From debbugs-submit-bounces@debbugs.gnu.org Thu Jul 29 12:16:39 2021 Received: (at 44700) by debbugs.gnu.org; 29 Jul 2021 16:16:39 +0000 Received: from localhost ([127.0.0.1]:58106 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1m98hy-00025T-T8 for submit@debbugs.gnu.org; Thu, 29 Jul 2021 12:16:39 -0400 Received: from dustycloud.org ([50.116.34.160]:57448) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1m98hs-00025C-Uc for 44700@debbugs.gnu.org; Thu, 29 Jul 2021 12:16:29 -0400 Received: from twig (localhost [127.0.0.1]) by dustycloud.org (Postfix) with ESMTPS id 6CA752673B; Thu, 29 Jul 2021 12:16:24 -0400 (EDT) References: <87v95oeq58.fsf@dustycloud.org> <20210706200320.27113-3-brice@waegenei.re> <87sg0qc98z.fsf@dustycloud.org> <87mtq5ksxz.fsf@dustycloud.org> User-agent: mu4e 1.4.15; emacs 27.2 From: Christine Lemmer-Webber To: Brice Waegeneire Subject: Re: [PATCH v3 2/2] services: Migrate to . In-reply-to: <87mtq5ksxz.fsf@dustycloud.org> Date: Thu, 29 Jul 2021 12:16:24 -0400 Message-ID: <87k0l9ksdj.fsf@dustycloud.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -0.0 (/) X-Debbugs-Envelope-To: 44700 Cc: 44700@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Got the all clear to push to master. Rebased and pushed! :) Christine Lemmer-Webber writes: > I rebased the patches and created the branch origin/wip-setuid. > (I also updated my name... again. Should be the final update.) > > Looks like the tests all pass. I don't want to let this bitrot again. > Does anyone have an objection to me pushing this to master? > > If nobody objects I'm gonna do it! > > > Chris Lemmer-Webber writes: > >> Looks good to me. I'd say push it... let's not let this bitrot again! >> >> Brice Waegeneire writes: >> >>> * gnu/services/dbus.scm (dbus-setuid-programs, polkit-setuid-programs): >>> Return setuid-programs. >>> * gnu/services/desktop.scm (enlightenment-setuid-programs): Return >>> setuid-programs. >>> (%desktop-services)[mount-setuid-helpers]: Use setuid-programs. >>> * gnu/services/docker.scm (singularity-setuid-programs): Return >>> setuid-programs. >>> * gnu/services/xorg.scm(screen-locker-setuid-programs): Return >>> setuid-programs. >>> * gnu/system.scm (%setuid-programs): Return setuid-programs. >>> * doc/guix.texi (Setuid Programs, operating-system Reference): Replace >>> 'list of G-expressions' with 'list of '. >>> --- >>> doc/guix.texi | 19 +++++++++++-------- >>> gnu/services/dbus.scm | 13 +++++++++---- >>> gnu/services/desktop.scm | 26 ++++++++++++++++---------- >>> gnu/services/docker.scm | 9 ++++++--- >>> gnu/services/xorg.scm | 4 +++- >>> gnu/system.scm | 31 ++++++++++++++++--------------- >>> 6 files changed, 61 insertions(+), 41 deletions(-) >>> >>> diff --git a/doc/guix.texi b/doc/guix.texi >>> index f7a72b9885..7919332521 100644 >>> --- a/doc/guix.texi >>> +++ b/doc/guix.texi >>> @@ -13860,8 +13860,8 @@ Linux @dfn{pluggable authentication module} (PA= M) services. >>> @c FIXME: Add xref to PAM services section. >>>=20=20 >>> @item @code{setuid-programs} (default: @code{%setuid-programs}) >>> -List of string-valued G-expressions denoting setuid programs. >>> -@xref{Setuid Programs}. >>> +List of @code{}. @xref{Setuid Programs}, for more >>> +information. >>>=20=20 >>> @item @code{sudoers-file} (default: @code{%sudoers-specification}) >>> @cindex sudoers file >>> @@ -32421,13 +32421,15 @@ the store, we let the system administrator @e= mph{declare} which programs >>> should be setuid root. >>>=20=20 >>> The @code{setuid-programs} field of an @code{operating-system} >>> -declaration contains a list of G-expressions denoting the names of >>> -programs to be setuid-root (@pxref{Using the Configuration System}). >>> -For instance, the @command{passwd} program, which is part of the Shadow >>> -package, can be designated by this G-expression (@pxref{G-Expressions}= ): >>> +declaration contains a list of @code{} denoting the >>> +names of programs to have a setuid or setgid bit set (@pxref{Using the >>> +Configuration System}). For instance, the @command{passwd} program, >>> +which is part of the Shadow package, with a setuid root can be >>> +designated like this: >>>=20=20 >>> @example >>> -#~(string-append #$shadow "/bin/passwd") >>> +(setuid-program >>> + (program (file-append #$shadow "/bin/passwd"))) >>> @end example >>>=20=20 >>> @deftp {Data Type} setuid-program >>> @@ -32458,7 +32460,8 @@ A default set of setuid programs is defined by = the >>> @code{%setuid-programs} variable of the @code{(gnu system)} module. >>>=20=20 >>> @defvr {Scheme Variable} %setuid-programs >>> -A list of G-expressions denoting common programs that are setuid-root. >>> +A list of @code{} denoting common programs that are >>> +setuid-root. >>>=20=20 >>> The list includes commands such as @command{passwd}, @command{ping}, >>> @command{su}, and @command{sudo}. >>> diff --git a/gnu/services/dbus.scm b/gnu/services/dbus.scm >>> index af1a1e4c3a..e7b3dac166 100644 >>> --- a/gnu/services/dbus.scm >>> +++ b/gnu/services/dbus.scm >>> @@ -2,6 +2,7 @@ >>> ;;; Copyright =C2=A9 2013, 2014, 2015, 2016, 2017, 2019, 2020 Ludovic = Court=C3=A8s >>> ;;; Copyright =C2=A9 2015 Sou Bunnbu >>> ;;; Copyright =C2=A9 2021 Maxime Devos >>> +;;; Copyright =C2=A9 2021 Brice Waegeneire >>> ;;; >>> ;;; This file is part of GNU Guix. >>> ;;; >>> @@ -21,6 +22,7 @@ >>> (define-module (gnu services dbus) >>> #:use-module (gnu services) >>> #:use-module (gnu services shepherd) >>> + #:use-module (gnu system setuid) >>> #:use-module (gnu system shadow) >>> #:use-module (gnu system pam) >>> #:use-module ((gnu packages glib) #:select (dbus)) >>> @@ -156,10 +158,12 @@ includes the @code{etc/dbus-1/system.d} directori= es of each package listed in >>> (shell (file-append shadow "/sbin/nologin"))))) >>>=20=20 >>> (define dbus-setuid-programs >>> - ;; Return the file name of the setuid program that we need. >>> + ;; Return a list of for the program that we need. >>> (match-lambda >>> (($ dbus services) >>> - (list (file-append dbus "/libexec/dbus-daemon-launch-helper"))))) >>> + (list (setuid-program >>> + (program (file-append >>> + dbus "/libexec/dbus-daemon-launch-helper"))))))) >>>=20=20 >>> (define (dbus-activation config) >>> "Return an activation gexp for D-Bus using @var{config}." >>> @@ -335,8 +339,9 @@ tuples, are all set as environment variables when t= he bus daemon launches it." >>> (define polkit-setuid-programs >>> (match-lambda >>> (($ polkit) >>> - (list (file-append polkit "/lib/polkit-1/polkit-agent-helper-1") >>> - (file-append polkit "/bin/pkexec"))))) >>> + (map file-like->setuid-program >>> + (list (file-append polkit "/lib/polkit-1/polkit-agent-helper= -1") >>> + (file-append polkit "/bin/pkexec")))))) >>>=20=20 >>> (define polkit-service-type >>> (service-type (name 'polkit) >>> diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm >>> index cd800fcc2b..64d0e85301 100644 >>> --- a/gnu/services/desktop.scm >>> +++ b/gnu/services/desktop.scm >>> @@ -12,6 +12,7 @@ >>> ;;; Copyright =C2=A9 2019 David Wilson >>> ;;; Copyright =C2=A9 2020 Tobias Geerinckx-Rice >>> ;;; Copyright =C2=A9 2020 Reza Alizadeh Majd >>> +;;; Copyright =C2=A9 2021 Brice Waegeneire >>> ;;; >>> ;;; This file is part of GNU Guix. >>> ;;; >>> @@ -40,6 +41,7 @@ >>> #:use-module ((gnu system file-systems) >>> #:select (%elogind-file-systems file-system)) >>> #:use-module (gnu system) >>> + #:use-module (gnu system setuid) >>> #:use-module (gnu system shadow) >>> #:use-module (gnu system pam) >>> #:use-module (gnu packages glib) >>> @@ -1034,14 +1036,15 @@ rules." >>>=20=20 >>> (define (enlightenment-setuid-programs enlightenment-desktop-configura= tion) >>> (match-record enlightenment-desktop-configuration >>> - >>> - (enlightenment) >>> - (list (file-append enlightenment >>> - "/lib/enlightenment/utils/enlightenment_sys") >>> - (file-append enlightenment >>> - "/lib/enlightenment/utils/enlightenment_system") >>> - (file-append enlightenment >>> - "/lib/enlightenment/utils/enlightenment_ckpassw= d")))) >>> + >>> + (enlightenment) >>> + (map file-like->setuid-program >>> + (list (file-append enlightenment >>> + "/lib/enlightenment/utils/enlightenment_sy= s") >>> + (file-append enlightenment >>> + "/lib/enlightenment/utils/enlightenment_sy= stem") >>> + (file-append enlightenment >>> + "/lib/enlightenment/utils/enlightenment_ck= passwd"))))) >>>=20=20 >>> (define enlightenment-desktop-service-type >>> (service-type >>> @@ -1204,8 +1207,11 @@ or setting its password with passwd."))) >>> ;; Allow desktop users to also mount NTFS and NFS file systems >>> ;; without root. >>> (simple-service 'mount-setuid-helpers setuid-program-service-= type >>> - (list (file-append nfs-utils "/sbin/mount.nfs= ") >>> - (file-append ntfs-3g "/sbin/mount.ntfs-= 3g"))) >>> + (map (lambda (program) >>> + (setuid-program >>> + (program program))) >>> + (list (file-append nfs-utils "/sbin/moun= t.nfs") >>> + (file-append ntfs-3g "/sbin/mount.ntfs-= 3g")))) >>>=20=20 >>> ;; The global fontconfig cache directory can sometimes contain >>> ;; stale entries, possibly referencing fonts that have been G= C'd, >>> diff --git a/gnu/services/docker.scm b/gnu/services/docker.scm >>> index be85316180..ef551480aa 100644 >>> --- a/gnu/services/docker.scm >>> +++ b/gnu/services/docker.scm >>> @@ -4,6 +4,7 @@ >>> ;;; Copyright =C2=A9 2020, 2021 Maxim Cournoyer >>> ;;; Copyright =C2=A9 2020 Efraim Flashner >>> ;;; Copyright =C2=A9 2020 Jesse Dowell >>> +;;; Copyright =C2=A9 2021 Brice Waegeneire >>> ;;; >>> ;;; This file is part of GNU Guix. >>> ;;; >>> @@ -26,6 +27,7 @@ >>> #:use-module (gnu services base) >>> #:use-module (gnu services dbus) >>> #:use-module (gnu services shepherd) >>> + #:use-module (gnu system setuid) >>> #:use-module (gnu system shadow) >>> #:use-module (gnu packages docker) >>> #:use-module (gnu packages linux) ;singularity >>> @@ -195,9 +197,10 @@ bundles in Docker containers.") >>> "-helper"))) >>> '("action" "mount" "start"))))) >>>=20=20 >>> - (list (file-append helpers "/singularity-action-helper") >>> - (file-append helpers "/singularity-mount-helper") >>> - (file-append helpers "/singularity-start-helper"))) >>> + (map file-like->setuid-program >>> + (list (file-append helpers "/singularity-action-helper") >>> + (file-append helpers "/singularity-mount-helper") >>> + (file-append helpers "/singularity-start-helper")))) >>>=20=20 >>> (define singularity-service-type >>> (service-type (name 'singularity) >>> diff --git a/gnu/services/xorg.scm b/gnu/services/xorg.scm >>> index 8ffea3b9dd..d95f8beb7a 100644 >>> --- a/gnu/services/xorg.scm >>> +++ b/gnu/services/xorg.scm >>> @@ -8,6 +8,7 @@ >>> ;;; Copyright =C2=A9 2020 shtwzrd >>> ;;; Copyright =C2=A9 2020 Jakub K=C4=85dzio=C5=82ka >>> ;;; Copyright =C2=A9 2020 Alex Griffin >>> +;;; Copyright =C2=A9 2021 Brice Waegeneire >>> ;;; >>> ;;; This file is part of GNU Guix. >>> ;;; >>> @@ -29,6 +30,7 @@ >>> #:use-module (gnu services) >>> #:use-module (gnu services shepherd) >>> #:use-module (gnu system pam) >>> + #:use-module (gnu system setuid) >>> #:use-module (gnu system keyboard) >>> #:use-module (gnu services base) >>> #:use-module (gnu services dbus) >>> @@ -681,7 +683,7 @@ reboot_cmd " shepherd "/sbin/reboot\n" >>> #:allow-empty-passwords? empty?))))) >>>=20=20 >>> (define screen-locker-setuid-programs >>> - (compose list screen-locker-program)) >>> + (compose list file-like->setuid-program screen-locker-program)) >>>=20=20 >>> (define screen-locker-service-type >>> (service-type (name 'screen-locker) >>> diff --git a/gnu/system.scm b/gnu/system.scm >>> index 385c36a484..681dd33630 100644 >>> --- a/gnu/system.scm >>> +++ b/gnu/system.scm >>> @@ -1105,22 +1105,23 @@ use 'plain-file' instead~%") >>> (define %setuid-programs >>> ;; Default set of setuid-root programs. >>> (let ((shadow (@ (gnu packages admin) shadow))) >>> - (list (file-append shadow "/bin/passwd") >>> - (file-append shadow "/bin/sg") >>> - (file-append shadow "/bin/su") >>> - (file-append shadow "/bin/newgrp") >>> - (file-append shadow "/bin/newuidmap") >>> - (file-append shadow "/bin/newgidmap") >>> - (file-append inetutils "/bin/ping") >>> - (file-append inetutils "/bin/ping6") >>> - (file-append sudo "/bin/sudo") >>> - (file-append sudo "/bin/sudoedit") >>> - (file-append fuse "/bin/fusermount") >>> + (map file-like->setuid-program >>> + (list (file-append shadow "/bin/passwd") >>> + (file-append shadow "/bin/sg") >>> + (file-append shadow "/bin/su") >>> + (file-append shadow "/bin/newgrp") >>> + (file-append shadow "/bin/newuidmap") >>> + (file-append shadow "/bin/newgidmap") >>> + (file-append inetutils "/bin/ping") >>> + (file-append inetutils "/bin/ping6") >>> + (file-append sudo "/bin/sudo") >>> + (file-append sudo "/bin/sudoedit") >>> + (file-append fuse "/bin/fusermount") >>>=20=20 >>> - ;; To allow mounts with the "user" option, "mount" and "umou= nt" must >>> - ;; be setuid-root. >>> - (file-append util-linux "/bin/mount") >>> - (file-append util-linux "/bin/umount")))) >>> + ;; To allow mounts with the "user" option, "mount" and = "umount" must >>> + ;; be setuid-root. >>> + (file-append util-linux "/bin/mount") >>> + (file-append util-linux "/bin/umount"))))) >>>=20=20 >>> (define %sudoers-specification >>> ;; Default /etc/sudoers contents: 'root' and all members of the 'whe= el'