Subject: bug#64862: closed (Re: bug#64862: [feature request] [shepherd] Specifying POSIX capabilities on services)

From: [email-masked] (GNU bug Tracking System)
Date: Tue, 12 Nov 2024 06:10:02 +0000

Your bug report

#64862: [feature request] [shepherd] Specifying POSIX capabilities on services

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
64862: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=64862
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#64862: [feature request] [shepherd] Specifying POSIX capabilities on services
From: Maxim Cournoyer <[email-masked]>
To: [email-masked]
Cc: Tobias Geerinckx-Rice <[email-masked]>
Date: Tue, 12 Nov 2024 15:08:29 +0900
List-Id: <debbugs-submit.debbugs.gnu.org>

Hello,

Maxim Cournoyer <[email-masked]> writes:

> Hello,
>
> It'd be useful to be able to specify POSIX capabilities a Shepherd
> service should have, for example for an unprivileged process to be able
> to bind to ports lower than 1024.
>
> This came up while reviewing #63082, which patch 10/16 (now dropped
> because of loss of functionality) suggested to let the user/group change
> be effected by Shepherd instead of by MPD itself (see:
> https://issues.guix.gnu.org/63082#98).
>
> I know that NixOS has some mechanism to do that; I think it was a simple
> shell script wrapper setting the capabilities, but that's all I
> remember.

I believe that's now possible since commit 71f0676a29 ("privilege: Add
POSIX capabilities(7) support.").  Thank you, Tobias!

Closing.

-- 
Thanks,
Maxim

Subject: [feature request] [shepherd] Specifying POSIX capabilities on services
From: Maxim Cournoyer <[email-masked]>
To: bug-guix <[email-masked]>
Date: Tue, 25 Jul 2023 17:04:26 -0400
List-Id: <debbugs-submit.debbugs.gnu.org>

Hello,

It'd be useful to be able to specify POSIX capabilities a Shepherd
service should have, for example for an unprivileged process to be able
to bind to ports lower than 1024.

This came up while reviewing #63082, which patch 10/16 (now dropped
because of loss of functionality) suggested to let the user/group change
be effected by Shepherd instead of by MPD itself (see:
https://issues.guix.gnu.org/63082#98).

I know that NixOS has some mechanism to do that; I think it was a simple
shell script wrapper setting the capabilities, but that's all I
remember.

-- 
Thanks,
Maxim