From debbugs-submit-bounces@debbugs.gnu.org Tue Nov 14 09:06:53 2023 Received: (at submit) by debbugs.gnu.org; 14 Nov 2023 14:06:53 +0000 Received: from localhost ([127.0.0.1]:60556 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r2u44-0005UH-Tx for submit@debbugs.gnu.org; Tue, 14 Nov 2023 09:06:53 -0500 Received: from lists.gnu.org ([2001:470:142::17]:42988) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r2u42-0005U3-Vo for submit@debbugs.gnu.org; Tue, 14 Nov 2023 09:06:51 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1r2u3G-0005l8-OL for guix-patches@gnu.org; Tue, 14 Nov 2023 09:06:02 -0500 Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1r2u3G-0001HV-FF; Tue, 14 Nov 2023 09:06:02 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:Date:Subject:To:From:in-reply-to: references; bh=Ucl4d/ij3in1Q/Zt6qJQ1vqsPMG693Xr3XbyAAYCLZw=; b=HfVnGCHvWXMQrD 6pqgMOpeYMvbauoo8Wcc3Jh+EJnImfzeZzsbzNoy74hIkEEXXBxHsdhWoDWQ2jBabYP5jjxOpKodG jetk4ukmuvYqR2a5wDiVDG9FcScotSpHQdxbMH8l9HgehDMljpl8Mc6EZ+tIHj8+7e14p6pgLuogI SPD8OTH7YsV2HSg2yashi78TIxsMOWrUIWogoOcShTJpjtYc2F4Lgf7JyzQjalPAyr4i5+5F9BmPr QeNJnY4Qvv4rVCX6iWRIefydu8fKQK6FEUSG/XAfs3jX/pXax1U6n09+zcgX70W6IOJN47/v3C3cg P4+nux0rrBSNHkDlVHJQ==; From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= To: guix-patches@gnu.org Subject: [PATCH 0/9] Removing 'make-forkexec-constructor/container' Date: Tue, 14 Nov 2023 15:05:51 +0100 Message-ID: X-Mailer: git-send-email 2.41.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -0.0 (/) X-Debbugs-Envelope-To: submit Cc: =?UTF-8?q?Ludovic=20Court=C3=A8s?= X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Hello Guix! This completes the removal of ‘make-forkexec-constructor/container’ as I intended to do with the introduction of ‘least-authority-wrapper’: https://issues.guix.gnu.org/54997 The Jami use case exposed a few shortcomings, including those addressed by , but thankfully there are tests, which made it easier to validate the changes! Feedback welcome! Ludo’. Ludovic Courtès (9): services: pagekite: Use ‘least-authority-wrapper’. services: pagekite: Add ‘configuration’ action. services: bitlbee: Remove use of ‘make-forkexec-constructor/container’. least-authority: Add support for changing UIDs/GIDs before exec. tests: jami: Check status of Jami D-Bus session. services: jami-dbus-session: Use ‘least-authority-wrapper’. services: jami: Use ‘least-authority-wrapper’. services: Remove unnecessary references to (gnu build shepherd). shepherd: Remove ‘make-forkexec-constructor/container’. gnu/build/shepherd.scm | 90 ---------------------- gnu/services/databases.scm | 41 +++++----- gnu/services/messaging.scm | 77 ++++++++----------- gnu/services/networking.scm | 36 +++++---- gnu/services/security-token.scm | 29 ++++--- gnu/services/telephony.scm | 132 +++++++++++++++++++------------- gnu/services/web.scm | 50 ++++++------ gnu/tests/telephony.scm | 9 +++ guix/least-authority.scm | 25 +++++- 9 files changed, 223 insertions(+), 266 deletions(-) base-commit: 08d94fe20eca47b69678b3eced8749dd02c700a4 prerequisite-patch-id: ea1da8834460072ad48cd7b4a3ec23e7205f2529 prerequisite-patch-id: eb3069189c1b61930a429f933fda673d8fe47691 -- 2.41.0 From debbugs-submit-bounces@debbugs.gnu.org Tue Nov 14 09:10:37 2023 Received: (at 67175) by debbugs.gnu.org; 14 Nov 2023 14:10:37 +0000 Received: from localhost ([127.0.0.1]:60568 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r2u7g-0005aN-VG for submit@debbugs.gnu.org; Tue, 14 Nov 2023 09:10:37 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:42266) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r2u7f-0005a4-Qk for 67175@debbugs.gnu.org; Tue, 14 Nov 2023 09:10:36 -0500 Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1r2u6t-0001r0-Qx; Tue, 14 Nov 2023 09:09:47 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=fb+XjT86CGeA6T1dLr7Vjt+ceFNklNVlGFBxP45nCmg=; b=GMaDrnkj6ysbNxXWSPyX WQK7OZk1padCbaumsaBN+c+f0ofKo5rIttUgod3oSTBTuoRnYYpTKiNF6clAm52RD9hh0IUkdUlwG gn29zV9B0IRJiGpNld+oUP2BNffaP9BSMdyNbVK0hqcRFwXHyjq91I32YbBH918O6VKWjGzNQuOgk g9Mxe0ComPe9uyZvTdTPsLpbBZQP71rIHXbz4SqMlg5c5gcMoctCYWt9vM+C6Rt9/0qCsGJhmdhS3 0ZsZtoG4l0p6rH9tNjaQCcfRDeuvo9tCgWLDQwl3zpeloVReFIFCFVQ5aan9c7FOk1C+10EBD2Bcn 3wVdTp3Y8upzyA==; From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= To: 67175@debbugs.gnu.org Subject: [PATCH 1/9] =?UTF-8?q?services:=20pagekite:=20Use=20=E2=80=98leas?= =?UTF-8?q?t-authority-wrapper=E2=80=99.?= Date: Tue, 14 Nov 2023 15:09:10 +0100 Message-ID: <52f588ecd8c438019142d9cb4766933407d42ee7.1699970930.git.ludo@gnu.org> X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 67175 Cc: =?UTF-8?q?Ludovic=20Court=C3=A8s?= X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/networking.scm (pagekite-shepherd-service): Define ‘config-file’ and ‘mappings’; define ‘pagekite’ in terms of ‘least-authority-wrapper’. Remove now-unneeded ‘with-imported-modules’ form and ‘modules’ field. Use ‘make-forkexec-constructor’ instead of ‘make-forkexec-constructor/container’. Change-Id: I7c6c6266785f6a0f81a69d85f070779a0d6edd91 --- gnu/services/networking.scm | 35 ++++++++++++++++++++--------------- 1 file changed, 20 insertions(+), 15 deletions(-) diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm index 0508a4282c..d3376f9acb 100644 --- a/gnu/services/networking.scm +++ b/gnu/services/networking.scm @@ -1918,29 +1918,34 @@ (define (pagekite-configuration-file config) (define (pagekite-shepherd-service config) (match-record config (package kitename kitesecret frontend kites extra-file) - (with-imported-modules (source-module-closure - '((gnu build shepherd) - (gnu system file-systems))) + (let* ((config-file (pagekite-configuration-file config)) + (mappings (cons (file-system-mapping + (source config-file) + (target source)) + (if extra-file + (list (file-system-mapping + (source extra-file) + (target source))) + '()))) + (pagekite (least-authority-wrapper + (file-append package "/bin/pagekite") + #:name "pagekite" + #:mappings mappings + ;; 'pagekite' changes user IDs to it needs to run in the + ;; global user namespace. + #:namespaces (fold delq %namespaces '(net user))))) (shepherd-service (documentation "Run the PageKite service.") (provision '(pagekite)) (requirement '(networking)) - (modules '((gnu build shepherd) - (gnu system file-systems))) - (start #~(make-forkexec-constructor/container - (list #$(file-append package "/bin/pagekite") + (start #~(make-forkexec-constructor + (list #$pagekite "--clean" "--nullui" "--nocrashreport" "--runas=pagekite:pagekite" - (string-append "--optfile=" - #$(pagekite-configuration-file config))) - #:log-file "/var/log/pagekite.log" - #:mappings #$(if extra-file - #~(list (file-system-mapping - (source #$extra-file) - (target source))) - #~'()))) + (string-append "--optfile=" #$config-file)) + #:log-file "/var/log/pagekite.log")) ;; SIGTERM doesn't always work for some reason. (stop #~(make-kill-destructor SIGINT)))))) -- 2.41.0 From debbugs-submit-bounces@debbugs.gnu.org Tue Nov 14 09:10:39 2023 Received: (at 67175) by debbugs.gnu.org; 14 Nov 2023 14:10:39 +0000 Received: from localhost ([127.0.0.1]:60576 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r2u7j-0005ac-AS for submit@debbugs.gnu.org; Tue, 14 Nov 2023 09:10:39 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:60924) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r2u7h-0005a8-E7 for 67175@debbugs.gnu.org; Tue, 14 Nov 2023 09:10:37 -0500 Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1r2u6v-0001rL-EH; Tue, 14 Nov 2023 09:09:49 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=UVYK2PlcnEvYqwN9+uAfeq5zvdujhrYrLUhPR93w0Hg=; b=D93oWhknmwzGxt0PfQt2 7eEni/GttuHbID/jtyuXksKL0vmFu2A1Zmk8wjR78EKINdlW/C2cxzq3GBXxFOFAoSJUQT1XgNojN P4pzgEAVBg+s4bOX0oifNOMGvEa7ivYB6CXZkgV8sNiV59cMAFHutmSUpfpNbF6x0YDnH4h+K5wjE awQf/tpcmE9LNYhtxJdAwQ7O5zWd5CSPtvZCnupxtwUpkQ3qpIfN4KA4D99lQMrnYlhFMIw8RG5b+ zbqBACRqbFiWVhCcKgd40BagPHYBQjN0Dkx5uZ2s/1fcjgZvfMKNvJNYBZDuqieaGAauitO3hBuAY DpNkHDSUVbsI7Q==; From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= To: 67175@debbugs.gnu.org Subject: [PATCH 2/9] =?UTF-8?q?services:=20pagekite:=20Add=20=E2=80=98conf?= =?UTF-8?q?iguration=E2=80=99=20action.?= Date: Tue, 14 Nov 2023 15:09:11 +0100 Message-ID: <7a171625d8ce12535c7a64aacf68e135e75e1d5c.1699970930.git.ludo@gnu.org> X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 67175 Cc: =?UTF-8?q?Ludovic=20Court=C3=A8s?= X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/networking.scm (pagekite-shepherd-service): Add ‘actions’ field. Change-Id: I04daa846d505b0700b574a82472ecd99b492d7c4 --- gnu/services/networking.scm | 1 + 1 file changed, 1 insertion(+) diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm index d3376f9acb..7c114fa53c 100644 --- a/gnu/services/networking.scm +++ b/gnu/services/networking.scm @@ -1938,6 +1938,7 @@ (define (pagekite-shepherd-service config) (documentation "Run the PageKite service.") (provision '(pagekite)) (requirement '(networking)) + (actions (list (shepherd-configuration-action config-file))) (start #~(make-forkexec-constructor (list #$pagekite "--clean" -- 2.41.0 From debbugs-submit-bounces@debbugs.gnu.org Tue Nov 14 09:10:42 2023 Received: (at 67175) by debbugs.gnu.org; 14 Nov 2023 14:10:42 +0000 Received: from localhost ([127.0.0.1]:60578 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r2u7l-0005aw-PO for submit@debbugs.gnu.org; Tue, 14 Nov 2023 09:10:42 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:60930) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r2u7i-0005aA-Se for 67175@debbugs.gnu.org; Tue, 14 Nov 2023 09:10:39 -0500 Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1r2u6x-0001rX-9s; Tue, 14 Nov 2023 09:09:51 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=gjqM5RJZzFq8WYPAMn5MThjxiPS0doUChdMxCB+9OgA=; b=MJ48iX9zqihRIzcCFpdp tgFVZ2YLvykegBjyrV+WixWm4HbtUgqDw33e8lyQypwYd6e1owy1myLhqU6UY80VHx1XvB8U2u+Dq zqtNmLbXNJ9NQwDlvqb4KgYccYQYB6pR7ve1rDuN0K71pux9L2DcaLn5RsLlaACHGdn7fb0NhI6Of VO0D4ZHsSoMN0eO35pJVhkVIe0zRMQIQf61OmeGoilen9RjpGB0hQQok9AJlhipxRbx0AEY515a5w 0hrRcTUAhcilROX+OQZV5Ghgv6P5DHpX01pRAicGPdqbrstkTomDEpXsXab3pyy5nLxG9uibADdSS BDTE9LZVhP/3lw==; From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= To: 67175@debbugs.gnu.org Subject: [PATCH 3/9] =?UTF-8?q?services:=20bitlbee:=20Remove=20use=20of=20?= =?UTF-8?q?=E2=80=98make-forkexec-constructor/container=E2=80=99.?= Date: Tue, 14 Nov 2023 15:09:12 +0100 Message-ID: <5e1107fcac6fbce929778e3e9cc5c2f1cc655aeb.1699970930.git.ludo@gnu.org> X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 67175 Cc: =?UTF-8?q?Ludovic=20Court=C3=A8s?= X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) This will only affect systems running Shepherd < 0.9.0, which was released in August 2022. * gnu/services/messaging.scm (bitlbee-shepherd-service): Remove ‘with-imported-modules’ and ‘modules’ field. Use ‘make-forkexec-constructor’ instead of ‘make-forkexec-constructor/container’ when ‘make-inetd-constructor’ is missing. Change-Id: I35a0487bccaee4799ad0d81388d540e5c7891f7e --- gnu/services/messaging.scm | 77 +++++++++++++++++--------------------- 1 file changed, 34 insertions(+), 43 deletions(-) diff --git a/gnu/services/messaging.scm b/gnu/services/messaging.scm index c4963936a0..7505810e7c 100644 --- a/gnu/services/messaging.scm +++ b/gnu/services/messaging.scm @@ -849,56 +849,47 @@ (define bitlbee-shepherd-service (target conf))) #:namespaces (delq 'net %namespaces)))) - (with-imported-modules (source-module-closure - '((gnu build shepherd) - (gnu system file-systems))) - (list (shepherd-service - (provision '(bitlbee)) + (list (shepherd-service + (provision '(bitlbee)) - ;; Note: If networking is not up, then /etc/resolv.conf - ;; doesn't get mapped in the container, hence the dependency - ;; on 'networking'. - (requirement '(user-processes networking)) + ;; Note: If networking is not up, then /etc/resolv.conf + ;; doesn't get mapped in the container, hence the dependency + ;; on 'networking'. + (requirement '(user-processes networking)) - (modules '((gnu build shepherd) - (gnu system file-systems))) - (start #~(if (defined? 'make-inetd-constructor) + (start #~(if (defined? 'make-inetd-constructor) - (make-inetd-constructor - (list #$bitlbee* "-I" "-c" #$conf) - (list (endpoint - (addrinfo:addr - (car (getaddrinfo #$interface - #$(number->string port) - (logior AI_NUMERICHOST - AI_NUMERICSERV)))))) - #:requirements '#$requirement - #:service-name-stem "bitlbee" - #:user "bitlbee" #:group "bitlbee" + (make-inetd-constructor + (list #$bitlbee* "-I" "-c" #$conf) + (list (endpoint + (addrinfo:addr + (car (getaddrinfo #$interface + #$(number->string port) + (logior AI_NUMERICHOST + AI_NUMERICSERV)))))) + #:requirements '#$requirement + #:service-name-stem "bitlbee" + #:user "bitlbee" #:group "bitlbee" - ;; Allow 'bitlbee-purple' to use libpurple plugins. - #:environment-variables - (list (string-append "PURPLE_PLUGIN_PATH=" - #$plugins "/lib/purple-2") - "GUIX_LOCPATH=/run/current-system/locale")) + ;; Allow 'bitlbee-purple' to use libpurple plugins. + #:environment-variables + (list (string-append "PURPLE_PLUGIN_PATH=" + #$plugins "/lib/purple-2") + "GUIX_LOCPATH=/run/current-system/locale")) - (make-forkexec-constructor/container - (list #$(file-append bitlbee "/sbin/bitlbee") - "-n" "-F" "-u" "bitlbee" "-c" #$conf) + (make-forkexec-constructor + (list #$(file-append bitlbee "/sbin/bitlbee") + "-n" "-F" "-u" "bitlbee" "-c" #$conf) - ;; Allow 'bitlbee-purple' to use libpurple plugins. - #:environment-variables - (list (string-append "PURPLE_PLUGIN_PATH=" - #$plugins "/lib/purple-2")) + ;; Allow 'bitlbee-purple' to use libpurple plugins. + #:environment-variables + (list (string-append "PURPLE_PLUGIN_PATH=" + #$plugins "/lib/purple-2")) - #:pid-file "/var/run/bitlbee.pid" - #:mappings (list (file-system-mapping - (source "/var/lib/bitlbee") - (target source) - (writable? #t)))))) - (stop #~(if (defined? 'make-inetd-destructor) - (make-inetd-destructor) - (make-kill-destructor)))))))))) + #:pid-file "/var/run/bitlbee.pid"))) + (stop #~(if (defined? 'make-inetd-destructor) + (make-inetd-destructor) + (make-kill-destructor))))))))) (define %bitlbee-accounts ;; User group and account to run BitlBee. -- 2.41.0 From debbugs-submit-bounces@debbugs.gnu.org Tue Nov 14 09:10:44 2023 Received: (at 67175) by debbugs.gnu.org; 14 Nov 2023 14:10:44 +0000 Received: from localhost ([127.0.0.1]:60586 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r2u7m-0005az-9L for submit@debbugs.gnu.org; Tue, 14 Nov 2023 09:10:43 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:60934) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r2u7i-0005aB-Sx for 67175@debbugs.gnu.org; Tue, 14 Nov 2023 09:10:39 -0500 Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1r2u6x-0001rf-4Y; Tue, 14 Nov 2023 09:09:51 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=c2yRPCiw/zizh9hGqgCexpBiw40UrhjUFBoU9GL8Q5I=; b=VV6K4gM5DoguvIMxbpmc a4J0PjJ0fDFsgIQkzRkhfi6oHbGKVG+r0jW4ZS2FHhXCHAjTP8ky+sTAU0BK0tOBnprXMgH5cc/4q Q2fQqURzwdgSrYn0FDYuqNee2dKL6GeN2lU2cjNMUvEkcWCDA4MFUQEabZw7SLgyY8Fcx/o85U6zJ Q0rYDvdigu2c3eFoWak9LFiJA3NXF8M68lhXprEyou+Vp4eF1igNAp5gBXrMNEAHRLbuFlpMNAhw5 /diVpPDsABtVh7BcbHG8X+wbufLLvZppNttamVDI9ZR6jyWPB95kEtWNIl+E6MVcnfu/ZaWo6OmGK hOeZsRBMML9tIw==; From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= To: 67175@debbugs.gnu.org Subject: [PATCH 4/9] least-authority: Add support for changing UIDs/GIDs before exec. Date: Tue, 14 Nov 2023 15:09:13 +0100 Message-ID: <9044b132a3746d6874969615923f5c534ba00152.1699970930.git.ludo@gnu.org> X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-Debbugs-Cc: Christopher Baines , Josselin Poiret , Ludovic Courtès , Mathieu Othacehe , Ricardo Wurmus , Simon Tournier , Tobias Geerinckx-Rice Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 67175 Cc: =?UTF-8?q?Ludovic=20Court=C3=A8s?= X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * guix/least-authority.scm (least-authority-wrapper): Add #:user and #:group. [code]: Add calls to ‘setgid’ and ‘setuid’ when appropriate. Change-Id: I2aad8e5686b42b5c92fc306b114c5c60cb8bc551 --- guix/least-authority.scm | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/guix/least-authority.scm b/guix/least-authority.scm index bfd7275e7c..3465fe9a48 100644 --- a/guix/least-authority.scm +++ b/guix/least-authority.scm @@ -1,5 +1,5 @@ ;;; GNU Guix --- Functional package management for GNU -;;; Copyright © 2022 Ludovic Courtès +;;; Copyright © 2022-2023 Ludovic Courtès ;;; ;;; This file is part of GNU Guix. ;;; @@ -41,6 +41,8 @@ (define %precious-variables (define* (least-authority-wrapper program #:key (name "pola-wrapper") + (user #f) + (group #f) (guest-uid 1000) (guest-gid 1000) (mappings '()) @@ -55,7 +57,11 @@ (define* (least-authority-wrapper program records indicating directories mirrored inside the execution environment of PROGRAM. DIRECTORY is the working directory of the wrapped process. Each environment listed in PRESERVED-ENVIRONMENT-VARIABLES -is preserved; other environment variables are erased." +is preserved; other environment variables are erased. + +When USER and GROUP are set and NAMESPACES does not include 'user, change UIDs +and GIDs to these prior to executing PROGRAM. This usually requires that the +resulting wrapper be executed as root so it can call setgid(2) and setuid(2)." (define code (with-imported-modules (source-module-closure '((gnu system file-systems) @@ -113,6 +119,10 @@ (define* (least-authority-wrapper program #$program signal) (exit (+ 128 signal)))))) + (define namespaces '#$namespaces) + (define host-group '#$group) + (define host-user '#$user) + ;; Note: 'call-with-container' creates a sub-process that this one ;; waits for. This might seem suboptimal but unshare(2) isn't ;; really applicable: the process would still run in the same PID @@ -123,6 +133,17 @@ (define* (least-authority-wrapper program (lambda () (chdir #$directory) (environ variables) + + (unless (memq 'user namespaces) + ;; This process lives in its parent user namespace, + ;; presumably as root; now is the time to setgid/setuid if + ;; asked for it (the 'clone' call would fail with EPERM if we + ;; changed UIDs/GIDs beforehand). + (when host-group + (setgid (group:gid (getgr host-group)))) + (when host-user + (setuid (passwd:uid (getpw host-user))))) + (apply execl #$program #$program (cdr (command-line)))) ;; Don't assume PROGRAM can behave as an init process. -- 2.41.0 From debbugs-submit-bounces@debbugs.gnu.org Tue Nov 14 09:10:48 2023 Received: (at 67175) by debbugs.gnu.org; 14 Nov 2023 14:10:48 +0000 Received: from localhost ([127.0.0.1]:60593 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r2u7s-0005bq-0a for submit@debbugs.gnu.org; Tue, 14 Nov 2023 09:10:48 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:60968) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r2u7l-0005aM-RB for 67175@debbugs.gnu.org; Tue, 14 Nov 2023 09:10:42 -0500 Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1r2u70-0001s9-CE; Tue, 14 Nov 2023 09:09:54 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=bsUL5ut2xAvw6xsw81b1e8m+qf52gQs58+To7iwqDGI=; b=pMQoMzgAQGM3mZeXifpk 6IFaOH8fajuMfskRjr2+QRScQ7E+tFBAKO2J20or9VX1b1q0WEhJx9dyGhorrlIY6GsmHuVUrGIoN L/9+cIDvsOkfNV5lKYWFXYwMz8bV/UL+tRUieP+EDUWIoysfMR3VTUle3I/gquNaWaMWDHXAG1SvJ QADhXpLj6H6eyPnr3qDbricEvJSlXgW9b7cMCYwljpNtcGptpVQwSHVf3LjxPcwpFeS2AJcOMS1qp p67zdbFcSyxADpp010835eIyiTd4DIpp7/su+HadJIoGKxps5KfI0cB5bghf4dY2SNPM9x/EnMeB7 5LBTS7OuqTbymw==; From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= To: 67175@debbugs.gnu.org Subject: [PATCH 7/9] =?UTF-8?q?services:=20jami:=20Use=20=E2=80=98least-au?= =?UTF-8?q?thority-wrapper=E2=80=99.?= Date: Tue, 14 Nov 2023 15:09:16 +0100 Message-ID: X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-Debbugs-Cc: Maxim Cournoyer Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 67175 Cc: =?UTF-8?q?Ludovic=20Court=C3=A8s?= X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/telephony.scm (jami-configuration->command-line-arguments) [wrapper]: New procedure. Use it. (jami-shepherd-services): In ‘start’ method of ‘jami’ service, use ‘fork+exec-command’ instead of ‘make-forkexec-constructor/container’. Remove use of (gnu build shepherd). Change-Id: Ic71c0c88477d92bf137d9d0a5832bae8721cc210 --- gnu/services/telephony.scm | 66 +++++++++++++++++++++----------------- 1 file changed, 37 insertions(+), 29 deletions(-) diff --git a/gnu/services/telephony.scm b/gnu/services/telephony.scm index 832470527d..16d109b8b1 100644 --- a/gnu/services/telephony.scm +++ b/gnu/services/telephony.scm @@ -261,9 +261,37 @@ (define %jami-accounts (define (jami-configuration->command-line-arguments config) "Derive the command line arguments to used to launch the Jami daemon from CONFIG, a object." + (define (wrapper libjami) + (least-authority-wrapper + ;; XXX: 'gexp-input' is needed as the outer layer so that + ;; 'references-file' picks the right output of LIBJAMI. + (gexp-input (file-append (gexp-input libjami "bin") "/libexec/jamid") + "bin") + #:mappings + (list (file-system-mapping + (source "/dev/log") ;for syslog + (target source)) + (file-system-mapping + (source "/var/lib/jami") + (target source) + (writable? #t)) + (file-system-mapping + (source "/var/run/jami") + (target source) + (writable? #t)) + ;; Expose TLS certificates for GnuTLS. + (file-system-mapping + (source (file-append nss-certs "/etc/ssl/certs")) + (target "/etc/ssl/certs"))) + #:preserved-environment-variables + '("DBUS_SESSION_BUS_ADDRESS" "SSL_CERT_DIR") + #:user "jami" + #:group "jami" + #:namespaces (fold delq %namespaces '(net user)))) + (match-record config (libjami dbus enable-logging? debug? auto-answer?) - `(,#~(string-append #$libjami:bin "/libexec/jamid") + `(,(wrapper libjami) "--persistent" ;stay alive after client quits ,@(if enable-logging? '() ;logs go to syslog by default @@ -334,7 +362,6 @@ (define (jami-shepherd-services config) (with-imported-modules (source-module-closure '((gnu build dbus-service) (gnu build jami-service) - (gnu build shepherd) (gnu system file-systems))) (define list-accounts-action @@ -562,7 +589,6 @@ (define (jami-shepherd-services config) (srfi srfi-26) (gnu build dbus-service) (gnu build jami-service) - (gnu build shepherd) (gnu system file-systems) ,@%default-modules)) (start @@ -608,32 +634,14 @@ (define (jami-shepherd-services config) ;; Start the daemon. (define daemon-pid - ((make-forkexec-constructor/container - (list #$@(jami-configuration->command-line-arguments - config)) - #:mappings - (list (file-system-mapping - (source "/dev/log") ;for syslog - (target source)) - (file-system-mapping - (source "/var/lib/jami") - (target source) - (writable? #t)) - (file-system-mapping - (source "/var/run/jami") - (target source) - (writable? #t)) - ;; Expose TLS certificates for GnuTLS. - (file-system-mapping - (source #$(file-append nss-certs "/etc/ssl/certs")) - (target "/etc/ssl/certs"))) - #:user "jami" - #:group "jami" - #:environment-variables - (list (string-append "DBUS_SESSION_BUS_ADDRESS=" - "unix:path=/var/run/jami/bus") - ;; Expose TLS certificates for OpenSSL. - "SSL_CERT_DIR=/etc/ssl/certs")))) + (fork+exec-command + (list #$@(jami-configuration->command-line-arguments + config)) + #:environment-variables + (list (string-append "DBUS_SESSION_BUS_ADDRESS=" + "unix:path=/var/run/jami/bus") + ;; Expose TLS certificates for OpenSSL. + "SSL_CERT_DIR=/etc/ssl/certs"))) (setenv "DBUS_SESSION_BUS_ADDRESS" "unix:path=/var/run/jami/bus") -- 2.41.0 From debbugs-submit-bounces@debbugs.gnu.org Tue Nov 14 09:10:49 2023 Received: (at 67175) by debbugs.gnu.org; 14 Nov 2023 14:10:49 +0000 Received: from localhost ([127.0.0.1]:60595 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r2u7s-0005by-Qo for submit@debbugs.gnu.org; Tue, 14 Nov 2023 09:10:49 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:60944) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r2u7l-0005aK-R5 for 67175@debbugs.gnu.org; Tue, 14 Nov 2023 09:10:43 -0500 Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1r2u6y-0001s0-Lj; Tue, 14 Nov 2023 09:09:54 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=jRGQi7SsU6cfNLYfud2uepi1KPHVYjrJsjRze/fTXOE=; b=KPcHulbR2qhbYFgW39Wu 0QqkY4VLXZaqNxVtwIlbb5nXjupaWkhKVkpO2bQhQAyENl+CRg0cbopha6vMmazqAP4pn0CUNn99p vkE4TzLDcIbp5XGYZqxVuuS+dxrvWsFg0OAY2kkx9bKqeKzETbzGYVlR9/EU1qLIzYohLo4OyBG0x KUQXQ9tATaRth8LFKndQ6Q8BXDBkb3MVynejfFnAPGW2ij7s6/TqkfQaUSO3l9gJtz8bWCz9vdQ18 M4ScoiqBeFtaY77LC1hG3HtViQsxi1tu3mJjwbyuIylODB1GrAEop9/2sgCeEs32F9HkyYie6HpFa 4JETeBLpUCO5Nw==; From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= To: 67175@debbugs.gnu.org Subject: [PATCH 5/9] tests: jami: Check status of Jami D-Bus session. Date: Tue, 14 Nov 2023 15:09:14 +0100 Message-ID: <2dcf5b29c48d4c243efaa7875d797c90c0b4a06a.1699970930.git.ludo@gnu.org> X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 X-Debbugs-Cc: Maxim Cournoyer Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 67175 Cc: =?UTF-8?q?Ludovic=20Court=C3=A8s?= X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/tests/telephony.scm (run-jami-test)["dbus session is up"]: New test. Change-Id: Ifa9b57c732f3c64e1ec6bf3028b69a57cee56320 --- gnu/tests/telephony.scm | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/gnu/tests/telephony.scm b/gnu/tests/telephony.scm index 442258dbc3..f159e970f7 100644 --- a/gnu/tests/telephony.scm +++ b/gnu/tests/telephony.scm @@ -184,6 +184,15 @@ (define* (run-jami-test #:key provisioning? partial?) %load-path) marionette)) + (test-assert "dbus session is up" + (and (marionette-eval + '(begin + (use-modules (gnu services herd)) + (wait-for-service 'jami-dbus-session)) + marionette) + (wait-for-unix-socket "/var/run/jami/bus" + marionette))) + (test-assert "service is running" (marionette-eval '(begin -- 2.41.0 From debbugs-submit-bounces@debbugs.gnu.org Tue Nov 14 09:10:49 2023 Received: (at 67175) by debbugs.gnu.org; 14 Nov 2023 14:10:49 +0000 Received: from localhost ([127.0.0.1]:60597 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r2u7t-0005c2-4l for submit@debbugs.gnu.org; Tue, 14 Nov 2023 09:10:49 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:60952) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r2u7l-0005aL-R8 for 67175@debbugs.gnu.org; Tue, 14 Nov 2023 09:10:43 -0500 Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1r2u6z-0001s7-GT; Tue, 14 Nov 2023 09:09:54 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=j7dQB2VANLfzcj2zYZyAVwxUHSkKgm7CCa+nV9XFbKU=; b=qlXU8akTAolj/MXOruuK MFOQ6vvULiHtKmmSdxKH5tbfJ5AIUr2xjoZiJmq6Tr1O+CT5RR8Mt874YCYFFWsinVHyE5nYX8vQr ppaIk7BraF7JoknQ+TqfdVpZBP+j9AcPs5yLGDuUdAXse7E+c9rfK6nzeyU8sMQJ7IvAGqvIHTGMa X4x0RNxC1uiDpbDnP9iJmZNx58vP6OgmiSu3hqC3Ms6S2eCWm8CSil565ZXenZsBJ0eLUX2qlBdi0 ZJkV4O4Mi+kFRW3V5cvt5D06KRvF+ZldgDdMtAiSe3CtpoiYcmosgEZ76QM5/aSbiwdQdbfFNSnnE sXapM40uCm2DPw==; From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= To: 67175@debbugs.gnu.org Subject: [PATCH 6/9] =?UTF-8?q?services:=20jami-dbus-session:=20Use=20?= =?UTF-8?q?=E2=80=98least-authority-wrapper=E2=80=99.?= Date: Tue, 14 Nov 2023 15:09:15 +0100 Message-ID: <05c3a9993783b02b89083b1ae0562a79af4c61b2.1699970930.git.ludo@gnu.org> X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-Debbugs-Cc: Maxim Cournoyer Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 67175 Cc: =?UTF-8?q?Ludovic=20Court=C3=A8s?= X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/telephony.scm (jami-shepherd-services): Use ‘least-authority-wrapper’ for ‘dbus-daemon’. Use ‘fork+exec-command’ instead of ‘make-forkexec-constructor/container’ in the ‘start’ method’. Remove reference to (gnu build shepherd). Change-Id: I9d9f8de6ecea77950000ff64aa8c8d097dc028a0 --- gnu/services/telephony.scm | 66 +++++++++++++++++++++++++------------- 1 file changed, 43 insertions(+), 23 deletions(-) diff --git a/gnu/services/telephony.scm b/gnu/services/telephony.scm index c9b5d6cd99..832470527d 100644 --- a/gnu/services/telephony.scm +++ b/gnu/services/telephony.scm @@ -34,6 +34,9 @@ (define-module (gnu services telephony) #:use-module (guix modules) #:use-module (guix packages) #:use-module (guix gexp) + #:autoload (guix least-authority) (least-authority-wrapper) + #:autoload (gnu system file-systems) (file-system-mapping) + #:autoload (gnu build linux-container) (%namespaces) #:use-module (srfi srfi-1) #:use-module (srfi srfi-2) #:use-module (srfi srfi-26) @@ -298,7 +301,28 @@ (define (jami-shepherd-services config) (let* ((libjami (jami-configuration-libjami config)) (nss-certs (jami-configuration-nss-certs config)) (dbus (jami-configuration-dbus config)) - (dbus-daemon (file-append dbus "/bin/dbus-daemon")) + (dbus-daemon (least-authority-wrapper + (file-append dbus "/bin/dbus-daemon") + #:name "dbus-daemon" + #:user "jami" + #:group "jami" + #:preserved-environment-variables + '("XDG_DATA_DIRS") + #:mappings + (list (file-system-mapping + (source "/dev/log") ;for syslog + (target source)) + (file-system-mapping + (source "/var/run/jami") + (target source) + (writable? #t)) + (file-system-mapping + (source (gexp-input libjami "bin")) + (target source))) + ;; 'dbus-daemon' wants to look up users in /etc/passwd + ;; so run it in the global user namespace. + #:namespaces + (fold delq %namespaces '(net user)))) (accounts (jami-configuration-accounts config)) (declarative-mode? (maybe-value-set? accounts))) @@ -490,8 +514,7 @@ (define (jami-shepherd-services config) (list (shepherd-service (documentation "Run a D-Bus session for the Jami daemon.") (provision '(jami-dbus-session)) - (modules `((gnu build shepherd) - (gnu build dbus-service) + (modules `((gnu build dbus-service) (gnu build jami-service) (gnu system file-systems) ,@%default-modules)) @@ -499,26 +522,23 @@ (define (jami-shepherd-services config) ;; activation for D-Bus, such as a /etc/machine-id file. (requirement '(dbus-system syslogd)) (start - #~(make-forkexec-constructor/container - (list #$dbus-daemon "--session" - "--address=unix:path=/var/run/jami/bus" - "--syslog-only") - #:pid-file "/var/run/jami/pid" - #:mappings - (list (file-system-mapping - (source "/dev/log") ;for syslog - (target source)) - (file-system-mapping - (source "/var/run/jami") - (target source) - (writable? #t))) - #:user "jami" - #:group "jami" - #:environment-variables - ;; This is so that the cx.ring.Ring service D-Bus - ;; definition is found by dbus-daemon. - (list (string-append "XDG_DATA_DIRS=" - #$libjami:bin "/share")))) + #~(lambda () + (define pid + (fork+exec-command + (list #$dbus-daemon "--session" + "--address=unix:path=/var/run/jami/bus" + "--syslog-only") + #:environment-variables + ;; This is so that the cx.ring.Ring service D-Bus + ;; definition is found by dbus-daemon. + (list (string-append "XDG_DATA_DIRS=" + #$libjami:bin "/share")))) + + ;; The PID file contains the "wrong" PID (the one in the + ;; separate PID namespace) so ignore it and return the + ;; value returned by 'fork+exec-command'. + (and (read-pid-file "/var/run/jami/pid") + pid))) (stop #~(make-kill-destructor))) (shepherd-service -- 2.41.0 From debbugs-submit-bounces@debbugs.gnu.org Tue Nov 14 09:10:50 2023 Received: (at 67175) by debbugs.gnu.org; 14 Nov 2023 14:10:50 +0000 Received: from localhost ([127.0.0.1]:60599 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r2u7t-0005cD-Km for submit@debbugs.gnu.org; Tue, 14 Nov 2023 09:10:50 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:60978) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r2u7m-0005aV-M1 for 67175@debbugs.gnu.org; Tue, 14 Nov 2023 09:10:44 -0500 Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1r2u71-0001sk-6P; Tue, 14 Nov 2023 09:09:55 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=kggIVBwqg15PvFVCNAv10Mp04NMevZ4yCjBx7VM5dTo=; b=iT7lwSyjEOb4ZkDXcEyw q7rYCg9aL8si5Y8vh+Xv8zbA7mnZZhk05bFy010eTMDsIjcnVbQA27P9ZQMNO4qGxlTy3Cwh01Juq Qwa/ogl0c1VMdRvYXD3tHf22iG+eOIoEOAFhxk56FQfnxmjq6kqEgi1Mnf8RFPmIdatnoqmR79YwQ SB+DqbeySH4jWP8w27rrB8FNNkcKdr9ivPWylxSWZ5pSMJ1zn4BT2yPydpdtJxVal0Aza7SdI9M9I B3kzBKugOeqzkF4I5h1oHqh8VhBh82V7souznpElBcytEa/qbdNc2SbPQngFC40PjTY+Q0OXo33E/ ppcvIs/9r6CaIw==; From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= To: 67175@debbugs.gnu.org Subject: [PATCH 8/9] services: Remove unnecessary references to (gnu build shepherd). Date: Tue, 14 Nov 2023 15:09:17 +0100 Message-ID: <9d76fe617e048052bab9f1033d292fe068b1652c.1699970930.git.ludo@gnu.org> X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 67175 Cc: =?UTF-8?q?Ludovic=20Court=C3=A8s?= X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) * gnu/services/databases.scm (memcached-shepherd-service): Remove ‘with-imported-modules’ form and ‘modules’ field. * gnu/services/security-token.scm (pcscd-shepherd-service): Remove ‘with-imported-modules’ form. * gnu/services/web.scm (hpcguix-web-shepherd-service): Likewise. Change-Id: Ieb817508f1751e0c1ff551a0e078789a4a813c1c --- gnu/services/databases.scm | 41 +++++++++++++-------------- gnu/services/security-token.scm | 29 +++++++++---------- gnu/services/web.scm | 50 ++++++++++++++++----------------- 3 files changed, 56 insertions(+), 64 deletions(-) diff --git a/gnu/services/databases.scm b/gnu/services/databases.scm index d3fee2a8ef..580031cb42 100644 --- a/gnu/services/databases.scm +++ b/gnu/services/databases.scm @@ -512,28 +512,25 @@ (define memcached-shepherd-service (match-lambda (($ memcached interfaces tcp-port udp-port additional-options) - (with-imported-modules (source-module-closure - '((gnu build shepherd))) - (list (shepherd-service - (provision '(memcached)) - (documentation "Run the Memcached daemon.") - (requirement '(user-processes loopback)) - (modules '((gnu build shepherd))) - (start #~(make-forkexec-constructor - `(#$(file-append memcached "/bin/memcached") - "-l" #$(string-join interfaces ",") - "-p" #$(number->string tcp-port) - "-U" #$(number->string udp-port) - "--daemon" - ;; Memcached changes to the memcached user prior to - ;; writing the pid file, so write it to a directory - ;; that memcached owns. - "-P" "/var/run/memcached/pid" - "-u" "memcached" - ,#$@additional-options) - #:log-file "/var/log/memcached" - #:pid-file "/var/run/memcached/pid")) - (stop #~(make-kill-destructor)))))))) + (list (shepherd-service + (provision '(memcached)) + (documentation "Run the Memcached daemon.") + (requirement '(user-processes loopback)) + (start #~(make-forkexec-constructor + `(#$(file-append memcached "/bin/memcached") + "-l" #$(string-join interfaces ",") + "-p" #$(number->string tcp-port) + "-U" #$(number->string udp-port) + "--daemon" + ;; Memcached changes to the memcached user prior to + ;; writing the pid file, so write it to a directory + ;; that memcached owns. + "-P" "/var/run/memcached/pid" + "-u" "memcached" + ,#$@additional-options) + #:log-file "/var/log/memcached" + #:pid-file "/var/run/memcached/pid")) + (stop #~(make-kill-destructor))))))) (define memcached-service-type (service-type (name 'memcached) diff --git a/gnu/services/security-token.scm b/gnu/services/security-token.scm index 2356273398..d971091e73 100644 --- a/gnu/services/security-token.scm +++ b/gnu/services/security-token.scm @@ -50,22 +50,19 @@ (define-record-type* (define pcscd-shepherd-service (match-lambda (($ pcsc-lite) - (with-imported-modules (source-module-closure - '((gnu build shepherd))) - (shepherd-service - (documentation "PC/SC Smart Card Daemon") - (provision '(pcscd)) - (requirement '(syslogd)) - (modules '((gnu build shepherd))) - (start #~(lambda _ - (let ((socket "/run/pcscd/pcscd.comm")) - (when (file-exists? socket) - (delete-file socket))) - (fork+exec-command - (list #$(file-append pcsc-lite "/sbin/pcscd") - "--foreground") - #:log-file "/var/log/pcscd.log"))) - (stop #~(make-kill-destructor))))))) + (shepherd-service + (documentation "PC/SC Smart Card Daemon") + (provision '(pcscd)) + (requirement '(syslogd)) + (start #~(lambda _ + (let ((socket "/run/pcscd/pcscd.comm")) + (when (file-exists? socket) + (delete-file socket))) + (fork+exec-command + (list #$(file-append pcsc-lite "/sbin/pcscd") + "--foreground") + #:log-file "/var/log/pcscd.log"))) + (stop #~(make-kill-destructor)))))) (define pcscd-activation (match-lambda diff --git a/gnu/services/web.scm b/gnu/services/web.scm index 818226a4f7..8eb00f76e3 100644 --- a/gnu/services/web.scm +++ b/gnu/services/web.scm @@ -1231,32 +1231,30 @@ (define %hpcguix-web-log-rotations (define (hpcguix-web-shepherd-service config) (let ((specs (hpcguix-web-configuration-specs config)) (hpcguix-web (hpcguix-web-package config))) - (with-imported-modules (source-module-closure - '((gnu build shepherd))) - (shepherd-service - (documentation "hpcguix-web daemon") - (provision '(hpcguix-web)) - (requirement '(networking)) - (start #~(make-forkexec-constructor - (list #$(file-append hpcguix-web "/bin/hpcguix-web") - (string-append "--listen=" - #$(hpcguix-web-configuration-address - config)) - "-p" - #$(number->string - (hpcguix-web-configuration-port config)) - #$@(if specs - #~((string-append "--config=" - #$(scheme-file - "hpcguix-web.scm" specs))) - #~())) - #:user "hpcguix-web" - #:group "hpcguix-web" - #:environment-variables - (list "XDG_CACHE_HOME=/var/cache/guix/web" - "SSL_CERT_DIR=/etc/ssl/certs") - #:log-file #$%hpcguix-web-log-file)) - (stop #~(make-kill-destructor)))))) + (shepherd-service + (documentation "hpcguix-web daemon") + (provision '(hpcguix-web)) + (requirement '(networking)) + (start #~(make-forkexec-constructor + (list #$(file-append hpcguix-web "/bin/hpcguix-web") + (string-append "--listen=" + #$(hpcguix-web-configuration-address + config)) + "-p" + #$(number->string + (hpcguix-web-configuration-port config)) + #$@(if specs + #~((string-append "--config=" + #$(scheme-file + "hpcguix-web.scm" specs))) + #~())) + #:user "hpcguix-web" + #:group "hpcguix-web" + #:environment-variables + (list "XDG_CACHE_HOME=/var/cache/guix/web" + "SSL_CERT_DIR=/etc/ssl/certs") + #:log-file #$%hpcguix-web-log-file)) + (stop #~(make-kill-destructor))))) (define hpcguix-web-service-type (service-type -- 2.41.0 From debbugs-submit-bounces@debbugs.gnu.org Tue Nov 14 09:10:50 2023 Received: (at 67175) by debbugs.gnu.org; 14 Nov 2023 14:10:50 +0000 Received: from localhost ([127.0.0.1]:60601 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r2u7u-0005cH-74 for submit@debbugs.gnu.org; Tue, 14 Nov 2023 09:10:50 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:60984) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r2u7n-0005aa-Fb for 67175@debbugs.gnu.org; Tue, 14 Nov 2023 09:10:44 -0500 Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1r2u72-0001tD-0x; Tue, 14 Nov 2023 09:09:56 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:References:In-Reply-To:Date:Subject:To: From; bh=8UUzoZ8WYkWViLnVfuRZp0DdKyxtHcDjT7hKIVtIjT0=; b=TWvlOFPIARVAQmovpMsQ eoswQvflA3wIMKhdbc77S0O6R6W9DEOD3vOlsppTsnHzsZ7XijlgDkKu6HHCfjrPAWPnL+KMgMCwK 2QLhus7GTfWfe7NhQBXowqQ2HcXo/DBCpmwzP5DJ8wZ3SRboXY9VU0ohSDysIPXQXD1ZjakjwPSOx uDxMo6bOdclSNmN9LFDk2foY1G3054GO9uDmhP7CE79sEdI09QzDeu96d83GKyXMyZNmnNhHwYK1C 2FniOdnWco19w9LaJzVjh01LEbFIQrZwVPIoripTE87DjE2l8HXmKupaWwTcR2enPags9JTTf5DpB 1TQDWpBEwunARg==; From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= To: 67175@debbugs.gnu.org Subject: [PATCH 9/9] =?UTF-8?q?shepherd:=20Remove=20=E2=80=98make-forkexec?= =?UTF-8?q?-constructor/container=E2=80=99.?= Date: Tue, 14 Nov 2023 15:09:18 +0100 Message-ID: <814e03ee68566de3912c5962a43e2241b1775b52.1699970930.git.ludo@gnu.org> X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 67175 Cc: =?UTF-8?q?Ludovic=20Court=C3=A8s?= X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) This was superseded by ‘least-authority-wrapper’. * gnu/build/shepherd.scm (read-pid-file/container) (make-forkexec-constructor/container): Remove. Change-Id: I6acccdff2609a35807608f865a4d381146113a88 --- gnu/build/shepherd.scm | 90 ------------------------------------------ 1 file changed, 90 deletions(-) diff --git a/gnu/build/shepherd.scm b/gnu/build/shepherd.scm index 9d9bfcfbc0..4ead27be0b 100644 --- a/gnu/build/shepherd.scm +++ b/gnu/build/shepherd.scm @@ -33,7 +33,6 @@ (define-module (gnu build shepherd) %precious-signals) #:autoload (shepherd system) (unblock-signals) #:export (default-mounts - make-forkexec-constructor/container fork+exec-command/container)) ;;; Commentary: @@ -101,27 +100,6 @@ (define* (default-mounts #:key (namespaces (default-namespaces '()))) (file-exists? (file-system-mapping-source mapping))) mappings))))) -(define* (read-pid-file/container pid pid-file #:key (max-delay 5)) - "Read PID-FILE in the container namespaces of PID, which exists in a -separate mount and PID name space. Return the \"outer\" PID. " - (match (container-excursion* pid - (lambda () - ;; XXX: Trick for Shepherd 0.9: prevent 'read-pid-file' from - ;; using (@ (fibers) sleep), which would try to suspend the - ;; current task, which doesn't work in this extra process. - (with-continuation-barrier - (lambda () - (read-pid-file pid-file - #:max-delay max-delay))))) - (#f - ;; Send SIGTERM to the whole process group. - (catch-system-error (kill (- pid) SIGTERM)) - #f) - ((? integer? container-pid) - ;; XXX: When COMMAND is started in a separate PID namespace, its - ;; PID is always 1, but that's not what Shepherd needs to know. - pid))) - (define* (exec-command* command #:key user group log-file pid-file (supplementary-groups '()) (directory "/") (environment-variables (environ))) @@ -144,74 +122,6 @@ (define* (exec-command* command #:key user group log-file pid-file #:directory directory #:environment-variables environment-variables)) -(define* (make-forkexec-constructor/container command - #:key - (namespaces - (default-namespaces args)) - (mappings '()) - (user #f) - (group #f) - (supplementary-groups '()) - (log-file #f) - pid-file - (pid-file-timeout 5) - (directory "/") - (environment-variables - (environ)) - #:rest args) - "This is a variant of 'make-forkexec-constructor' that starts COMMAND in -NAMESPACES, a list of Linux namespaces such as '(mnt ipc). MAPPINGS is the -list of to make in the case of a separate mount -namespace, in addition to essential bind-mounts such /proc." - (define container-directory - (match command - ((program _ ...) - (string-append "/var/run/containers/" (basename program))))) - - (define auto-mappings - `(,@(if log-file - (list (file-system-mapping - (source log-file) - (target source) - (writable? #t))) - '()))) - - (define mounts - (append (map file-system-mapping->bind-mount - (append auto-mappings mappings)) - (default-mounts #:namespaces namespaces))) - - (lambda args - (mkdir-p container-directory) - - (when log-file - ;; Create LOG-FILE so we can map it in the container. - (unless (file-exists? log-file) - (close (open log-file (logior O_CREAT O_APPEND O_CLOEXEC) #o640)) - (when user - (let ((pw (getpwnam user))) - (chown log-file (passwd:uid pw) (passwd:gid pw)))))) - - (let ((pid (run-container container-directory - mounts namespaces 1 - (lambda () - (exec-command* command - #:user user - #:group group - #:supplementary-groups - supplementary-groups - #:pid-file pid-file - #:log-file log-file - #:directory directory - #:environment-variables - environment-variables))))) - (if pid-file - (if (or (memq 'mnt namespaces) (memq 'pid namespaces)) - (read-pid-file/container pid pid-file - #:max-delay pid-file-timeout) - (read-pid-file pid-file #:max-delay pid-file-timeout)) - pid)))) - (define* (fork+exec-command/container command #:key pid #:allow-other-keys -- 2.41.0 From debbugs-submit-bounces@debbugs.gnu.org Sun Dec 03 20:39:07 2023 Received: (at 67175) by debbugs.gnu.org; 4 Dec 2023 01:39:07 +0000 Received: from localhost ([127.0.0.1]:33177 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r9xvP-0000vT-CF for submit@debbugs.gnu.org; Sun, 03 Dec 2023 20:39:07 -0500 Received: from mail-qk1-x732.google.com ([2607:f8b0:4864:20::732]:45326) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r9xvN-0000uz-KU for 67175@debbugs.gnu.org; Sun, 03 Dec 2023 20:39:06 -0500 Received: by mail-qk1-x732.google.com with SMTP id af79cd13be357-77d895c298eso260749985a.3 for <67175@debbugs.gnu.org>; Sun, 03 Dec 2023 17:38:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1701653929; x=1702258729; darn=debbugs.gnu.org; h=content-transfer-encoding:mime-version:user-agent:message-id:date :references:in-reply-to:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=JZOGNolf4v0IllGpRcD0/hK/LO0xll4a625dyd8JNBE=; b=VvS3wzffHl+JsTWK59xK3ikPivJ3yzD/0GkfBU+SdMblqcVW2FhXzOOMI8PcShkFav mKeCs0HIDlpLM07wQftu6UflMLnnC6RTcqNZhNBnhHdU3FjeFk6bbzWnHsc3Jb1HtAaZ FoYk0KJ957OHnf8u8UF8q55Ekl06zgXRv2kTz3Bl+DOKdSqdUZd5lhTEg/waRje+waGf 3Y4O/ePIAJGR/2kTTslGYGAqyqAbX63I210HEHmII0C8xFSrfHfGdzeXB107TmHVB9gz vGrCpqnQafSTy3s7hSzIRDhoQVwfJEsjutAZMHa7P96gezmA9FLffVWLWxIXkS1ZdQq/ vvHQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701653929; x=1702258729; h=content-transfer-encoding:mime-version:user-agent:message-id:date :references:in-reply-to:subject:cc:to:from:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=JZOGNolf4v0IllGpRcD0/hK/LO0xll4a625dyd8JNBE=; b=at5msA4THSWHOnw9uZ1lrlE/xrwUNO9PinkzXGGc0QS8zZ2XbzQsBMtpbSU7uPpxvO 9dal7a6YraM4qg+JTE37i2uv/Hk2T5HMEX9uKUqUHHlMUEWoTWUFJZ4PbGHloYOh31VF 4rLGrhAOvXmk9DnuRdk4P4vlhh+iu4gBKE9D54NVGwhYp8hLcwa2HsLun4VWeDWUbPl5 icvx+/+l7eOQ1SrecvA1V4dJK2F4xUH7wh4+YUa61IBLZ+ER/g3bmPfRHW5rwyIVsoje xz2fSKJsVZNriIsPLL2c/FT37j/q2Y4oEgvW7DehtU5QOncQ88aNGaOIYDQNiJPVk1Zl Sd3Q== X-Gm-Message-State: AOJu0YyFZlGXeFAD7q46CvU7UcIDX/CjdeHwOuaZyd2gKTWfriwFQYHo EQRWhNbb2XWWNeFmioo1TaHpoHBe2pQQUA== X-Google-Smtp-Source: AGHT+IEn3mylYCnH7OPEKhn3yQAwRj90VQqfuXj/cLWirxq+5Mzjam6C7bXk9qHOHXwbFBruwd0cIg== X-Received: by 2002:a05:620a:8227:b0:77d:645a:85e7 with SMTP id ow39-20020a05620a822700b0077d645a85e7mr3782620qkn.42.1701653929409; Sun, 03 Dec 2023 17:38:49 -0800 (PST) Received: from hurd (dsl-141-198.b2b2c.ca. [66.158.141.198]) by smtp.gmail.com with ESMTPSA id to12-20020a05620a4c8c00b0077dc5e60fa1sm3780254qkn.54.2023.12.03.17.38.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 03 Dec 2023 17:38:48 -0800 (PST) From: Maxim Cournoyer To: Ludovic =?utf-8?Q?Court=C3=A8s?= Subject: Re: [bug#67175] [PATCH 7/9] services: jami: Use =?utf-8?Q?=E2=80=98least-authority-wrapper=E2=80=99=2E?= In-Reply-To: ("Ludovic =?utf-8?Q?Court=C3=A8s=22's?= message of "Tue, 14 Nov 2023 15:09:16 +0100") References: Date: Sun, 03 Dec 2023 20:38:45 -0500 Message-ID: <875y1eu4pm.fsf@gmail.com> User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -0.0 (/) X-Debbugs-Envelope-To: 67175 Cc: 67175@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Hi, Ludovic Court=C3=A8s writes: > * gnu/services/telephony.scm (jami-configuration->command-line-arguments) > [wrapper]: New procedure. nitpick: Should be , according to 'info (standards) Indicating the Part Changed' > Use it. > (jami-shepherd-services): In =E2=80=98start=E2=80=99 method of =E2=80=98j= ami=E2=80=99 service, use > =E2=80=98fork+exec-command=E2=80=99 instead of =E2=80=98make-forkexec-con= structor/container=E2=80=99. > Remove use of (gnu build shepherd). > > Change-Id: Ic71c0c88477d92bf137d9d0a5832bae8721cc210 > --- > gnu/services/telephony.scm | 66 +++++++++++++++++++++----------------- > 1 file changed, 37 insertions(+), 29 deletions(-) > > diff --git a/gnu/services/telephony.scm b/gnu/services/telephony.scm > index 832470527d..16d109b8b1 100644 > --- a/gnu/services/telephony.scm > +++ b/gnu/services/telephony.scm > @@ -261,9 +261,37 @@ (define %jami-accounts > (define (jami-configuration->command-line-arguments config) > "Derive the command line arguments to used to launch the Jami daemon f= rom > CONFIG, a object." > + (define (wrapper libjami) > + (least-authority-wrapper > + ;; XXX: 'gexp-input' is needed as the outer layer so that > + ;; 'references-file' picks the right output of LIBJAMI. It seems clearer to me to stick to the current #~(string-append #$libjami:bin "/libexec/jamid") until file-append can handle non-default outputs more elegantly (did we have a bug for that? -- I couldn't find one). The rest LGTM, if both jami system tests pass. --=20 Thanks, Maxim From debbugs-submit-bounces@debbugs.gnu.org Sun Dec 03 20:43:20 2023 Received: (at 67175) by debbugs.gnu.org; 4 Dec 2023 01:43:20 +0000 Received: from localhost ([127.0.0.1]:33186 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r9xzU-00011t-E8 for submit@debbugs.gnu.org; Sun, 03 Dec 2023 20:43:20 -0500 Received: from mail-qk1-x72a.google.com ([2607:f8b0:4864:20::72a]:42404) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r9xzS-00011f-IM for 67175@debbugs.gnu.org; Sun, 03 Dec 2023 20:43:19 -0500 Received: by mail-qk1-x72a.google.com with SMTP id af79cd13be357-77dd4952308so340868585a.1 for <67175@debbugs.gnu.org>; Sun, 03 Dec 2023 17:43:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1701654182; x=1702258982; darn=debbugs.gnu.org; h=content-transfer-encoding:mime-version:user-agent:message-id:date :references:in-reply-to:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=PkWrv1A+/EFKeK19sgOqVsASyVy5Usqw2idAsrc/4tU=; b=U01/V7XLUcc0bgFugUgWHUNURiCy2gs98LGLJN0YfWk6R4wKH9B4ZX5aBMx5jBPPtU QOjigfA6L4F0VwAnblig+4obFkfh/dJZSGT+NkeZSLJKyGr6fPaDjcluPEp5FO7xUxmL 3CitwSxs1QVwedYWk4IJOwnyFDEpzuMOWOhfZ+Bcj5DC4yzVkL1g2HGCe0ZA7D3fGKBS HIGmWRKZ3rqeK7aUmpBgkFfMYXURoyqE/LUsybGSVNVqK3KtqrXc0SVOhUqCfM8/+Map +QbCjtfbbeg817AZNG1qww+OnOtE2C1B7txnBU/ExbucFTFkHApnkm2sQ5mFsKs2vwY/ P7Iw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701654182; x=1702258982; h=content-transfer-encoding:mime-version:user-agent:message-id:date :references:in-reply-to:subject:cc:to:from:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=PkWrv1A+/EFKeK19sgOqVsASyVy5Usqw2idAsrc/4tU=; b=bJWvuEsFyz0p1nC1iXSouGBT+c0YDDmQ27x3yKJOMbFG3h1ghGg5GM4EWtEo25/Zde dZvcaRD9pKt/232nITHB9nBTT2tC8aabVSGTux6kPW8R9d6NzPXbfUoYaXRTt3JXScgv xkZXe826CpZIQ1Bof6v2/2u8m9HSkRh/VVvmk1roAdaF7989uhYpn/lS1fOnZ57md5rm 4ORbUlxYAsj8Lq3Wd5yVjzPl3s/cc/10fz2tOC2zaLS4XKWgjekATwB8m1ep/y+dzOYW OmSH2GzhXVPS3BP/b4jJBdEmZ/D4oj5DjsQOhg2BvKD7/VQF3D9tltQFYuSnQCUzyTHw /17Q== X-Gm-Message-State: AOJu0YwuP3ZLpIHRiBE6iVEpFAZTuKv1zeRLjquW8qNIGXvDZvwJe6ni gNSG6uFeCerFxTgvaQzrKkmBmhmuldYs/g== X-Google-Smtp-Source: AGHT+IFbdIDjaB1exPV1fVkiuTLIX52r1iMpguxDSyD77pDSTzTjMdG3DWJtfimGYz0q4ieQyAz4oQ== X-Received: by 2002:a05:620a:85e:b0:778:929b:ffcc with SMTP id u30-20020a05620a085e00b00778929bffccmr3978103qku.4.1701654181969; Sun, 03 Dec 2023 17:43:01 -0800 (PST) Received: from hurd (dsl-141-198.b2b2c.ca. [66.158.141.198]) by smtp.gmail.com with ESMTPSA id d23-20020a05620a159700b0077d749de2a3sm3828641qkk.67.2023.12.03.17.43.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 03 Dec 2023 17:43:01 -0800 (PST) From: Maxim Cournoyer To: Ludovic =?utf-8?Q?Court=C3=A8s?= Subject: Re: [bug#67175] [PATCH 5/9] tests: jami: Check status of Jami D-Bus session. In-Reply-To: <2dcf5b29c48d4c243efaa7875d797c90c0b4a06a.1699970930.git.ludo@gnu.org> ("Ludovic =?utf-8?Q?Court=C3=A8s=22's?= message of "Tue, 14 Nov 2023 15:09:14 +0100") References: <2dcf5b29c48d4c243efaa7875d797c90c0b4a06a.1699970930.git.ludo@gnu.org> Date: Sun, 03 Dec 2023 20:43:00 -0500 Message-ID: <871qc2u4ij.fsf@gmail.com> User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -0.0 (/) X-Debbugs-Envelope-To: 67175 Cc: 67175@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Hi, Ludovic Court=C3=A8s writes: > * gnu/tests/telephony.scm (run-jami-test)["dbus session is up"]: New > test. > > Change-Id: Ifa9b57c732f3c64e1ec6bf3028b69a57cee56320 > --- > gnu/tests/telephony.scm | 9 +++++++++ > 1 file changed, 9 insertions(+) > > diff --git a/gnu/tests/telephony.scm b/gnu/tests/telephony.scm > index 442258dbc3..f159e970f7 100644 > --- a/gnu/tests/telephony.scm > +++ b/gnu/tests/telephony.scm > @@ -184,6 +184,15 @@ (define* (run-jami-test #:key provisioning? partial?) > %load-path) > marionette)) >=20=20 > + (test-assert "dbus session is up" > + (and (marionette-eval > + '(begin > + (use-modules (gnu services herd)) > + (wait-for-service 'jami-dbus-session)) > + marionette) > + (wait-for-unix-socket "/var/run/jami/bus" > + marionette))) > + > (test-assert "service is running" > (marionette-eval > '(begin Reviewed-by: Maxim Cournoyer --=20 Thanks, Maxim From debbugs-submit-bounces@debbugs.gnu.org Sun Dec 03 20:45:55 2023 Received: (at 67175) by debbugs.gnu.org; 4 Dec 2023 01:45:55 +0000 Received: from localhost ([127.0.0.1]:33190 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r9y1z-00015n-00 for submit@debbugs.gnu.org; Sun, 03 Dec 2023 20:45:55 -0500 Received: from mail-qt1-x832.google.com ([2607:f8b0:4864:20::832]:53630) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r9y1u-00015Y-L8 for 67175@debbugs.gnu.org; Sun, 03 Dec 2023 20:45:54 -0500 Received: by mail-qt1-x832.google.com with SMTP id d75a77b69052e-42552a1ab48so5173041cf.3 for <67175@debbugs.gnu.org>; Sun, 03 Dec 2023 17:45:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1701654334; x=1702259134; darn=debbugs.gnu.org; h=content-transfer-encoding:mime-version:user-agent:message-id:date :references:in-reply-to:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=3L/fQTWViyIS8fkEz2d3gyLi1t1G3IL0X8WvesDcSpk=; b=DM23ikADYDHNSfq+E3KsQLEIB2VeFEmcyIdE9NEr9aOgrqHfGNvp9TbxkvTTKkETmR qaFEVafFTDl/SrjjpKerrgu9cBY9oo5fALFa8YOknGIcK/ycExA8fWLHfy0j9wcw+CEv EjaoYl0t3jmn4xxyIBjhkEN2Xqf8+lqTcfH0qAB+QpiZEj4FBxWNgcNFXgXWzNx8w9Cn Gfu/9Jf2pDWq8ZxS1y8anRhA++AeCVFBkSBTLKzFs3fxoNa36rmX26MZ6jeG73ypzc7A 0XxrEVQucY2EegkvkYCNF2KXdoUABWI2sqbkUI8M9wqlZ8m11Ossz397AoBmI57l5u2u AE3A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701654334; x=1702259134; h=content-transfer-encoding:mime-version:user-agent:message-id:date :references:in-reply-to:subject:cc:to:from:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=3L/fQTWViyIS8fkEz2d3gyLi1t1G3IL0X8WvesDcSpk=; b=AORC+ydFlBHdATgp1kmHp/xrWDuVjb6f1CK+nloHiUCAUY38Bvo8Nb+m2ArkJJThgE fVfcuYfA2vG7kjJI3bRHxS0evzL7NFWdnTGDqOAxhQ+nn5IBb1isTsx5A5DBCv07l183 qPfvkKkdOd4vVOKKKs47EIxIrQ6NMmxtWVrmjSMrl41uq58o1bueBlB/xka65U9Oh03c vouIDjxYs6jdY7FsWhZruLdMzDf5aQhufRKjTCNsBdl+qsfNpQVkoJ2W/ApH+RvCksSQ LOZhlJ+WlFER12y39LFhWo1rsKq3+fduDaB7zMnjBOEWfAAzGlZ9VVW6AjlEWrHcbgOF Qpvg== X-Gm-Message-State: AOJu0YyNv5tmJZRNevtY0M0Fz2ssnDLObCcoM7M4rYDsGw3bHkcWxqur BiK464gbHkK8Pilq2N9s669T+vvFSECgxg== X-Google-Smtp-Source: AGHT+IFJrzn8c7FgB7LmapSUC5NlYs8gbR4Rga+Fyb2yUfQzUzwslLzd19QxR3oDd76w+TGokbudyA== X-Received: by 2002:ac8:5705:0:b0:423:6e2a:1c36 with SMTP id 5-20020ac85705000000b004236e2a1c36mr5514686qtw.35.1701654334407; Sun, 03 Dec 2023 17:45:34 -0800 (PST) Received: from hurd (dsl-141-198.b2b2c.ca. [66.158.141.198]) by smtp.gmail.com with ESMTPSA id l3-20020ac87243000000b00423ea1b31b3sm3818146qtp.66.2023.12.03.17.45.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 03 Dec 2023 17:45:33 -0800 (PST) From: Maxim Cournoyer To: Ludovic =?utf-8?Q?Court=C3=A8s?= Subject: Re: [bug#67175] [PATCH 6/9] services: jami-dbus-session: Use =?utf-8?Q?=E2=80=98least-authority-wrapper=E2=80=99=2E?= In-Reply-To: <05c3a9993783b02b89083b1ae0562a79af4c61b2.1699970930.git.ludo@gnu.org> ("Ludovic =?utf-8?Q?Court=C3=A8s=22's?= message of "Tue, 14 Nov 2023 15:09:15 +0100") References: <05c3a9993783b02b89083b1ae0562a79af4c61b2.1699970930.git.ludo@gnu.org> Date: Sun, 03 Dec 2023 20:45:32 -0500 Message-ID: <87wmtusptv.fsf@gmail.com> User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -0.0 (/) X-Debbugs-Envelope-To: 67175 Cc: 67175@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Hello! Ludovic Court=C3=A8s writes: > * gnu/services/telephony.scm (jami-shepherd-services): Use > =E2=80=98least-authority-wrapper=E2=80=99 for =E2=80=98dbus-daemon=E2=80= =99. Use =E2=80=98fork+exec-command=E2=80=99 > instead of =E2=80=98make-forkexec-constructor/container=E2=80=99 in the = =E2=80=98start=E2=80=99 method=E2=80=99. > Remove reference to (gnu build shepherd). Reviewed-by: Maxim Cournoyer --=20 Thanks, Maxim From debbugs-submit-bounces@debbugs.gnu.org Sun Dec 03 21:14:18 2023 Received: (at 67175) by debbugs.gnu.org; 4 Dec 2023 02:14:18 +0000 Received: from localhost ([127.0.0.1]:33203 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r9yTQ-0001wk-Dw for submit@debbugs.gnu.org; Sun, 03 Dec 2023 21:14:18 -0500 Received: from mail-qk1-x72e.google.com ([2607:f8b0:4864:20::72e]:59894) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1r9yTL-0001wE-Sy for 67175@debbugs.gnu.org; Sun, 03 Dec 2023 21:14:15 -0500 Received: by mail-qk1-x72e.google.com with SMTP id af79cd13be357-77efe9be09fso6509685a.3 for <67175@debbugs.gnu.org>; Sun, 03 Dec 2023 18:14:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1701656036; x=1702260836; darn=debbugs.gnu.org; h=content-transfer-encoding:mime-version:user-agent:message-id:date :references:in-reply-to:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=3wnRB+Hm+HnjWgs9pogSZZmPqeP0J1c1eSgQuRPg4N0=; b=HfyLpr6U4UjLeObMcLEbWeqBqeZmtJ9DRIClzBND01VWh+wMWy+rISVzxQkIiIU1Kw 9DxiairYzwfJqZRGs2XaG4kBkVPWVV1tr2C6yqqmFguGcIyPtdV+aVx5fgAsn9PMx6J9 uBEwL3ncXjBKKFDP/XWRRaVVTm2drAy1HQR8dG5ewGxtQiR3ootQf2fMI6HjkyxGMUQU ZiBQmUUK3bhgceLDSNvUjXRsE6xui4TXIzphiNXnRO+z7eekebBUBj7Fyu1hDjua1EHF NvswtOTJeeq5iEkwiXJw7HBu91o7BmlhZ+hHZir8Eb/jdUfcLPZ7ZXDBk+xZXLHMCDSN WJyg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701656036; x=1702260836; h=content-transfer-encoding:mime-version:user-agent:message-id:date :references:in-reply-to:subject:cc:to:from:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=3wnRB+Hm+HnjWgs9pogSZZmPqeP0J1c1eSgQuRPg4N0=; b=vKzACnkyRWE2fb0jZatitHWJ6IGmtoFkiZ+IO/qlmkc1wufF3TiPrEzyuJ8CkrCn/g P2RaosxzX1VNR+CoI7IdnKb9WpECyFJuUgShU9r+cpBRC3aIdPbBIfiqqabjboTVbZ1V C+WZgCimRAhictOjXqIedntrK009MYzrAC/GLDnuzfqkuTys8x+emW7kJ66xoUDZVmMj R8xg3rn8pOmdXTf22sQBEXwSf2m4UjGiIY8UoVBOMF0G7AC0GIw/p3GuMZ7AuT769lTp Vu0nd2C7+o5LRvdv4JPul1wn8LwUrFrLmJPulBFAj+OvKxf3mS8mquClbNRV/5TLFqGf 1dCg== X-Gm-Message-State: AOJu0YwXhaCB39cSy5iJ0fR6usvupAw/SnGkN0P5mwfol1Ee49hK6K+W 0FRcc3kuXXkD/uP6rYgISuU= X-Google-Smtp-Source: AGHT+IESPPgUy7Dl6Kn/BtspfbicrQs6LReQpaJQm85YAxBEpVqeWTdRzb7FBcFyLBWQHsx/Z3wuig== X-Received: by 2002:ae9:e007:0:b0:77e:fba3:a7a8 with SMTP id m7-20020ae9e007000000b0077efba3a7a8mr1248741qkk.134.1701656036029; Sun, 03 Dec 2023 18:13:56 -0800 (PST) Received: from hurd (dsl-141-198.b2b2c.ca. [66.158.141.198]) by smtp.gmail.com with ESMTPSA id b12-20020a05620a0ccc00b0077dd098d0b6sm3850956qkj.109.2023.12.03.18.13.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 03 Dec 2023 18:13:55 -0800 (PST) From: Maxim Cournoyer To: Ludovic =?utf-8?Q?Court=C3=A8s?= Subject: Re: [bug#67175] [PATCH 4/9] least-authority: Add support for changing UIDs/GIDs before exec. In-Reply-To: <9044b132a3746d6874969615923f5c534ba00152.1699970930.git.ludo@gnu.org> ("Ludovic =?utf-8?Q?Court=C3=A8s=22's?= message of "Tue, 14 Nov 2023 15:09:13 +0100") References: <9044b132a3746d6874969615923f5c534ba00152.1699970930.git.ludo@gnu.org> Date: Sun, 03 Dec 2023 21:13:54 -0500 Message-ID: <87jzpusoil.fsf@gmail.com> User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -0.0 (/) X-Debbugs-Envelope-To: 67175 Cc: Josselin Poiret , Simon Tournier , Mathieu Othacehe , Tobias Geerinckx-Rice , Ricardo Wurmus , 67175@debbugs.gnu.org, Christopher Baines X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Ludovic Court=C3=A8s writes: > * guix/least-authority.scm (least-authority-wrapper): Add #:user > and #:group. > [code]: Add calls to =E2=80=98setgid=E2=80=99 and =E2=80=98setuid=E2=80= =99 when appropriate. > > Change-Id: I2aad8e5686b42b5c92fc306b114c5c60cb8bc551 This should mention it fixes bug #67175 :-). > --- > guix/least-authority.scm | 25 +++++++++++++++++++++++-- > 1 file changed, 23 insertions(+), 2 deletions(-) > > diff --git a/guix/least-authority.scm b/guix/least-authority.scm > index bfd7275e7c..3465fe9a48 100644 > --- a/guix/least-authority.scm > +++ b/guix/least-authority.scm > @@ -1,5 +1,5 @@ > ;;; GNU Guix --- Functional package management for GNU > -;;; Copyright =C2=A9 2022 Ludovic Court=C3=A8s > +;;; Copyright =C2=A9 2022-2023 Ludovic Court=C3=A8s > ;;; > ;;; This file is part of GNU Guix. > ;;; > @@ -41,6 +41,8 @@ (define %precious-variables >=20=20 > (define* (least-authority-wrapper program > #:key (name "pola-wrapper") > + (user #f) > + (group #f) > (guest-uid 1000) > (guest-gid 1000) > (mappings '()) > @@ -55,7 +57,11 @@ (define* (least-authority-wrapper program > records indicating directories mirrored inside the > execution environment of PROGRAM. DIRECTORY is the working directory of= the > wrapped process. Each environment listed in PRESERVED-ENVIRONMENT-VARIA= BLES > -is preserved; other environment variables are erased." > +is preserved; other environment variables are erased. > + > +When USER and GROUP are set and NAMESPACES does not include 'user, chang= e UIDs > +and GIDs to these prior to executing PROGRAM. This usually requires tha= t the > +resulting wrapper be executed as root so it can call setgid(2) and > setuid(2)." About "usually"; in which case could a programm call to setgid and setuid without being root? > (define code > (with-imported-modules (source-module-closure > '((gnu system file-systems) > @@ -113,6 +119,10 @@ (define* (least-authority-wrapper program > #$program signal) > (exit (+ 128 signal)))))) >=20=20 > + (define namespaces '#$namespaces) > + (define host-group '#$group) > + (define host-user '#$user) > + > ;; Note: 'call-with-container' creates a sub-process that this= one > ;; waits for. This might seem suboptimal but unshare(2) isn't > ;; really applicable: the process would still run in the same = PID > @@ -123,6 +133,17 @@ (define* (least-authority-wrapper program > (lambda () > (chdir #$directory) > (environ variables) > + > + (unless (memq 'user namespaces) > + ;; This process lives in its parent user namespace, > + ;; presumably as root; now is the time to setgid/setuid= if > + ;; asked for it (the 'clone' call would fail with EPERM= if we > + ;; changed UIDs/GIDs beforehand). Related to my previous interrogation, should we check if the current user id is 0 (root), and fail otherwise with an informative message? --=20 Thanks, Maxim From debbugs-submit-bounces@debbugs.gnu.org Thu Dec 21 17:13:24 2023 Received: (at 67175) by debbugs.gnu.org; 21 Dec 2023 22:13:24 +0000 Received: from localhost ([127.0.0.1]:45630 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1rGRIC-0004wz-4P for submit@debbugs.gnu.org; Thu, 21 Dec 2023 17:13:24 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:59898) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1rGRIA-0004wn-6v for 67175@debbugs.gnu.org; Thu, 21 Dec 2023 17:13:22 -0500 Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rGRHy-0007rY-E3; Thu, 21 Dec 2023 17:13:11 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:Date:References:In-Reply-To:Subject:To: From; bh=ZKZsFhkcxzZ6K4MjRbGwC68Xj9EUQPEqVgbGtaMBtJ8=; b=Vfn8CdEP1/zEwCaoKEbH x/w3gzwvRLtpU5U/Vod8fd9nQ4X4gkXfbq41M3H1U0865ICUm/64NZQynOMIggBtxb3P+X9yCJqt8 +X8hw0Ob26R/tUOzSbnnK+5FodBsfcWYJc811eov8a66bGC3ZdiJP9OLmWf6Fpvy/AUVE+6sdwLeI mZi5q6/c1O7w9CCDSDwRHU4E2Gwt+VF9utKCbqAM/SXrDiy4BZjw4w0ue1PNwNFjSjGjzuEng5d5G wFKrj+u7ClwErlX3JNerqBcCThxxnCgOfTHb6izohVngEGSxe61ZCpvK2O47RRJa3li3xcp2GqIge LKKi6UKDaAr3pQ==; From: =?utf-8?Q?Ludovic_Court=C3=A8s?= To: Maxim Cournoyer Subject: Re: [bug#67175] [PATCH 4/9] least-authority: Add support for changing UIDs/GIDs before exec. In-Reply-To: <87jzpusoil.fsf@gmail.com> (Maxim Cournoyer's message of "Sun, 03 Dec 2023 21:13:54 -0500") References: <9044b132a3746d6874969615923f5c534ba00152.1699970930.git.ludo@gnu.org> <87jzpusoil.fsf@gmail.com> Date: Thu, 21 Dec 2023 23:13:06 +0100 Message-ID: <87msu3dx1p.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 67175 Cc: Josselin Poiret , Simon Tournier , Mathieu Othacehe , Tobias Geerinckx-Rice , Ricardo Wurmus , 67175@debbugs.gnu.org, Christopher Baines X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Hi! Maxim Cournoyer skribis: > Ludovic Court=C3=A8s writes: > >> * guix/least-authority.scm (least-authority-wrapper): Add #:user >> and #:group. >> [code]: Add calls to =E2=80=98setgid=E2=80=99 and =E2=80=98setuid=E2=80= =99 when appropriate. >> >> Change-Id: I2aad8e5686b42b5c92fc306b114c5c60cb8bc551 > > This should mention it fixes bug #67175 :-). Noted! >> (define* (least-authority-wrapper program >> #:key (name "pola-wrapper") >> + (user #f) >> + (group #f) >> (guest-uid 1000) >> (guest-gid 1000) >> (mappings '()) >> @@ -55,7 +57,11 @@ (define* (least-authority-wrapper program >> records indicating directories mirrored inside the >> execution environment of PROGRAM. DIRECTORY is the working directory o= f the >> wrapped process. Each environment listed in PRESERVED-ENVIRONMENT-VARI= ABLES >> -is preserved; other environment variables are erased." >> +is preserved; other environment variables are erased. >> + >> +When USER and GROUP are set and NAMESPACES does not include 'user, chan= ge UIDs >> +and GIDs to these prior to executing PROGRAM. This usually requires th= at the >> +resulting wrapper be executed as root so it can call setgid(2) and >> setuid(2)." > > About "usually"; in which case could a programm call to setgid and > setuid without being root? On Linux, a non-root process can have =E2=80=98CAP_SETGID=E2=80=99 and/or = =E2=80=98CAP_SETUID=E2=80=99 and successfully call these. So checking whether the UID is zero would not be accurate (tricky semantics). I think it=E2=80=99s safer to let it fail and display the actu= al error. Thanks, Ludo=E2=80=99. From debbugs-submit-bounces@debbugs.gnu.org Thu Dec 21 17:16:53 2023 Received: (at 67175) by debbugs.gnu.org; 21 Dec 2023 22:16:53 +0000 Received: from localhost ([127.0.0.1]:45638 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1rGRLZ-0007ds-0f for submit@debbugs.gnu.org; Thu, 21 Dec 2023 17:16:53 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:44884) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1rGRLX-0007df-0l for 67175@debbugs.gnu.org; Thu, 21 Dec 2023 17:16:51 -0500 Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rGRLN-0000Tp-Hm; Thu, 21 Dec 2023 17:16:41 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:Date:References:In-Reply-To:Subject:To: From; bh=zWteJDpor8P5s9RNe1tTJs3zPMtVFH6B9ZlziaFFD9w=; b=Z3bR2o6lJTuiaTCSUsyP G/XD6MMxCs0//TmTNucaZKPcolUrt7e+ZbqemldcjJeZkRQoKRhMwI/G5V93Hci4EbWA8mVXTuwjH PbTUMBpgO7rCjNUMu/VQyCXGUnUSFMfUe236fxM7XSDqG7wsJCXowUC+724FtXU6oOnFLh8Vnj3ud VZtvn61X4uzA9f1c9k36Ihte6NE7uzvpX/CVX3M7wn9mRTaDt8hUYfLNw5OSFSsfu8s8AV8TYq8ZD L03P8w3/Cmk96ZHQb4XBVx87ra5guW9o5gIX62K6uzdcRIVAGzKV3cHqJQfRvAw/kQAAlWkpA5TMf 1awukcJFvt8ZmA==; From: =?utf-8?Q?Ludovic_Court=C3=A8s?= To: Maxim Cournoyer Subject: Re: [bug#67175] [PATCH 7/9] services: jami: Use =?utf-8?Q?=E2=80=98least-authority-wrapper=E2=80=99=2E?= In-Reply-To: <875y1eu4pm.fsf@gmail.com> (Maxim Cournoyer's message of "Sun, 03 Dec 2023 20:38:45 -0500") References: <875y1eu4pm.fsf@gmail.com> Date: Thu, 21 Dec 2023 23:16:39 +0100 Message-ID: <87h6kbdwvs.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 67175 Cc: 67175@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Hi, Maxim Cournoyer skribis: > Ludovic Court=C3=A8s writes: > >> * gnu/services/telephony.scm (jami-configuration->command-line-arguments) >> [wrapper]: New procedure. > > nitpick: Should be , according to 'info (standards) Indicating > the Part Changed' OK. >> + (define (wrapper libjami) >> + (least-authority-wrapper >> + ;; XXX: 'gexp-input' is needed as the outer layer so that >> + ;; 'references-file' picks the right output of LIBJAMI. > > It seems clearer to me to stick to the current #~(string-append > #$libjami:bin "/libexec/jamid") until file-append can handle non-default > outputs more elegantly (did we have a bug for that? -- I couldn't find > one). We cannot write #~(string-append =E2=80=A6) here because =E2=80=98least-authority-wrapper=E2=80=99 expects a file-like object (becau= se it passes it to =E2=80=98references-file=E2=80=99). > The rest LGTM, if both jami system tests pass. Alright! Ludo=E2=80=99. From debbugs-submit-bounces@debbugs.gnu.org Thu Dec 21 18:42:33 2023 Received: (at 67175-done) by debbugs.gnu.org; 21 Dec 2023 23:42:33 +0000 Received: from localhost ([127.0.0.1]:45707 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1rGSgS-0005up-VU for submit@debbugs.gnu.org; Thu, 21 Dec 2023 18:42:33 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:44788) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1rGSgR-0005uc-Bn for 67175-done@debbugs.gnu.org; Thu, 21 Dec 2023 18:42:31 -0500 Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rGSgH-00061u-Lt; Thu, 21 Dec 2023 18:42:21 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:Date:References:In-Reply-To:Subject:To: From; bh=AplIQmqmOfCuhkWZwgk/hIBiM8XDn3wxZyxnCLS4uG4=; b=QsHl1iTqiyWoV49MXxTX fMw5vk6yLdaed2CgZmrffb7j9n1ZrYKCpj4QEMc6wfz9TNTcpSz/IIRG5dWu+qjh2e7y3EpVdX0O0 s/XwvU3S643wJmj5yZDCfhu7O2Jn248YmArNQ50JKfSKdbojA9ZD+IGSl4ud4KQj/p0SDf992gKQH UpFbOleOvUvmxxc0vhTITBgbqLdDcGjxJGu75igXy/H7R5vg6IG0xDlDkruvQsm2BvvEmxS7RQk/e c+5lV0VhEKWI1M2N0O6f6COYDlYdmvLNP8JJoM2Hzje1PoI/4Y+sKmlJ3h3sGOevMnG0dJZgvhthd XCNB9OrWMBRX5w==; From: =?utf-8?Q?Ludovic_Court=C3=A8s?= To: Maxim Cournoyer Subject: Re: [bug#67175] [PATCH 7/9] services: jami: Use =?utf-8?Q?=E2=80=98least-authority-wrapper=E2=80=99=2E?= In-Reply-To: <875y1eu4pm.fsf@gmail.com> (Maxim Cournoyer's message of "Sun, 03 Dec 2023 20:38:45 -0500") References: <875y1eu4pm.fsf@gmail.com> Date: Fri, 22 Dec 2023 00:42:19 +0100 Message-ID: <8734vvdsx0.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 67175-done Cc: 67175-done@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Pushed as commit ca813173894360edef35a5d98878a3135e99e62a after double-checking with: make check-system TESTS=3D"jami jami-provisioning jami-provisioning-parti= al" I inserted a new commit, 2cc881ac13522566a27d996afd1fb88df363f75e, to increase timeouts in the tests: on my laptop the three tests would occasionally fail when using the initial 20s timeouts (it=E2=80=99s not =E2= =80=9Creally=E2=80=9D 20s as the time measured in the host, not in the guest). Thanks, Ludo=E2=80=99. From unknown Tue Aug 19 10:02:51 2025 Received: (at fakecontrol) by fakecontrolmessage; To: internal_control@debbugs.gnu.org From: Debbugs Internal Request Subject: Internal Control Message-Id: bug archived. Date: Fri, 19 Jan 2024 12:24:08 +0000 User-Agent: Fakemail v42.6.9 # This is a fake control message. # # The action: # bug archived. thanks # This fakemail brought to you by your local debbugs # administrator