GNU bug report logs - #54997
[PATCH 00/12] Add "least authority" program wrapper

Previous Next

Full log

Message #59 received at 54997 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Maxime Devos <maximedevos <at> telenet.be>
Cc: 54997 <at> debbugs.gnu.org
Subject: Re: bug#54997: [PATCH 00/12] Add "least authority" program wrapper
Date: Tue, 19 Apr 2022 23:59:53 +0200

Hi Maxime,

Maxime Devos <maximedevos <at> telenet.be> skribis:

> Ludovic Courtès schreef op zo 17-04-2022 om 23:04 [+0200]:
>> +                     ;; XXX: The daemon needs to live in the main user
>> +                     ;; namespace, as root, so it can access /var/lib/quassel
>> +                     ;; owned by "quasselcore".
>
> The previous code did not have this comment, was the old code broken or
> is this a limitation of least-authority-wrapper?

It’s just that ‘make-forkexec-constructor/container’ does it by default:

--8<---------------cut here---------------start------------->8---
(define (default-namespaces args)
  ;; Most daemons are here to talk to the network, and most of them expect to
  ;; run under a non-zero UID.
  (fold delq %namespaces '(net user)))
--8<---------------cut here---------------end--------------->8---

‘least-authority-wrapper’ is stricter by defaulting to ‘%namespaces’.

Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.