022 18:56:32 +0200 Message-Id: <20220427165635.8015-13-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220427165635.8015-1-ludo@gnu.org> References: <878rrrk1v1.fsf_-_@gnu.org> <20220427165635.8015-1-ludo@gnu.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/games.scm (wesnothd-shepherd-service): Augment 'modules' field. Pass #:mappings argument to 'make-forkexec-constructor/container'. (wesnothd-activation): New variable. (wesnothd-service-type): Extend ACTIVATION-SERVICE-TYPE. --- gnu/services/games.scm | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/gnu/services/games.scm b/gnu/services/games.scm index b743f6a4b6..dc0bfbe9dc 100644 --- a/gnu/services/games.scm +++ b/gnu/services/games.scm @@ -1,5 +1,6 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2018 Arun Isaac +;;; Copyright © 2022 Ludovic Courtès ;;; ;;; This file is part of GNU Guix. ;;; @@ -57,18 +58,35 @@ (define wesnothd-shepherd-service (match-lambda (($ package port) (with-imported-modules (source-module-closure - '((gnu build shepherd))) + '((gnu build shepherd) + (gnu system file-systems))) (shepherd-service (documentation "The Battle for Wesnoth server") (provision '(wesnoth-daemon)) (requirement '(networking)) - (modules '((gnu build shepherd))) + (modules '((gnu build shepherd) + (gnu system file-systems))) (start #~(make-forkexec-constructor/container (list #$(file-append package "/bin/wesnothd") "-p" #$(number->string port)) + #:mappings (list (file-system-mapping + (source "/var/run/wesnothd") + (target source) + (writable? #t))) #:user "wesnothd" #:group "wesnothd")) (stop #~(make-kill-destructor))))))) +(define wesnothd-activation + (with-imported-modules '((guix build utils)) + #~(begin + (use-modules (guix build utils)) + + (let* ((user (getpw "wesnothd")) + (directory "/var/run/wesnothd")) + ;; wesnothd creates a Unix-domain socket in DIRECTORY. + (mkdir-p directory) + (chown directory (passwd:uid user) (passwd:gid user)))))) + (define wesnothd-service-type (service-type (name 'wesnothd) @@ -77,6 +95,8 @@ (define wesnothd-service-type (extensions (list (service-extension account-service-type (const %wesnothd-accounts)) + (service-extension activation-service-type + (const wesnothd-activation)) (service-extension shepherd-root-service-type (compose list wesnothd-shepherd-service)))) (default-value (wesnothd-configuration)))) -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH v2 10/15] services: ipfs: Adjust for Shepherd 0.9. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Wed, 27 Apr 2022 16:58:05 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165107864614824 (code B ref 54997); Wed, 27 Apr 2022 16:58:05 +0000 Received: (at 54997) by debbugs.gnu.org; 27 Apr 2022 16:57:26 +0000 Received: from localhost ([127.0.0.1]:44141 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyk-0003qw-Ab for submit@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:26 -0400 Received: from eggs.gnu.org ([209.51.188.92]:41190) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyM-0003oD-8v for 54997@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:02 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:60020) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njkyE-00053W-Vp; Wed, 27 Apr 2022 12:56:56 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=0pgjMwjdOy4O50Emcy/6rmMMZOHshbrFdP+RNSSj450=; b=J7defC/RnJK9+MCWWfk5 sr0VlAG+oi36Tc2ana5dnGNclzYc3gUf+1RAhEo+eBrpIgzlQeCsAgmb6so+Q1lUCqj7W68jrCBU4 OnoLBvWK/fgkNkjEg8Peo8qdWxgT6IjveUms9JK+C6Q//+BbZCiaEoK8kXYgreLOKYeGvrEi8YKZk z6zaFbz7tyOXgcGU8/9bzRpqcinUHJSgBLF2qYHrrIOHLYKxF1P3zWs5Oc4fyY55GSxko/7uWbH3h 8ghEM4XFEawsq3k40KnXQwKbdQ97uIbHXXx2GjG5n7yHGVDvzPZW/qqsWlkF0eO76zkUmW3o8drwb fDBpPs9ZSGFzug==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:64439 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1njkyE-0000Hl-FY; Wed, 27 Apr 2022 12:56:54 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Wed, 27 Apr 2022 18:56:30 +0200 Message-Id: <20220427165635.8015-11-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220427165635.8015-1-ludo@gnu.org> References: <878rrrk1v1.fsf_-_@gnu.org> <20220427165635.8015-1-ludo@gnu.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) This is a followup to e1f0c88ea221d846b5a533c4dc88e99e953af63e. * gnu/services/networking.scm (%ipfs-activation)[shepherd&co]: New variable. [container-gexp]: Use it. --- gnu/services/networking.scm | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm index 5bb8638930..b302be5aaf 100644 --- a/gnu/services/networking.scm +++ b/gnu/services/networking.scm @@ -2074,12 +2074,19 @@ (define inner-gexp #$@(map (cute apply set-config!-gexp <>) settings))) (define inner-script (program-file "ipfs-activation-inner" inner-gexp)) + + (define shepherd&co + ;; 'make-forkexec-constructor/container' needs version 0.9 for + ;; #:supplementary-groups. + (cons shepherd-0.9 + (list (lookup-package-input shepherd-0.9 "guile-fibers")))) + ;; Run ipfs init and ipfs config from a container, ;; in case the IPFS daemon was compromised at some point ;; and ~/.ipfs is now a symlink to somewhere outside ;; %ipfs-home. (define container-gexp - (with-extensions (list shepherd) + (with-extensions shepherd&co (with-imported-modules (source-module-closure '((gnu build shepherd) (gnu system file-systems))) -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH v2 08/15] services: dicod: Use 'make-inetd-constructor'. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Wed, 27 Apr 2022 16:58:05 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165107864714831 (code B ref 54997); Wed, 27 Apr 2022 16:58:05 +0000 Received: (at 54997) by debbugs.gnu.org; 27 Apr 2022 16:57:27 +0000 Received: from localhost ([127.0.0.1]:44143 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyk-0003r3-Ks for submit@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:26 -0400 Received: from eggs.gnu.org ([209.51.188.92]:41188) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyM-0003oC-8w for 54997@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:03 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:60016) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njkyD-00053U-OJ; Wed, 27 Apr 2022 12:56:56 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=MQpPXdmT27Sc0jQcJN7CCKM6M2Rthov0aXprrffF8VE=; b=AWhfDRPaYFltgn7hq4ZO 61RRDWgGNC7OspGe6YFl8bVJokegxytw2op+0GMNqHjmdYRVuFGWMDJmtym/8HiONr0dBTlNP/2Ay g75J24IPH6nR7KrTdB0rHfP4CcSDTmDtz/6fp/U0h2NYz3ZYT/MEaVydtcjBetS5Kuo1CI4XqWpiA 1MYEq2GwVt1WqRY54Ymvem9vBuY3b6wABa1ys9jqtZ9psbmqThjNZ0OeNfZm60YgMNsX/1aDrrrQK 5Nx8/RVyJV9Gs18y2tlMex6jVpvkZixJndBEqFCbSrLuMbeY6niIfjGyPVcVxTuc2IOmoJeRAWvAR SRoWlndTT6O4Wg==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:64439 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1njkyD-0000Hl-C2; Wed, 27 Apr 2022 12:56:53 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Wed, 27 Apr 2022 18:56:28 +0200 Message-Id: <20220427165635.8015-9-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220427165635.8015-1-ludo@gnu.org> References: <878rrrk1v1.fsf_-_@gnu.org> <20220427165635.8015-1-ludo@gnu.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/dict.scm (dicod-shepherd-service): Use 'make-inetd-constructor' in the 'start' method when available. --- gnu/services/dict.scm | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/gnu/services/dict.scm b/gnu/services/dict.scm index 62b21f8d53..109917c05c 100644 --- a/gnu/services/dict.scm +++ b/gnu/services/dict.scm @@ -146,6 +146,7 @@ (define %dicod-activation (define (dicod-shepherd-service config) (let* ((dicod.conf (dicod-configuration-file config)) + (interfaces (dicod-configuration-interfaces config)) (dicod (least-authority-wrapper (file-append (dicod-configuration-dico config) "/bin/dicod") @@ -165,10 +166,19 @@ (define (dicod-shepherd-service config) (provision '(dicod)) (requirement '(user-processes)) (documentation "Run the dicod daemon.") - (start #~(make-forkexec-constructor - (list #$dicod "--foreground" - (string-append "--config=" #$dicod.conf)) - #:user "dicod" #:group "dicod")) + (start #~(if (and (defined? 'make-inetd-constructor) + #$(= 1 (length interfaces))) ;XXX + (make-inetd-constructor + (list #$dicod "--inetd" "--foreground" + (string-append "--config=" #$dicod.conf)) + (addrinfo:addr + (car (getaddrinfo #$(first interfaces) "dict"))) + #:user "dicod" #:group "dicod" + #:service-name-stem "dicod") + (make-forkexec-constructor + (list #$dicod "--foreground" + (string-append "--config=" #$dicod.conf)) + #:user "dicod" #:group "dicod"))) (stop #~(make-kill-destructor)))))) (define dicod-service-type -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH v2 06/15] Add (guix least-authority). Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Wed, 27 Apr 2022 16:58:05 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165107864714839 (code B ref 54997); Wed, 27 Apr 2022 16:58:05 +0000 Received: (at 54997) by debbugs.gnu.org; 27 Apr 2022 16:57:27 +0000 Received: from localhost ([127.0.0.1]:44145 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyk-0003rA-Vi for submit@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:27 -0400 Received: from eggs.gnu.org ([209.51.188.92]:41196) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyM-0003oF-9J for 54997@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:04 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:60012) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njkyC-00053S-KL; Wed, 27 Apr 2022 12:56:56 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=zSsIqSMO7CqR4PBtRZSYQv41k1Bfnhdhycb7G9A9iHo=; b=E3z2m4wuqT+l5P9Ym487 PZa4g93CC51FcoLofErhzGtK+O4XXh3eqRz2znCvSq8lG5huqhAXq147aTfZaxPEbK4Bs+7sX3+2p iB+UEWQlOljLNHqMpHnAmowekbutHuN/R34PlpGlzF/GPCRaxfRfo+XAsDue3jTogY0Dqxotv2Opl UQAuMs/gsR/XXChPwMqXzITclxQzh6S/Ofqxyi7BFd30zELXp6OGN82CH6zDz2vsOtH7v7RjT1e9t 8VXH3iSN0G7ktECisGMu73if7WU0zJfZMF6yHE7HeCIj2rsclPKvf9yiwqOFnqMfjQd79dL+tzpS7 sCfyiFLnZZkw/A==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:64439 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1njkyC-0000Hl-4Y; Wed, 27 Apr 2022 12:56:52 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Wed, 27 Apr 2022 18:56:26 +0200 Message-Id: <20220427165635.8015-7-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220427165635.8015-1-ludo@gnu.org> References: <878rrrk1v1.fsf_-_@gnu.org> <20220427165635.8015-1-ludo@gnu.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * guix/least-authority.scm: New file. * Makefile.am (MODULES): Add it. * gnu/build/shepherd.scm (default-mounts): Make public. --- Makefile.am | 1 + gnu/build/shepherd.scm | 3 +- guix/least-authority.scm | 135 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 138 insertions(+), 1 deletion(-) create mode 100644 guix/least-authority.scm diff --git a/Makefile.am b/Makefile.am index fecce7c6f7..d0d58da4e3 100644 --- a/Makefile.am +++ b/Makefile.am @@ -130,6 +130,7 @@ MODULES = \ guix/cache.scm \ guix/cve.scm \ guix/workers.scm \ + guix/least-authority.scm \ guix/ipfs.scm \ guix/build-system.scm \ guix/build-system/android-ndk.scm \ diff --git a/gnu/build/shepherd.scm b/gnu/build/shepherd.scm index d52e53eb78..f4caefce3c 100644 --- a/gnu/build/shepherd.scm +++ b/gnu/build/shepherd.scm @@ -31,7 +31,8 @@ (define-module (gnu build shepherd) exec-command %precious-signals) #:autoload (shepherd system) (unblock-signals) - #:export (make-forkexec-constructor/container + #:export (default-mounts + make-forkexec-constructor/container fork+exec-command/container)) ;;; Commentary: diff --git a/guix/least-authority.scm b/guix/least-authority.scm new file mode 100644 index 0000000000..d871816fca --- /dev/null +++ b/guix/least-authority.scm @@ -0,0 +1,135 @@ +;;; GNU Guix --- Functional package management for GNU +;;; Copyright © 2022 Ludovic Courtès +;;; +;;; This file is part of GNU Guix. +;;; +;;; GNU Guix is free software; you can redistribute it and/or modify it +;;; under the terms of the GNU General Public License as published by +;;; the Free Software Foundation; either version 3 of the License, or (at +;;; your option) any later version. +;;; +;;; GNU Guix is distributed in the hope that it will be useful, but +;;; WITHOUT ANY WARRANTY; without even the implied warranty of +;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +;;; GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License +;;; along with GNU Guix. If not, see . + +(define-module (guix least-authority) + #:use-module (guix gexp) + #:use-module (guix modules) + #:use-module ((guix store) #:select (%store-prefix)) + #:autoload (gnu build linux-container) (%namespaces) + #:autoload (gnu system file-systems) (file-system-mapping + file-system-mapping-source + spec->file-system + file-system->spec + file-system-mapping->bind-mount) + #:export (least-authority-wrapper)) + +;;; Commentary: +;;; +;;; This module provides tools to execute programs with the least authority +;;; necessary, using Linux namespaces. +;;; +;;; Code: + +(define %precious-variables + ;; Environment variables preserved by the wrapper by default. + '("HOME" "USER" "LOGNAME" "DISPLAY" "XAUTHORITY" "TERM" "TZ" "PAGER")) + +(define* (least-authority-wrapper program + #:key (name "pola-wrapper") + (guest-uid 1000) + (guest-gid 1000) + (mappings '()) + (namespaces %namespaces) + (directory "/") + (preserved-environment-variables + %precious-variables)) + "Return a wrapper of PROGRAM that executes it with the least authority. + +PROGRAM is executed in separate namespaces according to NAMESPACES, a list of +symbols; it turns with GUEST-UID and GUEST-GID. MAPPINGS is a list of + records indicating directories mirrored inside the +execution environment of PROGRAM. DIRECTORY is the working directory of the +wrapped process. Each environment listed in PRESERVED-ENVIRONMENT-VARIABLES +is preserved; other environment variables are erased." + (define code + (with-imported-modules (source-module-closure + '((gnu system file-systems) + (gnu build shepherd) + (gnu build linux-container))) + #~(begin + (use-modules (gnu system file-systems) + (gnu build linux-container) + ((gnu build shepherd) #:select (default-mounts)) + (srfi srfi-1)) + + (define variables + (filter-map (lambda (variable) + (let ((value (getenv variable))) + (and value + (string-append variable "=" value)))) + '#$preserved-environment-variables)) + + (define (read-file file) + (call-with-input-file file read)) + + (define references + (delete-duplicates + (append-map read-file + '#$(map references-file + (cons program + (map file-system-mapping-source + mappings)))))) + + (define (store? file-system) + (string=? (file-system-mount-point file-system) + #$(%store-prefix))) + + (define mounts + (append (map (lambda (item) + (file-system-mapping->bind-mount + (file-system-mapping (source item) + (target item)))) + references) + (remove store? + (default-mounts + #:namespaces '#$namespaces)) + (map spec->file-system + '#$(map (compose file-system->spec + file-system-mapping->bind-mount) + mappings)))) + + (define (reify-exit-status status) + (cond ((status:exit-val status) => exit) + ((or (status:term-sig status) + (status:stop-sig status)) + => (lambda (signal) + (format (current-error-port) + "~a terminated with signal ~a~%" + #$program signal) + (exit (+ 128 signal)))))) + + ;; Note: 'call-with-container' creates a sub-process that this one + ;; waits for. This might seem suboptimal but unshare(2) isn't + ;; really applicable: the process would still run in the same PID + ;; namespace. + + (reify-exit-status + (call-with-container mounts + (lambda () + (chdir #$directory) + (environ variables) + (apply execl #$program #$program (cdr (command-line)))) + + ;; Don't assume PROGRAM can behave as an init process. + #:child-is-pid1? #f + + #:guest-uid #$guest-uid + #:guest-gid #$guest-gid + #:namespaces '#$namespaces))))) + + (program-file name code)) -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH v2 07/15] services: dicod: Rewrite using 'least-authority-wrapper'. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Wed, 27 Apr 2022 16:58:06 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165107864714846 (code B ref 54997); Wed, 27 Apr 2022 16:58:06 +0000 Received: (at 54997) by debbugs.gnu.org; 27 Apr 2022 16:57:27 +0000 Received: from localhost ([127.0.0.1]:44147 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyl-0003rI-FQ for submit@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:27 -0400 Received: from eggs.gnu.org ([209.51.188.92]:41202) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyM-0003oG-9K for 54997@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:04 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:60014) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njkyD-00053T-61; Wed, 27 Apr 2022 12:56:56 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=C/R40NJJCuw3AQnu9NbuQVkDnge+l5uFaKySskrcw5Q=; b=bmHIymvuojKW8WQiSTl2 OJET/guKDR2HbZixwfAHQtqIElfXRKr+VHgY2YamLSp0RKpK2iiS6VLgjyoTjEtYcgTNrd7SGsTMi In/gX2vJmOuAuWtO77mtB6PyvqEVdMymtDDWIhz0Oyo3OsF3O4VNfpg0TqD3sXWSUT2w2hUSoxPb0 Ec1hiaMcC3EBHsgIFUvKraza+QSMIhbgMYk5ENRA1p6SOMAobV6dweFEg5HFJA+5kKaRZpFCUzGXd xC1KFm74YIHPThpgZNsnOPFA2syWRGajEgLuTaRRKJHRfAbujJGeWn2hY0Lr6sCOGxhZ27Mh/SDSk rhJ29kixQSQZJA==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:64439 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1njkyC-0000Hl-QQ; Wed, 27 Apr 2022 12:56:53 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Wed, 27 Apr 2022 18:56:27 +0200 Message-Id: <20220427165635.8015-8-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220427165635.8015-1-ludo@gnu.org> References: <878rrrk1v1.fsf_-_@gnu.org> <20220427165635.8015-1-ludo@gnu.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/dict.scm (dicod-shepherd-service): Rewrite using 'least-authority-wrapper' plus 'make-forkexec-constructor' instead of 'make-forkexec-constructor/container'. --- gnu/services/dict.scm | 51 ++++++++++++++++++++++++------------------- 1 file changed, 29 insertions(+), 22 deletions(-) diff --git a/gnu/services/dict.scm b/gnu/services/dict.scm index a97ad8f608..62b21f8d53 100644 --- a/gnu/services/dict.scm +++ b/gnu/services/dict.scm @@ -1,6 +1,6 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2016 Sou Bunnbu -;;; Copyright © 2016, 2017, 2018, 2020 Ludovic Courtès +;;; Copyright © 2016, 2017, 2018, 2020, 2022 Ludovic Courtès ;;; Copyright © 2017 Huang Ying ;;; ;;; This file is part of GNU Guix. @@ -22,12 +22,15 @@ (define-module (gnu services dict) #:use-module (guix gexp) #:use-module (guix records) #:use-module (guix modules) + #:use-module (guix least-authority) #:use-module (gnu services) #:use-module (gnu services shepherd) #:use-module (gnu system shadow) #:use-module ((gnu packages admin) #:select (shadow)) #:use-module (gnu packages dico) #:use-module (gnu packages dictionaries) + #:autoload (gnu build linux-container) (%namespaces) + #:autoload (gnu system file-systems) (file-system-mapping) #:use-module (srfi srfi-1) #:use-module (srfi srfi-26) #:use-module (ice-9 match) @@ -142,27 +145,31 @@ (define %dicod-activation (chown rundir (passwd:uid user) (passwd:gid user))))) (define (dicod-shepherd-service config) - (let ((dicod (file-append (dicod-configuration-dico config) - "/bin/dicod")) - (dicod.conf (dicod-configuration-file config))) - (with-imported-modules (source-module-closure - '((gnu build shepherd) - (gnu system file-systems))) - (list (shepherd-service - (provision '(dicod)) - (requirement '(user-processes)) - (documentation "Run the dicod daemon.") - (modules '((gnu build shepherd) - (gnu system file-systems))) - (start #~(make-forkexec-constructor/container - (list #$dicod "--foreground" - (string-append "--config=" #$dicod.conf)) - #:user "dicod" #:group "dicod" - #:mappings (list (file-system-mapping - (source "/var/run/dicod") - (target source) - (writable? #t))))) - (stop #~(make-kill-destructor))))))) + (let* ((dicod.conf (dicod-configuration-file config)) + (dicod (least-authority-wrapper + (file-append (dicod-configuration-dico config) + "/bin/dicod") + #:name "dicod" + #:mappings (list (file-system-mapping + (source "/var/run/dicod") + (target source) + (writable? #t)) + (file-system-mapping + (source "/dev/log") + (target source)) + (file-system-mapping + (source dicod.conf) + (target source))) + #:namespaces (delq 'net %namespaces)))) + (list (shepherd-service + (provision '(dicod)) + (requirement '(user-processes)) + (documentation "Run the dicod daemon.") + (start #~(make-forkexec-constructor + (list #$dicod "--foreground" + (string-append "--config=" #$dicod.conf)) + #:user "dicod" #:group "dicod")) + (stop #~(make-kill-destructor)))))) (define dicod-service-type (service-type -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH v2 13/15] services: wesnothd: Use 'least-authority-wrapper'. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Wed, 27 Apr 2022 16:58:06 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165107864814854 (code B ref 54997); Wed, 27 Apr 2022 16:58:06 +0000 Received: (at 54997) by debbugs.gnu.org; 27 Apr 2022 16:57:28 +0000 Received: from localhost ([127.0.0.1]:44149 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyl-0003rP-Sa for submit@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:28 -0400 Received: from eggs.gnu.org ([209.51.188.92]:41216) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyM-0003oP-Rg for 54997@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:04 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:60028) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njkyH-00053x-2O; Wed, 27 Apr 2022 12:56:57 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=Fs0Td2FhdDbA9Zx7+m4bcoGIq+I66Pyd3wX+b3zcZ+U=; b=hbwcMra4Xc8cZ3I+X9uD Mv1UPDS7LsnRjU8qORE+9X11qEX8NT+0k3mNqb54VphkewYh7qpPezLNt3pEqNn4cAeNT5m/zwVmt sOCOdYmqXVqkGtck5iHf2xiP361hUvW9T1MWgUnjpdgaFb+ldVMkpyBt9maFTq030oeumve9MI6Mn 55E7v4V2dw2V1ZM/xzSGxIny0+zqt3zTN2swnCY33CPiET81wTW8b9kMV1Z2pVsiJquLFn/aY+sA/ DoIjpPnZP9OkWa4Hk0fM5SslFpDvhtAnq1HzGE++ulBbBxhMOWsVZo/MhOuP7if3eV/v2IMaLPcTV stWBdd0tCn2e0Q==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:64439 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1njkyG-0000Hl-GB; Wed, 27 Apr 2022 12:56:56 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Wed, 27 Apr 2022 18:56:33 +0200 Message-Id: <20220427165635.8015-14-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220427165635.8015-1-ludo@gnu.org> References: <878rrrk1v1.fsf_-_@gnu.org> <20220427165635.8015-1-ludo@gnu.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/games.scm (wesnothd-shepherd-service): Use 'least-authority-wrapper' instead of 'make-forkexec-constructor/container'. --- gnu/services/games.scm | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/gnu/services/games.scm b/gnu/services/games.scm index dc0bfbe9dc..6c2af44b49 100644 --- a/gnu/services/games.scm +++ b/gnu/services/games.scm @@ -23,6 +23,9 @@ (define-module (gnu services games) #:use-module (gnu packages admin) #:use-module (gnu packages games) #:use-module (gnu system shadow) + #:use-module ((gnu system file-systems) #:select (file-system-mapping)) + #:use-module (gnu build linux-container) + #:autoload (guix least-authority) (least-authority-wrapper) #:use-module (guix gexp) #:use-module (guix modules) #:use-module (guix records) @@ -57,22 +60,20 @@ (define %wesnothd-accounts (define wesnothd-shepherd-service (match-lambda (($ package port) - (with-imported-modules (source-module-closure - '((gnu build shepherd) - (gnu system file-systems))) + (let ((wesnothd (least-authority-wrapper + (file-append package "/bin/wesnothd") + #:name "wesnothd" + #:mappings (list (file-system-mapping + (source "/var/run/wesnothd") + (target source) + (writable? #t))) + #:namespaces (delq 'net %namespaces)))) (shepherd-service (documentation "The Battle for Wesnoth server") (provision '(wesnoth-daemon)) (requirement '(networking)) - (modules '((gnu build shepherd) - (gnu system file-systems))) - (start #~(make-forkexec-constructor/container - (list #$(file-append package "/bin/wesnothd") - "-p" #$(number->string port)) - #:mappings (list (file-system-mapping - (source "/var/run/wesnothd") - (target source) - (writable? #t))) + (start #~(make-forkexec-constructor + (list #$wesnothd "-p" #$(number->string port)) #:user "wesnothd" #:group "wesnothd")) (stop #~(make-kill-destructor))))))) -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH v2 09/15] services: bitlbee: Use 'make-inetd-constructor'. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Wed, 27 Apr 2022 16:58:07 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165107864814861 (code B ref 54997); Wed, 27 Apr 2022 16:58:07 +0000 Received: (at 54997) by debbugs.gnu.org; 27 Apr 2022 16:57:28 +0000 Received: from localhost ([127.0.0.1]:44151 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkym-0003rX-68 for submit@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:28 -0400 Received: from eggs.gnu.org ([209.51.188.92]:41206) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyM-0003oH-A0 for 54997@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:05 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:60018) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njkyE-00053V-9X; Wed, 27 Apr 2022 12:56:56 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=hqz/X8pTaIpKmynCFVw6ehRqbeudnNNz6KcSmFlF8kU=; b=rcDgwWx/SLkrWvN4vyPR iLMXD3heLe3Fv5VouzjEltDIWB4WMopZkDb2l0eVY52KPqxyEWoOI7Mj3XabhQPBfhkvn5JQmVTuq KmXBVnL/YjgHMlpnelfRx7+kNCg/97nXY4vqttxa4vZS0TDDJzL0+IdoY60GbkuJ1RTqe004yC/cE DMIqTFPT+Zy4A+6gYcmBT19IZc5HjIO7bVa/I2xMMioFkH/CpolFwLK3MrWCIoAita81zfu7V85jf kmFxrtdRu0ZoMVxpHO0lVHOd54YxmE7sJA7x5X5wS1rkv3qQmOQB3sDt/WVIihJ0ZwNqIrkOvEPHV RdPqDZ52x3Ustw==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:64439 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1njkyD-0000Hl-U3; Wed, 27 Apr 2022 12:56:54 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Wed, 27 Apr 2022 18:56:29 +0200 Message-Id: <20220427165635.8015-10-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220427165635.8015-1-ludo@gnu.org> References: <878rrrk1v1.fsf_-_@gnu.org> <20220427165635.8015-1-ludo@gnu.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/messaging.scm (bitlbee-shepherd-service): Add call to 'least-authority-wrapper'. In 'start' method, use 'make-inetd-constructor' when available. * gnu/tests/messaging.scm (run-bitlbee-test)["valid PID"]: Remove test. --- gnu/services/messaging.scm | 63 ++++++++++++++++++++++++++++---------- gnu/tests/messaging.scm | 21 +------------ 2 files changed, 48 insertions(+), 36 deletions(-) diff --git a/gnu/services/messaging.scm b/gnu/services/messaging.scm index 4bceb1d37a..7fdd8cf285 100644 --- a/gnu/services/messaging.scm +++ b/gnu/services/messaging.scm @@ -1,7 +1,7 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2017, 2018 Clément Lassieur ;;; Copyright © 2017 Mathieu Othacehe -;;; Copyright © 2015, 2017, 2018, 2019, 2020 Ludovic Courtès +;;; Copyright © 2015, 2017-2020, 2022 Ludovic Courtès ;;; Copyright © 2018 Pierre-Antoine Rouby ;;; ;;; This file is part of GNU Guix. @@ -28,11 +28,14 @@ (define-module (gnu services messaging) #:use-module (gnu services shepherd) #:use-module (gnu services configuration) #:use-module (gnu system shadow) + #:autoload (gnu build linux-container) (%namespaces) + #:use-module ((gnu system file-systems) #:select (file-system-mapping)) #:use-module (guix gexp) #:use-module (guix modules) #:use-module (guix records) #:use-module (guix packages) #:use-module (guix deprecation) + #:use-module (guix least-authority) #:use-module (srfi srfi-1) #:use-module (srfi srfi-35) #:use-module (ice-9 match) @@ -821,7 +824,18 @@ (define bitlbee-shepherd-service DaemonInterface = " interface " DaemonPort = " (number->string port) " PluginDir = " plugins "/lib/bitlbee -" extra-settings))) +" extra-settings)) + (bitlbee* (least-authority-wrapper + (file-append bitlbee "/sbin/bitlbee") + #:name "bitlbee" + #:mappings (list (file-system-mapping + (source "/var/lib/bitlbee") + (target source) + (writable? #t)) + (file-system-mapping + (source conf) + (target conf))) + #:namespaces (delq 'net %namespaces)))) (with-imported-modules (source-module-closure '((gnu build shepherd) @@ -836,20 +850,37 @@ (define bitlbee-shepherd-service (modules '((gnu build shepherd) (gnu system file-systems))) - (start #~(make-forkexec-constructor/container - (list #$(file-append bitlbee "/sbin/bitlbee") - "-n" "-F" "-u" "bitlbee" "-c" #$conf) - - ;; Allow 'bitlbee-purple' to use libpurple plugins. - #:environment-variables - (list (string-append "PURPLE_PLUGIN_PATH=" - #$plugins "/lib/purple-2")) - - #:pid-file "/var/run/bitlbee.pid" - #:mappings (list (file-system-mapping - (source "/var/lib/bitlbee") - (target source) - (writable? #t))))) + (start #~(if (defined? 'make-inetd-constructor) + + (make-inetd-constructor + (list #$bitlbee* "-I" + "-u" "bitlbee" "-c" #$conf) + (addrinfo:addr + (car (getaddrinfo #$interface + #$(number->string port) + (logior AI_NUMERICHOST + AI_NUMERICSERV)))) + #:service-name-stem "bitlbee" + + ;; Allow 'bitlbee-purple' to use libpurple plugins. + #:environment-variables + (list (string-append "PURPLE_PLUGIN_PATH=" + #$plugins "/lib/purple-2"))) + + (make-forkexec-constructor/container + (list #$(file-append bitlbee "/sbin/bitlbee") + "-n" "-F" "-u" "bitlbee" "-c" #$conf) + + ;; Allow 'bitlbee-purple' to use libpurple plugins. + #:environment-variables + (list (string-append "PURPLE_PLUGIN_PATH=" + #$plugins "/lib/purple-2")) + + #:pid-file "/var/run/bitlbee.pid" + #:mappings (list (file-system-mapping + (source "/var/lib/bitlbee") + (target source) + (writable? #t)))))) (stop #~(make-kill-destructor))))))))) (define %bitlbee-accounts diff --git a/gnu/tests/messaging.scm b/gnu/tests/messaging.scm index 202a1c2f73..1e26c0ddea 100644 --- a/gnu/tests/messaging.scm +++ b/gnu/tests/messaging.scm @@ -1,6 +1,6 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2017, 2018 Clément Lassieur -;;; Copyright © 2017, 2018, 2021 Ludovic Courtès +;;; Copyright © 2017-2018, 2021-2022 Ludovic Courtès ;;; Copyright © 2018 Efraim Flashner ;;; ;;; This file is part of GNU Guix. @@ -198,25 +198,6 @@ (define marionette (start-service 'bitlbee)) marionette)) - (test-equal "valid PID" - #$(file-append bitlbee "/sbin/bitlbee") - (marionette-eval - '(begin - (use-modules (srfi srfi-1) - (gnu services herd)) - - (let ((bitlbee - (find (lambda (service) - (equal? '(bitlbee) - (live-service-provision service))) - (current-services)))) - (and (pk 'bitlbee-service bitlbee) - (let ((pid (live-service-running bitlbee))) - (readlink (string-append "/proc/" - (number->string pid) - "/exe")))))) - marionette)) - (test-assert "connect" (let* ((address (make-socket-address AF_INET INADDR_LOOPBACK 6667)) -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH v2 11/15] services: ipfs: Use 'least-authority-wrapper'. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Wed, 27 Apr 2022 16:58:07 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165107864914869 (code B ref 54997); Wed, 27 Apr 2022 16:58:07 +0000 Received: (at 54997) by debbugs.gnu.org; 27 Apr 2022 16:57:29 +0000 Received: from localhost ([127.0.0.1]:44153 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkym-0003re-Mz for submit@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:29 -0400 Received: from eggs.gnu.org ([209.51.188.92]:41192) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyM-0003oE-90 for 54997@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:05 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:60022) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njkyF-00053Y-Mk; Wed, 27 Apr 2022 12:56:56 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=KxaDcRI/s/OmdSnaAoayJmj06Soqk6ikskfeRXujx90=; b=iiV7NLD5piecRmN+TyYX DvyD1zJxsLRoK4A/ttT5CsyqFMLGnEElZLmbtdpwUcmhSpKAuXzHeYNWIOc9hR815Pl96Ge/Pz0A1 FuyCqVbURKqD1C6wm+TLtSqG2tZtudrKhCQqY7QgV869dJrpGb9YClKw1Ev1vwYK/NmgFfcBAqDo7 biuQECw3z8v6l1QaCNxMPUVNoe+Szd5HS2HdBiREPm2A5Jb9+TVixVsEt9pzDjbhp0r2ZC/KbgnV7 +hPkCPvBGETXzCJ6vPWbfyZ56Qf+1cDYy9Low5vllyPYTg/qkKog0grU8AKx5lpWTO93kK+q95cwd urikruJXsWtVCQ==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:64439 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1njkyF-0000Hl-5f; Wed, 27 Apr 2022 12:56:55 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Wed, 27 Apr 2022 18:56:31 +0200 Message-Id: <20220427165635.8015-12-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220427165635.8015-1-ludo@gnu.org> References: <878rrrk1v1.fsf_-_@gnu.org> <20220427165635.8015-1-ludo@gnu.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/networking.scm (ipfs-binary): Call 'least-authority-wrapper'. (%ipfs-home-mapping): Remove surrounding gexp. (ipfs-shepherd-service)[exec-command]: New procedure. [ipfs-config-command, set-config!-gexp, shepherd&co] [container-gexp, container-script]: Remove. [inner-gexp]: Use 'exec-command'. --- gnu/services/networking.scm | 123 +++++++++++++++++------------------- 1 file changed, 58 insertions(+), 65 deletions(-) diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm index b302be5aaf..4708ade0ca 100644 --- a/gnu/services/networking.scm +++ b/gnu/services/networking.scm @@ -1,5 +1,5 @@ ;;; GNU Guix --- Functional package management for GNU -;;; Copyright © 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021 Ludovic Courtès +;;; Copyright © 2013-2022 Ludovic Courtès ;;; Copyright © 2015 Mark H Weaver ;;; Copyright © 2016, 2018, 2020 Efraim Flashner ;;; Copyright © 2016 John Darrington @@ -43,6 +43,7 @@ (define-module (gnu services networking) #:use-module (gnu services dbus) #:use-module (gnu system shadow) #:use-module (gnu system pam) + #:use-module ((gnu system file-systems) #:select (file-system-mapping)) #:use-module (gnu packages admin) #:use-module (gnu packages base) #:use-module (gnu packages bash) @@ -59,6 +60,7 @@ (define-module (gnu services networking) #:use-module (gnu packages gnome) #:use-module (gnu packages ipfs) #:use-module (gnu build linux-container) + #:autoload (guix least-authority) (least-authority-wrapper) #:use-module (guix gexp) #:use-module (guix records) #:use-module (guix modules) @@ -2018,13 +2020,20 @@ (define %ipfs-accounts (system? #t)))) (define (ipfs-binary config) - (file-append (ipfs-configuration-package config) "/bin/ipfs")) + (define command + (file-append (ipfs-configuration-package config) "/bin/ipfs")) + + (least-authority-wrapper + command + #:name "ipfs" + #:mappings (list %ipfs-home-mapping) + #:namespaces (delq 'net %namespaces))) (define %ipfs-home-mapping - #~(file-system-mapping - (source #$%ipfs-home) - (target #$%ipfs-home) - (writable? #t))) + (file-system-mapping + (source %ipfs-home) + (target %ipfs-home) + (writable? #t))) (define %ipfs-environment #~(list #$(string-append "HOME=" %ipfs-home))) @@ -2033,82 +2042,66 @@ (define (ipfs-shepherd-service config) "Return a for IPFS with CONFIG." (define ipfs-daemon-command #~(list #$(ipfs-binary config) "daemon")) - (list - (with-imported-modules (source-module-closure - '((gnu build shepherd) - (gnu system file-systems))) - (shepherd-service - (provision '(ipfs)) - ;; While IPFS is most useful when the machine is connected - ;; to the network, only loopback is required for starting - ;; the service. - (requirement '(loopback)) - (documentation "Connect to the IPFS network") - (modules '((gnu build shepherd) - (gnu system file-systems))) - (start #~(make-forkexec-constructor/container - #$ipfs-daemon-command - #:namespaces '#$(fold delq %namespaces '(user net)) - #:mappings (list #$%ipfs-home-mapping) - #:log-file "/var/log/ipfs.log" - #:user "ipfs" - #:group "ipfs" - #:environment-variables #$%ipfs-environment)) - (stop #~(make-kill-destructor)))))) + + (list (shepherd-service + (provision '(ipfs)) + ;; While IPFS is most useful when the machine is connected + ;; to the network, only loopback is required for starting + ;; the service. + (requirement '(loopback)) + (documentation "Connect to the IPFS network") + (start #~(make-forkexec-constructor + #$ipfs-daemon-command + #:log-file "/var/log/ipfs.log" + #:user "ipfs" #:group "ipfs" + #:environment-variables #$%ipfs-environment)) + (stop #~(make-kill-destructor))))) (define (%ipfs-activation config) "Return an activation gexp for IPFS with CONFIG" - (define (ipfs-config-command setting value) - #~(#$(ipfs-binary config) "config" #$setting #$value)) - (define (set-config!-gexp setting value) - #~(system* #$@(ipfs-config-command setting value))) + (define (exec-command . args) + ;; Exec the given ifps command with the right authority. + #~(let ((pid (primitive-fork))) + (if (zero? pid) + (dynamic-wind + (const #t) + (lambda () + ;; Run ipfs init and ipfs config from a container, + ;; in case the IPFS daemon was compromised at some point + ;; and ~/.ipfs is now a symlink to somewhere outside + ;; %ipfs-home. + (let ((pw (getpwnam "ipfs"))) + (setgroups '#()) + (setgid (passwd:gid pw)) + (setuid (passwd:uid pw)) + (environ #$%ipfs-environment) + (execl #$(ipfs-binary config) #$@args))) + (lambda () + (primitive-exit 127))) + (waitpid pid)))) + (define settings `(("Addresses.API" ,(ipfs-configuration-api config)) ("Addresses.Gateway" ,(ipfs-configuration-gateway config)))) + (define inner-gexp #~(begin (umask #o077) ;; Create $HOME/.ipfs structure - (system* #$(ipfs-binary config) "init") + #$(exec-command "ipfs" "init") ;; Apply settings - #$@(map (cute apply set-config!-gexp <>) settings))) + #$@(map (match-lambda + ((setting value) + (exec-command "ipfs" "config" setting value))) + settings))) + (define inner-script (program-file "ipfs-activation-inner" inner-gexp)) - (define shepherd&co - ;; 'make-forkexec-constructor/container' needs version 0.9 for - ;; #:supplementary-groups. - (cons shepherd-0.9 - (list (lookup-package-input shepherd-0.9 "guile-fibers")))) - - ;; Run ipfs init and ipfs config from a container, - ;; in case the IPFS daemon was compromised at some point - ;; and ~/.ipfs is now a symlink to somewhere outside - ;; %ipfs-home. - (define container-gexp - (with-extensions shepherd&co - (with-imported-modules (source-module-closure - '((gnu build shepherd) - (gnu system file-systems))) - #~(begin - (use-modules (gnu build shepherd) - (gnu system file-systems)) - (let* ((constructor - (make-forkexec-constructor/container - (list #$inner-script) - #:namespaces '#$(fold delq %namespaces '(user)) - #:mappings (list #$%ipfs-home-mapping) - #:user "ipfs" - #:group "ipfs" - #:environment-variables #$%ipfs-environment)) - (pid (constructor))) - (waitpid pid)))))) ;; The activation may happen from the initrd, which uses ;; a statically-linked guile, while the guix container ;; procedures require a working dynamic-link. - (define container-script - (program-file "ipfs-activation-container" container-gexp)) - #~(system* #$container-script)) + #~(system* #$inner-script)) (define ipfs-service-type (service-type -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH v2 14/15] services: quassel: Use 'least-authority-wrapper'. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Wed, 27 Apr 2022 16:58:07 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165107864914876 (code B ref 54997); Wed, 27 Apr 2022 16:58:07 +0000 Received: (at 54997) by debbugs.gnu.org; 27 Apr 2022 16:57:29 +0000 Received: from localhost ([127.0.0.1]:44155 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyn-0003rl-8S for submit@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:29 -0400 Received: from eggs.gnu.org ([209.51.188.92]:41222) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyN-0003oW-6U for 54997@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:05 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:60030) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njkyH-00054W-N0; Wed, 27 Apr 2022 12:56:57 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=3JvzXej9xh9iqV8fsnLduF9DnXG51SXcve0a7fRlY0U=; b=NXgpRzLwMtnNR2USaS93 Att0o+Rno06Umqu0lM5WvQAXg0PaoB5BUag4HMGOatwUc+m9qF/udGD3XN7q341VHXKPAVENJ/9/m NfNpESiK3TohTJdTf/q6wj2Vks032NlJKORm8klI8VEacnkLSp1CTp/QQ9tXBm4BE7VUIGkkyjivK TPHONg8kp4kL2krASKNocgH5/hWc+pa0L6GFcLr/Q3//h4aEydw6jJPoWD+EufHRwS/MIhIx8hmqB eVxcPdh/6zIFPbDo2gsYmM2hUYNh0VaGfhDHq/McsAgJTWZJHcv2i0mjyAPhmOqaMX72I16Rz1Dye kGO53PZTV6g0Mg==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:64439 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1njkyH-0000Hl-72; Wed, 27 Apr 2022 12:56:57 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Wed, 27 Apr 2022 18:56:34 +0200 Message-Id: <20220427165635.8015-15-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220427165635.8015-1-ludo@gnu.org> References: <878rrrk1v1.fsf_-_@gnu.org> <20220427165635.8015-1-ludo@gnu.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/messaging.scm (quassel-shepherd-service): Use 'least-authority-wrapper' instead of 'make-forkexec-constructor/container'. --- gnu/services/messaging.scm | 42 ++++++++++++++++++++------------------ 1 file changed, 22 insertions(+), 20 deletions(-) diff --git a/gnu/services/messaging.scm b/gnu/services/messaging.scm index 7fdd8cf285..05bf6e784b 100644 --- a/gnu/services/messaging.scm +++ b/gnu/services/messaging.scm @@ -939,29 +939,31 @@ (define-record-type* (define quassel-shepherd-service (match-lambda (($ quassel interface port loglevel) - (with-imported-modules (source-module-closure - '((gnu build shepherd) - (gnu system file-systems))) + (let ((quassel (least-authority-wrapper + (file-append quassel "/bin/quasselcore") + #:name "quasselcore" + #:mappings (list (file-system-mapping + (source "/var/lib/quassel") + (target source) + (writable? #t)) + (file-system-mapping + (source "/var/log/quassel") + (target source) + (writable? #t))) + ;; XXX: The daemon needs to live in the main user + ;; namespace, as root, so it can access /var/lib/quassel + ;; owned by "quasselcore". + #:namespaces (fold delq %namespaces '(net user))))) (list (shepherd-service (provision '(quassel)) (requirement '(user-processes networking)) - (modules '((gnu build shepherd) - (gnu system file-systems))) - (start #~(make-forkexec-constructor/container - (list #$(file-append quassel "/bin/quasselcore") - "--configdir=/var/lib/quassel" - "--logfile=/var/log/quassel/core.log" - (string-append "--loglevel=" #$loglevel) - (string-append "--port=" (number->string #$port)) - (string-append "--listen=" #$interface)) - #:mappings (list (file-system-mapping - (source "/var/lib/quassel") - (target source) - (writable? #t)) - (file-system-mapping - (source "/var/log/quassel") - (target source) - (writable? #t))))) + (start #~(make-forkexec-constructor + (list #$quassel + "--configdir=/var/lib/quassel" + "--logfile=/var/log/quassel/core.log" + (string-append "--loglevel=" #$loglevel) + (string-append "--port=" (number->string #$port)) + (string-append "--listen=" #$interface)))) (stop #~(make-kill-destructor)))))))) (define %quassel-account -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH v2 15/15] services: opendht: Use 'least-authority-wrapper'. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Wed, 27 Apr 2022 16:58:08 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 54997@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165107865014882 (code B ref 54997); Wed, 27 Apr 2022 16:58:08 +0000 Received: (at 54997) by debbugs.gnu.org; 27 Apr 2022 16:57:30 +0000 Received: from localhost ([127.0.0.1]:44157 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyn-0003rt-Kn for submit@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:30 -0400 Received: from eggs.gnu.org ([209.51.188.92]:41226) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njkyN-0003oX-L1 for 54997@debbugs.gnu.org; Wed, 27 Apr 2022 12:57:05 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:60032) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njkyI-00054h-91; Wed, 27 Apr 2022 12:56:58 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=JaLxsvYppwCzUdZhpyUCjqE9ZnjCMOGFJJmxJ6Ch/R0=; b=bLAGzNnzJyDCsYMOC4yI zj8XSr5a7nGdPoG5MXvXySxKWQ9KZjdkEeHzxPTvPetkhY8fsWZ0tZB2NBhW7n6QWdQZ5yCqtCOvG vSS9hbjoyEThoGgUKjEG90IY6H/RswS2jCAbM/ENcaYsO9ktF0VWz+qYtWNY398zIGVk5g/vox1yo a0H1fb4Yl+bbG62k23iBdzuB8TwBX1J+WMzjjqFyWZaUXn8b583imHxh9w6vLIAkcq5SUL3z5nhoG rE6TslUq7gKgJwTR3iDsALUlJYV3/wzs7l21/h6gi2OaKadyNvyhPIUbBmGmpcfowjo3HPwaJZ7Gq eX5j4kCY44cdMg==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:64439 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1njkyH-0000Hl-Sm; Wed, 27 Apr 2022 12:56:58 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Wed, 27 Apr 2022 18:56:35 +0200 Message-Id: <20220427165635.8015-16-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220427165635.8015-1-ludo@gnu.org> References: <878rrrk1v1.fsf_-_@gnu.org> <20220427165635.8015-1-ludo@gnu.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/networking.scm (opendht-configuration->command-line-arguments): Use 'least-authority-wrapper'. (opendht-shepherd-service): Use 'make-forkexec-constructor'. --- gnu/services/networking.scm | 40 ++++++++++++++++++++----------------- 1 file changed, 22 insertions(+), 18 deletions(-) diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm index 4708ade0ca..5873070bdd 100644 --- a/gnu/services/networking.scm +++ b/gnu/services/networking.scm @@ -796,7 +796,19 @@ (define (opendht-configuration->command-line-arguments config) (match-record config (opendht bootstrap-host enable-logging? port debug? peer-discovery? proxy-server-port proxy-server-port-tls) - (let ((dhtnode #~(string-append #$opendht:tools "/bin/dhtnode"))) + (let ((dhtnode (least-authority-wrapper + ;; XXX: Work around lack of support for multiple outputs + ;; in 'file-append'. + (computed-file "dhtnode" + #~(symlink + (string-append #$opendht:tools + "/bin/dhtnode") + #$output)) + #:name "dhtnode" + #:mappings (list (file-system-mapping + (source "/dev/log") ;for syslog + (target source))) + #:namespaces (delq 'net %namespaces)))) `(,dhtnode "--service" ;non-forking mode ,@(if (string? bootstrap-host) @@ -822,23 +834,15 @@ (define (opendht-configuration->command-line-arguments config) (define (opendht-shepherd-service config) "Return a running OpenDHT." - (with-imported-modules (source-module-closure - '((gnu build shepherd) - (gnu system file-systems))) - (shepherd-service - (documentation "Run an OpenDHT node.") - (provision '(opendht dhtnode dhtproxy)) - (requirement '(networking syslogd)) - (modules '((gnu build shepherd) - (gnu system file-systems))) - (start #~(make-forkexec-constructor/container - (list #$@(opendht-configuration->command-line-arguments config)) - #:mappings (list (file-system-mapping - (source "/dev/log") ;for syslog - (target source))) - #:user "opendht" - #:group "opendht")) - (stop #~(make-kill-destructor))))) + (shepherd-service + (documentation "Run an OpenDHT node.") + (provision '(opendht dhtnode dhtproxy)) + (requirement '(networking syslogd)) + (start #~(make-forkexec-constructor + (list #$@(opendht-configuration->command-line-arguments config)) + #:user "opendht" + #:group "opendht")) + (stop #~(make-kill-destructor)))) (define opendht-service-type (service-type -- 2.35.1 From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 00/12] Add "least authority" program wrapper Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Wed, 27 Apr 2022 22:03:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Maxime Devos Cc: 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165109692425505 (code B ref 54997); Wed, 27 Apr 2022 22:03:02 +0000 Received: (at 54997) by debbugs.gnu.org; 27 Apr 2022 22:02:04 +0000 Received: from localhost ([127.0.0.1]:44684 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njpjX-0006dI-Rh for submit@debbugs.gnu.org; Wed, 27 Apr 2022 18:02:04 -0400 Received: from eggs.gnu.org ([209.51.188.92]:39192) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1njpjV-0006cm-Ny for 54997@debbugs.gnu.org; Wed, 27 Apr 2022 18:02:02 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:38050) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njpjP-0007k5-WC; Wed, 27 Apr 2022 18:01:56 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:In-Reply-To:Date:References:Subject:To: From; bh=E1qBCqgNovU16XffzQ+yNY56AwR7xX7ESJGqWoPXBKs=; b=m1IWQb6FanF012eRzh2y bGA8CaJYo7WFeorAEhtsxGHKZKqZKES/jZd8t+7ecSQ7CTV9Ji5lWlXuewL3BMbeXNNxRYx4b5lZ4 ROKUHKDnmKBynuC3uhjrVP2LmIIQTSX7/+NfL41qPtUEvOjz9X17qo5rbNYjm86Tga7Q2MlRhLDXe 5o+ORH/beI7Mv+GAT73JbBh2S2Ez8CZ4SFL5dOJWH/HvjKd039E6gAyHGz/wyUHfAMKy/Nf1fDI7q SCPsRhpPvdfrw5MIi9nH6xIlDeO1Anjd0IEapSFBJq/zX0jXVVDN4D9jNpxowW9gd/O03pNVXNxLZ 4wYmm8kEp0KGWQ==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:57326 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1njpjP-00040O-Ij; Wed, 27 Apr 2022 18:01:55 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= References: <20220417210453.27884-1-ludo@gnu.org> <20220417210453.27884-9-ludo@gnu.org> <4eac7fd571ddafd46bcadfa2ef5c6b3e41a162ab.camel@telenet.be> <8735i8ratp.fsf_-_@gnu.org> <616af1474c44d6c1caf71fa1f9d263ff46462201.camel@telenet.be> X-URL: http://www.fdn.fr/~lcourtes/ X-Revolutionary-Date: 8 =?UTF-8?Q?Flor=C3=A9al?= an 230 de la =?UTF-8?Q?R=C3=A9volution?= X-PGP-Key-ID: 0x090B11993D9AEBB5 X-PGP-Key: http://www.fdn.fr/~lcourtes/ludovic.asc X-PGP-Fingerprint: 3CE4 6455 8A84 FDC6 9DB4 0CFB 090B 1199 3D9A EBB5 X-OS: x86_64-pc-linux-gnu Date: Thu, 28 Apr 2022 00:01:54 +0200 In-Reply-To: <616af1474c44d6c1caf71fa1f9d263ff46462201.camel@telenet.be> (Maxime Devos's message of "Fri, 22 Apr 2022 16:39:43 +0200") Message-ID: <878rrqgp7x.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="=-=-=" X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi, Maxime Devos skribis: > Many of these are supported by 'least-authority-wrapper' but these POLA > wrappers require creating an additional process which seems a bit > unoptimal to me (memory- and latency-wise). Yeah, that=E2=80=99s why I initially looked at unshare(2), just to find out= that we can=E2=80=99t quite do the same as with clone(2)=E2=80=94in particular w= e cannot escape the current PID namespace. (There were also complications, such as the fact that you can only unshare(2) a single-threaded process, meaning that Guile had to be started with GC_MARKERS=3D1. For posterity, part of the patch I had is attached below.) > Also, having to do fork, waitpid and primitive-fork seems rather low- > level to me, so I prefer moving this code into somewhere like (gnu > build SOMEWHERE) or to keep the old make-forkexec-constructor/container > code. =E2=80=98primitive-fork=E2=80=99 and =E2=80=98waitpid=E2=80=99 calls are in= (gnu build linux-container) right now so I guess we=E2=80=99re fine? The goal though is to replace uses of =E2=80=98make-forkexec-constructor/container=E2=80=99 with uses of =E2=80=98least-authority-wrapper=E2=80=99, as done in this patch series. Ludo=E2=80=99. --=-=-= Content-Type: text/x-patch; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm index bdeca2cdb9..308c0bb325 100644 --- a/gnu/build/linux-container.scm +++ b/gnu/build/linux-container.scm @@ -1,6 +1,6 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright =C2=A9 2015 David Thompson -;;; Copyright =C2=A9 2017, 2018, 2019 Ludovic Court=C3=A8s +;;; Copyright =C2=A9 2017, 2018, 2019, 2022 Ludovic Court=C3=A8s ;;; ;;; This file is part of GNU Guix. ;;; @@ -21,6 +21,7 @@ (define-module (gnu build linux-container) #:use-module (ice-9 format) #:use-module (ice-9 match) #:use-module (ice-9 rdelim) + #:use-module (srfi srfi-1) #:use-module (srfi srfi-98) #:use-module (guix build utils) #:use-module (guix build syscalls) @@ -33,7 +34,8 @@ (define-module (gnu build linux-container) run-container call-with-container container-excursion - container-excursion*)) + container-excursion* + self-sever)) =20 (define (user-namespace-supported?) "Return #t if user namespaces are supported on this system." @@ -174,50 +176,53 @@ (define* (mount* source target type #:optional (flags= 0) options (chmod "/" #o755))) =20 (define* (initialize-user-namespace pid host-uids - #:key (guest-uid 0) (guest-gid 0)) + #:key (guest-uid 0) (guest-gid 0) + (uid (getuid)) (gid (getgid))) "Configure the user namespace for PID. HOST-UIDS specifies the number of host user identifiers to map into the user namespace. GUEST-UID and GUEST= -GID specify the first UID (respectively GID) that host UIDs (respectively GIDs) map to in the namespace." (define proc-dir - (string-append "/proc/" (number->string pid))) + (string-append "/proc/" + (match pid + ('self "self") + (_ (number->string pid))))) =20 (define (scope file) (string-append proc-dir file)) =20 - (let ((uid (getuid)) - (gid (getgid))) - - ;; Only root can write to the gid map without first disabling the - ;; setgroups syscall. - (unless (and (zero? uid) (zero? gid)) - (call-with-output-file (scope "/setgroups") - (lambda (port) - (display "deny" port)))) - - ;; Map the user/group that created the container to the root user - ;; within the container. - (call-with-output-file (scope "/uid_map") + ;; Only root can write to the gid map without first disabling the + ;; setgroups syscall. + (unless (and (zero? uid) (zero? gid)) + (call-with-output-file (scope "/setgroups") (lambda (port) - (format port "~d ~d ~d" guest-uid uid host-uids))) - (call-with-output-file (scope "/gid_map") - (lambda (port) - (format port "~d ~d ~d" guest-gid gid host-uids))))) + (display "deny" port)))) + + ;; Map the user/group that created the container to the root user + ;; within the container. + (call-with-output-file (scope "/uid_map") + (lambda (port) + (format port "~d ~d ~d" guest-uid uid host-uids))) + (call-with-output-file (scope "/gid_map") + (lambda (port) + (format port "~d ~d ~d" guest-gid gid host-uids)))) =20 (define (namespaces->bit-mask namespaces) "Return the number suitable for the 'flags' argument of 'clone' that corresponds to the symbols in NAMESPACES." ;; Use the same flags as fork(3) in addition to the namespace flags. - (apply logior SIGCHLD - (map (match-lambda - ('cgroup CLONE_NEWCGROUP) - ('mnt CLONE_NEWNS) - ('uts CLONE_NEWUTS) - ('ipc CLONE_NEWIPC) - ('user CLONE_NEWUSER) - ('pid CLONE_NEWPID) - ('net CLONE_NEWNET)) - namespaces))) + (fold (lambda (namespace flags) + (logior flags + (match namespace + ('cgroup CLONE_NEWCGROUP) + ('mnt CLONE_NEWNS) + ('uts CLONE_NEWUTS) + ('ipc CLONE_NEWIPC) + ('user CLONE_NEWUSER) + ('pid CLONE_NEWPID) + ('net CLONE_NEWNET)))) + 0 + namespaces)) =20 (define* (run-container root mounts namespaces host-uids thunk #:key (guest-uid 0) (guest-gid 0)) @@ -236,7 +241,7 @@ (define* (run-container root mounts namespaces host-uid= s thunk (match (socketpair PF_UNIX SOCK_STREAM 0) ((child . parent) (let ((flags (namespaces->bit-mask namespaces))) - (match (clone flags) + (match (clone (logior SIGCHLD flags)) (0 (call-with-clean-exit (lambda () @@ -392,3 +397,23 @@ (define (container-excursion* pid thunk) (close-port out) (close-port in) #f))))) + +(define* (self-sever mounts + #:key (namespaces %namespaces) (host-uids 1) + (guest-uid 0) (guest-gid 0)) + (let ((uid (getuid)) + (gid (getgid))) + (unshare (namespaces->bit-mask namespaces)) + + (initialize-user-namespace 'self host-uids + #:uid uid #:gid gid + #:guest-uid uid + #:guest-gid guest-gid) + + (when (memq 'mnt namespaces) + ;; (mount "none" "/" #f (logior MS_REC MS_PRIVATE)) + (call-with-temporary-directory + (lambda (root) + (mount-file-systems root mounts + #:mount-/proc? (memq 'pid namespaces) + #:mount-/sys? (memq 'net namespaces))))))) diff --git a/guix/build/syscalls.scm b/guix/build/syscalls.scm index a7401fd73f..5ee6bd1229 100644 --- a/guix/build/syscalls.scm +++ b/guix/build/syscalls.scm @@ -1,5 +1,5 @@ ;;; GNU Guix --- Functional package management for GNU -;;; Copyright =C2=A9 2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021 Ludovi= c Court=C3=A8s +;;; Copyright =C2=A9 2014-2022 Ludovic Court=C3=A8s ;;; Copyright =C2=A9 2015 David Thompson ;;; Copyright =C2=A9 2015 Mark H Weaver ;;; Copyright =C2=A9 2017 Mathieu Othacehe @@ -49,6 +49,11 @@ (define-module (guix build syscalls) MS_RELATIME MS_BIND MS_MOVE + MS_REC + MS_SILENT + MS_POSIXACL + MS_UNBINDABLE + MS_PRIVATE MS_LAZYTIME MNT_FORCE MNT_DETACH @@ -140,6 +145,7 @@ (define-module (guix build syscalls) CLONE_NEWPID CLONE_NEWNET clone + unshare setns =20 PF_PACKET @@ -537,6 +543,11 @@ (define MS_REMOUNT 32) (define MS_NOATIME 1024) (define MS_BIND 4096) (define MS_MOVE 8192) +(define MS_REC 16384) +(define MS_SILENT 32768) +(define MS_POSIXACL 65536) +(define MS_UNBINDABLE 131072) +(define MS_PRIVATE 262144) (define MS_RELATIME 2097152) (define MS_STRICTATIME 16777216) (define MS_LAZYTIME 33554432) @@ -1101,6 +1112,23 @@ (define clone (list err)) ret))))) =20 +(define unshare + (let ((proc (syscall->procedure int "unshare" (list int)))) + (lambda (flags) + "Disassociate the current process from parts of its execution context +according to FLAGS, which must be a logical or of CLONE_NEW* constants. + +Note that CLONE_NEWUSER requires that the calling process be single-thread= ed, +which is possible if and only if libgc is running a single marker thread; = this +can be achieved by setting the GC_MARKERS environment variable to 1. If t= he +calling process is multi-threaded, this throws to 'system-error' with EINV= AL." + (let-values (((ret err) + (without-automatic-finalization (proc flags)))) + (unless (zero? ret) + (throw 'system-error "unshare" "~a: ~A" + (list flags (strerror err)) + err)))))) + (define setns ;; Some systems may be using an old (pre-2.14) version of glibc where th= ere ;; is no 'setns' function available. --=-=-=-- From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 00/12] Add "least authority" program wrapper Resent-From: Maxime Devos Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Thu, 28 Apr 2022 11:30:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Ludovic =?UTF-8?Q?Court=C3=A8s?= Cc: 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165114538929575 (code B ref 54997); Thu, 28 Apr 2022 11:30:02 +0000 Received: (at 54997) by debbugs.gnu.org; 28 Apr 2022 11:29:49 +0000 Received: from localhost ([127.0.0.1]:45609 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nk2LF-0007gx-01 for submit@debbugs.gnu.org; Thu, 28 Apr 2022 07:29:49 -0400 Received: from michel.telenet-ops.be ([195.130.137.88]:50516) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nk2LC-0007go-GC for 54997@debbugs.gnu.org; Thu, 28 Apr 2022 07:29:47 -0400 Received: from ptr-bvsjgyhxw7psv60dyze.18120a2.ip6.access.telenet.be ([IPv6:2a02:1811:8c09:9d00:3c5f:2eff:feb0:ba5a]) by michel.telenet-ops.be with bizsmtp id QBVk270084UW6Th06BVkvi; Thu, 28 Apr 2022 13:29:44 +0200 Message-ID: <31ff48d9240cf1ab53405c097bbe7148be3ed3bf.camel@telenet.be> From: Maxime Devos Date: Thu, 28 Apr 2022 13:29:39 +0200 In-Reply-To: <878rrqgp7x.fsf@gnu.org> References: <20220417210453.27884-1-ludo@gnu.org> <20220417210453.27884-9-ludo@gnu.org> <4eac7fd571ddafd46bcadfa2ef5c6b3e41a162ab.camel@telenet.be> <8735i8ratp.fsf_-_@gnu.org> <616af1474c44d6c1caf71fa1f9d263ff46462201.camel@telenet.be> <878rrqgp7x.fsf@gnu.org> Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-SQKCswJm8LtwTojvG5zb" User-Agent: Evolution 3.38.3-1 MIME-Version: 1.0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telenet.be; s=r22; t=1651145384; bh=P7o5iqnt6UEm1WXWzqvAU4oPd+OQFAUyOWSmB+tDpw8=; h=Subject:From:To:Cc:Date:In-Reply-To:References; b=QXClyt4ucxMbFoNl/28ndwUd4c5ZXV8EdEREM4sesI1hhUIeGyolwS/zWKb7v5slv YFgtdnvFtZGvBiWJQZlPThJkg2qqcZJeG3+Dix6HouOo1/2orakIyJ348LhlV23ygH 0WeZwX6TyqOLmfapS3sbeUX2dydBFguVUGVSEByyYF2chpb55h1oQcKEFuQcu2Wgxc tvvE6nuj6HKkJTuiwMCGdoxsjBR3dFfpkABGu52VwEereFaZwKVR3wx66KgBpNEPP+ 8dYHu00mNNEvWrsilU6QZCO33VwpDyKF0NREMPmkQZ2ZeZ43ZhPvR9B8F2+VnLE1Ft rZPQxyb3KyqVw== X-Spam-Score: -0.0 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) --=-SQKCswJm8LtwTojvG5zb Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Ludovic Court=C3=A8s schreef op do 28-04-2022 om 00:01 [+0200]: > > Also, having to do fork, waitpid and primitive-fork seems rather > > low-level to me, so I prefer moving this code into somewhere like > > (gnu build SOMEWHERE) or to keep the old make-forkexec- > > constructor/container code. >=20 > =E2=80=98primitive-fork=E2=80=99 and =E2=80=98waitpid=E2=80=99 calls are = in (gnu build linux- > container) > right now so I guess we=E2=80=99re fine? Their use in (gnu build linux-container) seems fine to me, but their use in %ipfs-activation doesn't: > + #~(let ((pid (primitive-fork))) > + (if (zero? pid) > + (dynamic-wind > + (const #t) > + (lambda () > + [...] (execl #$(ipfs-binary config) #$@args))) > + (lambda () > + (primitive-exit 127))) Greetings, Maxime. --=-SQKCswJm8LtwTojvG5zb Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- iI0EABYKADUWIQTB8z7iDFKP233XAR9J4+4iGRcl7gUCYmp6oxccbWF4aW1lZGV2 b3NAdGVsZW5ldC5iZQAKCRBJ4+4iGRcl7p1jAP9PfrSueTBAfM/Qw995YPaSr4eN p4vvPWUCkB9J5IEwhwEApfLuiUtnl+I2rNltmKV4QbvxrUxdXqALl5eTqdzHDw8= =BlYP -----END PGP SIGNATURE----- --=-SQKCswJm8LtwTojvG5zb-- From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 00/12] Add "least authority" program wrapper Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Thu, 28 Apr 2022 19:26:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Maxime Devos Cc: 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165117393318415 (code B ref 54997); Thu, 28 Apr 2022 19:26:02 +0000 Received: (at 54997) by debbugs.gnu.org; 28 Apr 2022 19:25:33 +0000 Received: from localhost ([127.0.0.1]:49986 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nk9ld-0004mx-EJ for submit@debbugs.gnu.org; Thu, 28 Apr 2022 15:25:33 -0400 Received: from eggs.gnu.org ([209.51.188.92]:57814) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nk9lb-0004mg-Cp for 54997@debbugs.gnu.org; Thu, 28 Apr 2022 15:25:32 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:58282) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nk9lW-0006Dy-2m; Thu, 28 Apr 2022 15:25:26 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:In-Reply-To:Date:References:Subject:To: From; bh=Xxswlh9sH1LZJkBlfhBH81E5mY9PFQXM5CUgvMpn9Us=; b=FaSHJqL2gCpUrLwoxZBX xM6BYPe8woADBTGh2lcXcZksC9o6zL+DuNgA47YAjyxlz2PwiEPgQI60Yo+ZDx+W0YxqMCRM7n/wB 4o3t/KlErZOppB0cDPAXkD0MptN6oC0d/f9umirCxrtNl/4Zdq9uvfLOqJ32doh3uCvMfHboQAPG8 AOOt56peiUSBlmid54omDjFv67fnvtR67hosjRO3i2yf00Tp0DwjdNEd+TkqxQ1B+2ij9xUL8sh/Q L1vnaYmtsukbDbCjpTFZUE08ugJmWn+JLD1yNPLQvdq7365xtIPrFOuBtuU0pqjpnqNaQAT8a+0Sf JioF6DiSSi4vew==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:53600 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nk9lP-00074f-0A; Thu, 28 Apr 2022 15:25:24 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= References: <20220417210453.27884-1-ludo@gnu.org> <20220417210453.27884-9-ludo@gnu.org> <4eac7fd571ddafd46bcadfa2ef5c6b3e41a162ab.camel@telenet.be> <8735i8ratp.fsf_-_@gnu.org> <616af1474c44d6c1caf71fa1f9d263ff46462201.camel@telenet.be> <878rrqgp7x.fsf@gnu.org> <31ff48d9240cf1ab53405c097bbe7148be3ed3bf.camel@telenet.be> X-URL: http://www.fdn.fr/~lcourtes/ X-Revolutionary-Date: 9 =?UTF-8?Q?Flor=C3=A9al?= an 230 de la =?UTF-8?Q?R=C3=A9volution?= X-PGP-Key-ID: 0x090B11993D9AEBB5 X-PGP-Key: http://www.fdn.fr/~lcourtes/ludovic.asc X-PGP-Fingerprint: 3CE4 6455 8A84 FDC6 9DB4 0CFB 090B 1199 3D9A EBB5 X-OS: x86_64-pc-linux-gnu Date: Thu, 28 Apr 2022 21:25:17 +0200 In-Reply-To: <31ff48d9240cf1ab53405c097bbe7148be3ed3bf.camel@telenet.be> (Maxime Devos's message of "Thu, 28 Apr 2022 13:29:39 +0200") Message-ID: <87pml1au3m.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Hi Maxime, Maxime Devos skribis: > Ludovic Court=C3=A8s schreef op do 28-04-2022 om 00:01 [+0200]: >> > Also, having to do fork, waitpid and primitive-fork seems rather >> > low-level to me, so I prefer moving this code into somewhere like >> > (gnu build SOMEWHERE) or to keep the old make-forkexec- >> > constructor/container code. >>=20 >> =E2=80=98primitive-fork=E2=80=99 and =E2=80=98waitpid=E2=80=99 calls are= in (gnu build linux- >> container) >> right now so I guess we=E2=80=99re fine? > > Their use in (gnu build linux-container) seems fine to me, but their > use in %ipfs-activation doesn't: > >> + #~(let ((pid (primitive-fork))) >> + (if (zero? pid) >> + (dynamic-wind >> + (const #t) >> + (lambda () >> + [...] (execl #$(ipfs-binary config) #$@args))) >> + (lambda () >> + (primitive-exit 127))) Oh I see, and I agree. Now, to be fair, this patch deletes more lines than it adds: > * gnu/services/networking.scm (ipfs-binary): Call > 'least-authority-wrapper'. > (%ipfs-home-mapping): Remove surrounding gexp. > (ipfs-shepherd-service)[exec-command]: New procedure. > [ipfs-config-command, set-config!-gexp, shepherd&co] > [container-gexp, container-script]: Remove. > [inner-gexp]: Use 'exec-command'. > --- > gnu/services/networking.scm | 123 +++++++++++++++++------------------- > 1 file changed, 58 insertions(+), 65 deletions(-) The previous code abused =E2=80=98make-forkexec-constructor/container=E2=80= =99 as a way to spawn processes during activation, which wasn=E2=80=99t great either IMO. So yes, I agree there=E2=80=99s room for improvement here and that this cal= ls for some kind of =E2=80=98system*=E2=80=99 interface, if the need is common= enough. But! I don=E2=80=99t think this is a blocker for the whole series. WDYT? :-) Thanks, Ludo=E2=80=99. From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 00/12] Add "least authority" program wrapper Resent-From: Maxime Devos Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Thu, 28 Apr 2022 19:53:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Ludovic =?UTF-8?Q?Court=C3=A8s?= Cc: 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165117554321182 (code B ref 54997); Thu, 28 Apr 2022 19:53:02 +0000 Received: (at 54997) by debbugs.gnu.org; 28 Apr 2022 19:52:23 +0000 Received: from localhost ([127.0.0.1]:50034 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nkABb-0005Va-Dd for submit@debbugs.gnu.org; Thu, 28 Apr 2022 15:52:23 -0400 Received: from xavier.telenet-ops.be ([195.130.132.52]:42150) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nkABZ-0005VR-GJ for 54997@debbugs.gnu.org; Thu, 28 Apr 2022 15:52:22 -0400 Received: from ptr-bvsjgyhxw7psv60dyze.18120a2.ip6.access.telenet.be ([IPv6:2a02:1811:8c09:9d00:3c5f:2eff:feb0:ba5a]) by xavier.telenet-ops.be with bizsmtp id QKsK270054UW6Th01KsKSE; Thu, 28 Apr 2022 21:52:19 +0200 Message-ID: <4d8266b45cd2dc5ba0113e086f4b81fc42f27a8a.camel@telenet.be> From: Maxime Devos Date: Thu, 28 Apr 2022 21:52:14 +0200 In-Reply-To: <87pml1au3m.fsf@gnu.org> References: <20220417210453.27884-1-ludo@gnu.org> <20220417210453.27884-9-ludo@gnu.org> <4eac7fd571ddafd46bcadfa2ef5c6b3e41a162ab.camel@telenet.be> <8735i8ratp.fsf_-_@gnu.org> <616af1474c44d6c1caf71fa1f9d263ff46462201.camel@telenet.be> <878rrqgp7x.fsf@gnu.org> <31ff48d9240cf1ab53405c097bbe7148be3ed3bf.camel@telenet.be> <87pml1au3m.fsf@gnu.org> Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-DmbdyGz2LVKiwSilM4f3" User-Agent: Evolution 3.38.3-1 MIME-Version: 1.0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telenet.be; s=r22; t=1651175539; bh=2S0GfwcqmCD1GVjyF7rkkVdN2+XZ9iei/jkJY1+I488=; h=Subject:From:To:Cc:Date:In-Reply-To:References; b=oCIlIbNnYo038tpBvEOgxfOeEuKNtChk1+RKacrjTF5IIPlJH4oAybUzh+aleNW51 H45GJYvvfMsXeE+S4RX9rEbA6EpaHcJJUvvpObunC98GuVF25Zh7DOWzgo2GbIw6lS UtCsuJrAi9U9AyUnd5x+fcUmeIxD+u0IS/jQntPYA+VI8kQQ8aoVsqatNoPNHngz6i dBUjSmfmzaVcyhT2t/fO5gywsXJ2STR+eOvs0A/M9yRl6SZXzuHsOeI5+HT5aPLVit 3UEXF9Knl6fzT0NjQPeHV086W4F/5W8WoLZuia0y0adkvaBImwp1kccbG98LbraYiE 1pCXoAg47690g== X-Spam-Score: -0.0 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) --=-DmbdyGz2LVKiwSilM4f3 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Ludovic Court=C3=A8s schreef op do 28-04-2022 om 21:25 [+0200]: > The previous code abused =E2=80=98make-forkexec-constructor/container=E2= =80=99 as a way > to spawn processes during activation, which wasn=E2=80=99t great either I= MO. >=20 > So yes, I agree there=E2=80=99s room for improvement here and that this c= alls > for some kind of =E2=80=98system*=E2=80=99 interface, if the need is comm= on enough. > But! I don=E2=80=99t think this is a blocker for the whole series. >=20 > WDYT?=C2=A0 :-) Agreed that it's not a blocker, but next I have to write something similar, I think I'll then propose some kind of variant of system*. I guess I'm personally more inclined than you to write abstractions that only have a single use. Greetings, Maxime. --=-DmbdyGz2LVKiwSilM4f3 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- iI0EABYKADUWIQTB8z7iDFKP233XAR9J4+4iGRcl7gUCYmrwbhccbWF4aW1lZGV2 b3NAdGVsZW5ldC5iZQAKCRBJ4+4iGRcl7vNfAPwMC5xGqray3cu5M6nKEXnZ30zm QqpqbGYRNyo8z7gNuwEA6DupSEivwYv6mWBFPFZUFY76IXbE0uqRMSKXL2wxrwc= =Eg82 -----END PGP SIGNATURE----- --=-DmbdyGz2LVKiwSilM4f3-- From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 00/12] Add "least authority" program wrapper Resent-From: Thiago Jung Bauermann Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Fri, 29 Apr 2022 03:52:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Ludovic =?UTF-8?Q?Court=C3=A8s?= Cc: 54997@debbugs.gnu.org Received: via spool by 54997-submit@debbugs.gnu.org id=B54997.165120431318439 (code B ref 54997); Fri, 29 Apr 2022 03:52:02 +0000 Received: (at 54997) by debbugs.gnu.org; 29 Apr 2022 03:51:53 +0000 Received: from localhost ([127.0.0.1]:50445 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nkHfZ-0004nI-Io for submit@debbugs.gnu.org; Thu, 28 Apr 2022 23:51:53 -0400 Received: from mx.kolabnow.com ([212.103.80.153]:47328) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nkHfX-0004n2-Bm for 54997@debbugs.gnu.org; Thu, 28 Apr 2022 23:51:48 -0400 Received: from localhost (unknown [127.0.0.1]) by mx.kolabnow.com (Postfix) with ESMTP id B1D6340F51; Fri, 29 Apr 2022 05:51:41 +0200 (CEST) Authentication-Results: ext-mx-out003.mykolab.com (amavisd-new); dkim=pass (4096-bit key) reason="pass (just generated, assumed good)" header.d=kolabnow.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kolabnow.com; h= content-transfer-encoding:content-type:content-type:mime-version :message-id:in-reply-to:date:date:subject:subject:from:from :references:received:received:received; s=dkim20160331; t= 1651204301; x=1653018702; bh=CnjYppv+3GPWrL/60DeMngjAcgNRbfPDKLa gCiTIc6M=; b=HyHdyqNclDLJIFAEmPfHU44/S0s7lgQuiKn6D5VilfquLGOGxID RdaS9qNqwqj5LnxavJExwiGuPhoFUyyRAHt+vrsIXb54qg2podT7i1H7kb0B4rii F4FsaZjHh8khbcKWaXX2a8dKSQxlmx7puVHrFckKGYb4vNKpaJeoi4SJHI86mokP DoExsX7iAyzvXiRGZqdQY0XUqHKXIfJFJVoQiuzThmT0Q7pqQtxVAc6d5QQEjpio Lx28vsFmKnBrj0QR0kvQHvJ9OaA8fztoQWQBfbpUQuL4m/EsgjbDcD+bMh1lkKmk KztDGyT4JCRi64tBSkSuTPm7wpEFD3VNtu+RrNmSVEvmIhYwcHC4i4TrdV8w8eJH AQvhLnWayn3+sT6r/FywtDJNfwKjjio8VlFs46JuYu+gRu/7Oz0P+GUrg6ZRl1PO q0m2d5NQcpRQYJBa0OmOOOp81qdsWyTCGQaq9hGHDtWoSiEZPgH/WuYkEiMmVRzF da6LAV3Q89GuV6ooSYM17JROHZlnzY0BbDICEvR/KTgGk5LqKL+6OuLhfyQ/8mdb Gc6l4+ylP98aHEK5QfLCzoabmh3SQ008Xd9/WeaXKYIvmZEFjfxi8ngC5U2NYHMY Bzrh5UhCp+w/NxriezjHVfxaRhN8D98Q8o0avBJXLXFxYYKV1v3sUFqE= X-Virus-Scanned: amavisd-new at mykolab.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-10 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mx.kolabnow.com ([127.0.0.1]) by localhost (ext-mx-out003.mykolab.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9x1Tb5VksExp; Fri, 29 Apr 2022 05:51:41 +0200 (CEST) Received: from int-mx003.mykolab.com (unknown [10.9.13.3]) by mx.kolabnow.com (Postfix) with ESMTPS id 2758C40D34; Fri, 29 Apr 2022 05:51:39 +0200 (CEST) Received: from ext-subm001.mykolab.com (unknown [10.9.6.1]) by int-mx003.mykolab.com (Postfix) with ESMTPS id BC798315F; Fri, 29 Apr 2022 05:51:39 +0200 (CEST) References: <20220417210453.27884-1-ludo@gnu.org> <20220417210453.27884-4-ludo@gnu.org> <87h76klv6j.fsf@kolabnow.com> <87o80nk2o8.fsf_-_@gnu.org> From: Thiago Jung Bauermann Date: Fri, 29 Apr 2022 00:43:59 -0300 In-reply-to: <87o80nk2o8.fsf_-_@gnu.org> Message-ID: <878rrownqz.fsf@kolabnow.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -0.0 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Hi Ludo! Ludovic Court=C3=A8s writes: > Thiago Jung Bauermann skribis: >> So to avoid an accumulation of zombie processes and other signal-related >> problems, I suggest adding a =E2=80=9C(init-program ,tini)=E2=80=9D para= meter to >> =E2=80=98least-authority-wrapper=E2=80=99 and executing =E2=80=98program= =E2=80=99 as a subprocess of >> =E2=80=98tini=E2=80=99 or whatever was passed as the #:init-program (per= haps #f could >> mean running =E2=80=98program=E2=80=99 directly as PID 1). > > Hmm yes. It=E2=80=99s not great that the choice is between =E2=80=98unsh= are=E2=80=99=E2=80=94efficient > but the process lives in the parent PID namespace=E2=80=94and =E2=80=98cl= one=E2=80=99=E2=80=94but then > you have to fork twice. Yeah, the signals part of the Unix design isn't great. > But yeah, you=E2=80=99re right. I=E2=80=99ll try what you suggest and se= nd a v2. Thank you for making these changes! I had a look at v2 and it looks great. >> I mention this because I'm currently dealing with a problem that has >> exactly this root cause: I'm working on updating the public-inbox >> package to the latest version, and the testsuite is failing because it >> tests that lei's daemon process is correctly terminated. But that >> doesn't work because =E2=80=9Cguix build=E2=80=9D doesn't use a proper i= nit program as >> PID 1 and thus the daemon process goes to zombie state and the testsuite >> thinks that it didn't go away. I'm hoping to send a patch to fix that >> issue. > > Now that you mention it, this was discussed before: > > https://issues.guix.gnu.org/30948 > > I think we should do something about it in gnu-build-system.scm. Nice! Thank you for the link. The discussion there was very informative. I'll try to implement your idea of adding a new build phase to install the appropriate signal handlers. Probably even steal your child reaping code from the v2 patches. > Thanks for your feedback! Thank you for taking it into account! --=20 Thanks Thiago From unknown Sat Aug 09 14:04:32 2025 MIME-Version: 1.0 X-Mailer: MIME-tools 5.505 (Entity 5.505) X-Loop: help-debbugs@gnu.org From: help-debbugs@gnu.org (GNU bug Tracking System) To: Ludovic =?UTF-8?Q?Court=C3=A8s?= Subject: bug#54997: closed (Re: bug#54997: [PATCH 00/12] Add "least authority" program wrapper) Message-ID: References: <87pmkx2elg.fsf_-_@gnu.org> <20220417210107.27263-1-ludo@gnu.org> X-Gnu-PR-Message: they-closed 54997 X-Gnu-PR-Package: guix-patches X-Gnu-PR-Keywords: patch Reply-To: 54997@debbugs.gnu.org Date: Sun, 01 May 2022 20:17:02 +0000 Content-Type: multipart/mixed; boundary="----------=_1651436222-8958-1" This is a multi-part message in MIME format... ------------=_1651436222-8958-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Your bug report #54997: [PATCH 00/12] Add "least authority" program wrapper which was filed against the guix-patches package, has been closed. The explanation is attached below, along with your original report. If you require more details, please reply to 54997@debbugs.gnu.org. --=20 54997: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D54997 GNU Bug Tracking System Contact help-debbugs@gnu.org with problems ------------=_1651436222-8958-1 Content-Type: message/rfc822 Content-Disposition: inline Content-Transfer-Encoding: 7bit Received: (at 54997-done) by debbugs.gnu.org; 1 May 2022 20:16:38 +0000 Received: from localhost ([127.0.0.1]:34278 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nlFzi-0002Jo-Lt for submit@debbugs.gnu.org; Sun, 01 May 2022 16:16:38 -0400 Received: from eggs.gnu.org ([209.51.188.92]:59146) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nlFzh-0002Jb-Mf for 54997-done@debbugs.gnu.org; Sun, 01 May 2022 16:16:37 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:43294) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nlFzb-0007gb-Hv; Sun, 01 May 2022 16:16:31 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:In-Reply-To:Date:References:Subject:To: From; bh=01FcsWWiDeL6eeZ0QqWbs1ZLVfyF2j9329WGJLSrOOI=; b=CqDYdcJl/funZeJ2uwlU DubuIflXW1ua77BBz2eFKIHQLsuAPe5FW6CFYaSOw8J9VDjqxVQghxDyl/GltznoPZ8T4dpWfdYzP 1u9zRSuAXuqhtQkIa32jVFFaNqk2ILHzLbHnwhxmFlWR8UhoHh8s4C2Obo16J1CoSlE1juTJa6738 T1J8WGn4vz8KYF7g7FhBetVVP8AZd9PWac9P6fdL/elx5v83a3JTzbx03h3XAMyEJg8DT2JN3H5xe 8F69zt6IBhGw/Z1H2Ow5tokpzCWdAxU5WU0WE9A7GV7b5Y7V5hZUSkH/G2xdcpuBarzb9QbVibYhi d23LH8/ejR3Vsg==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:64657 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nlFza-0000Vq-50; Sun, 01 May 2022 16:16:30 -0400 From: =?utf-8?Q?Ludovic_Court=C3=A8s?= To: 54997-done@debbugs.gnu.org Subject: Re: bug#54997: [PATCH 00/12] Add "least authority" program wrapper References: <878rrrk1v1.fsf_-_@gnu.org> <20220427165635.8015-1-ludo@gnu.org> Date: Sun, 01 May 2022 22:16:27 +0200 In-Reply-To: <20220427165635.8015-1-ludo@gnu.org> ("Ludovic =?utf-8?Q?Cour?= =?utf-8?Q?t=C3=A8s=22's?= message of "Wed, 27 Apr 2022 18:56:20 +0200") Message-ID: <87pmkx2elg.fsf_-_@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 54997-done Cc: Maxime Devos , Thiago Jung Bauermann X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Ludovic Court=C3=A8s skribis: > gexp: Add 'references-file'. > file-systems: Avoid load-time warnings when attempting to load (guix > store). > linux-container: 'call-with-container' relays SIGTERM and SIGINT. > linux-container: Ensure signal-handling asyncs get a chance to run. > linux-container: Add #:child-is-pid1? parameter to > 'call-with-container'. > Add (guix least-authority). > services: dicod: Rewrite using 'least-authority-wrapper'. > services: dicod: Use 'make-inetd-constructor'. > services: bitlbee: Use 'make-inetd-constructor'. > services: ipfs: Adjust for Shepherd 0.9. > services: ipfs: Use 'least-authority-wrapper'. > services: wesnothd: Grant write access to /var/run/wesnothd. > services: wesnothd: Use 'least-authority-wrapper'. > services: quassel: Use 'least-authority-wrapper'. > services: opendht: Use 'least-authority-wrapper'. Pushed as fee06d5aaa71a965ea0bc06c1ff15c138a8bb2c8, thanks again for reviewing! Ludo=E2=80=99. ------------=_1651436222-8958-1 Content-Type: message/rfc822 Content-Disposition: inline Content-Transfer-Encoding: 7bit Received: (at submit) by debbugs.gnu.org; 17 Apr 2022 21:01:26 +0000 Received: from localhost ([127.0.0.1]:37383 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC1O-0001vn-0d for submit@debbugs.gnu.org; Sun, 17 Apr 2022 17:01:26 -0400 Received: from lists.gnu.org ([209.51.188.17]:53320) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ngC1M-0001vg-8o for submit@debbugs.gnu.org; Sun, 17 Apr 2022 17:01:24 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:60028) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngC1J-0005Os-VL for guix-patches@gnu.org; Sun, 17 Apr 2022 17:01:24 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:58326) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ngC1J-0008EY-Mm; Sun, 17 Apr 2022 17:01:21 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:Date:Subject:To:From:in-reply-to: references; bh=FvJpE7nukYqYvkiFQWBCQjnHoU335xkw3YOLTcuc+aw=; b=aKZniBCTJZe6GR ppm7r8KU23456/5tqZO5GhVWgBxRyc49yjed3cq7wRZVbtBwiR/Rlb6qlrB67fAxjtUKj7xyCwPAk MqRR0FaGkbxI6s7MYkRNNHTrdHqLJf0ykOW8FYiOTaeh4s6cOWfAZu7QZOsSgC8PgyQ1qniHQR79d 00chtfOC+7NeVh8bxESEGPJZvpSNbIVhRGk7Awa8wFqQRZapa2sSWHBkm/mVwU1S0PPmAJB4zJxSn N7jHqgBbW936UBBSrZTeC4M4flAfs9xycveP73bteKNNUc/Cehgi3OpQA98q19qsAUMlo/wcg7Omd bMkTgnZ5Z/ktKmupC5Fg==; Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38868 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ngC1H-0004Hq-To; Sun, 17 Apr 2022 17:01:20 -0400 From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= To: guix-patches@gnu.org Subject: [PATCH 00/12] Add "least authority" program wrapper Date: Sun, 17 Apr 2022 23:01:07 +0200 Message-Id: <20220417210107.27263-1-ludo@gnu.org> X-Mailer: git-send-email 2.35.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: submit Cc: =?UTF-8?q?Ludovic=20Court=C3=A8s?= X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Hello Guix! So we have this fancy ‘make-forkexec-constructor/container’ thing to spawn Shepherd services in a container: https://guix.gnu.org/en/blog/2017/running-system-services-in-containers/ It’s nice, but it doesn’t compose. What if you want an inetd-style service *and* have it run in a container? We certainly don’t want to end up defining ‘make-inetd-constructor/container’ and so on. Instead, the new (guix least-authority) module provides a way to create “least-authority wrappers” for a given program: the wrapper forks[*] a process that lives in separate namespaces, with ‘call-with-container’, sets up bind mounts and everything in the child, and executes the program in that environment. ([*] I considered using unshare(2) instead of forking but that doesn’t quite work, notably because the process itself would remain in the same PID namespace as its parent.) Subsequent patches change most, but not all, users of ‘make-forkexec-constructor/container’ to ‘least-authority-wrapper’. One situation where ‘make-forkexec-constructor/container’ cannot be replaced yet is when we rely on #:pid-file, as is the case for Tor (‘make-forkexec-constructor/container’ goes to great lengths to read PID files in the container and be happy with a PID that is only valid within that namespace.) The remaining users are Jami and Pagekite; that is left as an exercise to the reader. :-) I have plans to use ‘least-authority-wrapper’ in other contexts, in particular as the basis of a new package transformation option. Thoughts? Ludo’. Ludovic Courtès (12): gexp: Add 'references-file'. file-systems: Avoid load-time warnings when attempting to load (guix store). linux-container: 'call-with-container' relays SIGTERM and SIGINT. Add (guix least-authority). services: dicod: Rewrite using 'least-authority-wrapper'. services: dicod: Use 'make-inetd-constructor'. services: bitlbee: Use 'make-inetd-constructor'. services: ipfs: Adjust for Shepherd 0.9. services: ipfs: Use 'least-authority-wrapper'. services: wesnothd: Grant write access to /var/run/wesnothd. services: wesnothd: Use 'least-authority-wrapper'. services: quassel: Use 'least-authority-wrapper'. Makefile.am | 1 + gnu/build/linux-container.scm | 15 ++-- gnu/build/shepherd.scm | 3 +- gnu/services/base.scm | 22 ------ gnu/services/dict.scm | 61 ++++++++++------ gnu/services/games.scm | 33 +++++++-- gnu/services/messaging.scm | 105 +++++++++++++++++---------- gnu/services/networking.scm | 118 +++++++++++++++--------------- gnu/system/file-systems.scm | 5 +- gnu/tests/messaging.scm | 21 +----- guix/gexp.scm | 43 +++++++++++ guix/least-authority.scm | 131 ++++++++++++++++++++++++++++++++++ tests/gexp.scm | 18 +++++ 13 files changed, 403 insertions(+), 173 deletions(-) create mode 100644 guix/least-authority.scm base-commit: 950f3e4f98add14f645dc4c9f8c512cac7b8a779 -- 2.35.1 ------------=_1651436222-8958-1-- From unknown Sat Aug 09 14:04:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#54997] [PATCH 00/12] Add "least authority" program wrapper Resent-From: Thiago Jung Bauermann Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Mon, 02 May 2022 04:26:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 54997 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Ludovic =?UTF-8?Q?Court=C3=A8s?= Cc: Maxime Devos , 54997-done@debbugs.gnu.org Received: via spool by 54997-done@debbugs.gnu.org id=D54997.165146555332730 (code D ref 54997); Mon, 02 May 2022 04:26:01 +0000 Received: (at 54997-done) by debbugs.gnu.org; 2 May 2022 04:25:53 +0000 Received: from localhost ([127.0.0.1]:34606 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nlNdB-0008Vq-AQ for submit@debbugs.gnu.org; Mon, 02 May 2022 00:25:53 -0400 Received: from mx.kolabnow.com ([212.103.80.154]:47804) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nlNd8-0008Vc-RA for 54997-done@debbugs.gnu.org; Mon, 02 May 2022 00:25:51 -0400 Received: from localhost (unknown [127.0.0.1]) by mx.kolabnow.com (Postfix) with ESMTP id 0E254131D; Mon, 2 May 2022 06:25:45 +0200 (CEST) Authentication-Results: ext-mx-out001.mykolab.com (amavisd-new); dkim=pass (4096-bit key) reason="pass (just generated, assumed good)" header.d=kolabnow.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kolabnow.com; h= content-transfer-encoding:content-type:content-type:mime-version :message-id:in-reply-to:date:date:subject:subject:from:from :references:received:received:received; s=dkim20160331; t= 1651465544; x=1653279945; bh=MwGCiVudFWQhG8mBgHgIPp9jXhLHwjRh1UL AMyPs1+8=; b=iM8uWTlo2U1JI1s7IjHXq0sdAbcuvenN2Pp4GCWsdEqmuCk/9xf mKojUuHX/4xSmTC+Dz9enZNApjmdUS5jufTOZmnlARCFm9XPTZkwKnr7Ik0ODpTU R5+njFZhTeQzbmTzhrJfHW/CNsb9twEOT0j6A9i/PSWyG/rfNto+Zz/oomYqDPjJ 76Dl2bx7dRLLZtgxgzXl8Er5uWn1hrZVjahy6K73V6VDPmOQOKnNoGg4q3HZ3nEB mba2ZhKK+NvwBLV3fPlQScTbefnCstcMAaOQnO0JBtBo0Mdsaktw9vrea9BOghhe 5BV4SQD5o3j70idVyc2w0dPXk8Hoc82cvu2Kq7LcLoZrXksyaJzyv17URH4VmDQK EB5OKF6Z0EQVRoiKpwEkIdqyZX6YpMVIDs9IN3nJpJV5IAxf7VVBqL//iiJCjBm+ FqRH2Aqs5kJpSA6IljV1EJqR9bMevGbwNlwHHn2LaaP0LfzBDce9cn3/D2pFJAMN +JCpOtbS7GaOIkSwWtwZvGhdkVJenHfRY3dXOm7m7yUm670B0AJU3DdznBR0Rfhd 0J5YuC7DoW70vX+B1s19pUZ7tU6R8inx3siTLc0sdJgpXtS7L8unTnF0YWsxiBlX ow4u9uEGKk1J2Hs5zoF3/IzrbaJ5sUv9KkhEMG1ogwQyBlxMBDPlLUnM= X-Virus-Scanned: amavisd-new at mykolab.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-10 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mx.kolabnow.com ([127.0.0.1]) by localhost (ext-mx-out001.mykolab.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k9Bnkuj8wJ6O; Mon, 2 May 2022 06:25:44 +0200 (CEST) Received: from int-mx003.mykolab.com (unknown [10.9.13.3]) by mx.kolabnow.com (Postfix) with ESMTPS id CA2B01093; Mon, 2 May 2022 06:25:43 +0200 (CEST) Received: from ext-subm002.mykolab.com (unknown [10.9.6.2]) by int-mx003.mykolab.com (Postfix) with ESMTPS id 44C9A252B; Mon, 2 May 2022 06:25:43 +0200 (CEST) References: <878rrrk1v1.fsf_-_@gnu.org> <20220427165635.8015-1-ludo@gnu.org> <87pmkx2elg.fsf_-_@gnu.org> From: Thiago Jung Bauermann Date: Mon, 02 May 2022 01:25:02 -0300 In-reply-to: <87pmkx2elg.fsf_-_@gnu.org> Message-ID: <87bkwgy30f.fsf@kolabnow.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -0.0 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Ludovic Court=C3=A8s writes: > Ludovic Court=C3=A8s skribis: > >> gexp: Add 'references-file'. >> file-systems: Avoid load-time warnings when attempting to load (guix >> store). >> linux-container: 'call-with-container' relays SIGTERM and SIGINT. >> linux-container: Ensure signal-handling asyncs get a chance to run. >> linux-container: Add #:child-is-pid1? parameter to >> 'call-with-container'. >> Add (guix least-authority). >> services: dicod: Rewrite using 'least-authority-wrapper'. >> services: dicod: Use 'make-inetd-constructor'. >> services: bitlbee: Use 'make-inetd-constructor'. >> services: ipfs: Adjust for Shepherd 0.9. >> services: ipfs: Use 'least-authority-wrapper'. >> services: wesnothd: Grant write access to /var/run/wesnothd. >> services: wesnothd: Use 'least-authority-wrapper'. >> services: quassel: Use 'least-authority-wrapper'. >> services: opendht: Use 'least-authority-wrapper'. > > Pushed as fee06d5aaa71a965ea0bc06c1ff15c138a8bb2c8, thanks again for > reviewing! That's great! Thank you for addressing the PID 1 issue! --=20 Thanks Thiago