From debbugs-submit-bounces@debbugs.gnu.org Sun Feb 06 00:17:13 2022 Received: (at 53468) by debbugs.gnu.org; 6 Feb 2022 05:17:13 +0000 Received: from localhost ([127.0.0.1]:36181 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nGZvE-0002Ag-IA for submit@debbugs.gnu.org; Sun, 06 Feb 2022 00:17:12 -0500 Received: from mail-lf1-f52.google.com ([209.85.167.52]:39516) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nGZv7-0002A3-RV for 53468@debbugs.gnu.org; Sun, 06 Feb 2022 00:17:11 -0500 Received: by mail-lf1-f52.google.com with SMTP id b9so20630604lfq.6 for <53468@debbugs.gnu.org>; Sat, 05 Feb 2022 21:17:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trop-in.20210112.gappssmtp.com; s=20210112; h=from:to:cc:subject:in-reply-to:references:date:message-id :mime-version; bh=ulcpM5K5F1c2MEQvcHRaYh3z3LPHnI+ph/OxoPEJVRQ=; b=Z6ir9VFt7MBMut261Jq/1b047OFuzgKmUFpDnMqulSujgqvQ14PNuHQSOf2ycUvjG4 TIQ+x8O0Goq9ZHlvcvWbCdevHbF2h+yHViUmmtZMAKeDyTl0vVJbFv3rjxFMpRI0NQ5X 1heWyOLagV2TazpjFt4vliBPpLuRjUxifq/a1tJzFLSsNzzjq5td/jKiuxT52QPzY6td u8YDXqPyyzB7Z+jcUb6w7pDB7xHjJ8IMGJn2BVkdmYxolqHOX71Mx0WobDa2OPe3H/b7 /qA+joVIvFs43o33V8c/pLx8/TkEsrMtxF6GseN+DZIw5xvCqzNXWvdIEqSx2MslCtGI quEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:in-reply-to:references:date :message-id:mime-version; bh=ulcpM5K5F1c2MEQvcHRaYh3z3LPHnI+ph/OxoPEJVRQ=; b=pdSSvDg37N9NReKoOdeS62pj3NJfDlMYKTM+IpWgUSe+Aer3V750WMoI+hGlZKrCBL e/vU4ilX25rib+huC/kiVsKhClG001HFSpBzYRTb1chPTCBEbQgaKcgOn9w2JRMFMDmW /q2nrSxidKFpP2+FkHi3Br/pAyTTOdTlKBCJYhd9ZdH/XMk1xq3iSKYSMB26I80oqHie aeM6hj0keaQfTEhP8wBI8hc3yLMQuMBHQTODo0rUOlHj3OSj8iuay35ChvqjopXHdXYg gO7tIgQaJiAHZ5GydKqOspiEyF3gaEwV/S3vxxn0YGya56f3eYjPHViun6ATv6o7vMhA Tupw== X-Gm-Message-State: AOAM531qNDeNFXA6sdo1hasBNUnFLtBxDCbS8kD7cxaGFFIaU4MayhHc rv1s0kEN70aZWrGBF53KrHjlbw== X-Google-Smtp-Source: ABdhPJxmNORqvlBx9BjAXw2nc6oBv6T/yRYdg7nzXNAolxpeQnw/arJAdOMkQUcunmrOPLwQCD7+GA== X-Received: by 2002:ac2:5190:: with SMTP id u16mr4448829lfi.257.1644124619804; Sat, 05 Feb 2022 21:16:59 -0800 (PST) Received: from localhost (109-252-135-33.dynamic.spd-mgts.ru. [109.252.135.33]) by smtp.gmail.com with ESMTPSA id e24sm1029162ljj.131.2022.02.05.21.16.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 05 Feb 2022 21:16:57 -0800 (PST) From: Andrew Tropin To: Ludovic =?utf-8?Q?Court=C3=A8s?= Subject: Re: bug#53468: [RFC PATCH] gnu: linux-pam: Change path to unix_chkpwd helper. In-Reply-To: <877daamgf2.fsf_-_@gnu.org> References: <87tudu38yz.fsf@trop.in> <87sftetuhg.fsf@trop.in> <877daamgf2.fsf_-_@gnu.org> Date: Sun, 06 Feb 2022 08:16:54 +0300 Message-ID: <878ruo60c9.fsf@trop.in> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="==-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-Spam-Score: -0.0 (/) X-Debbugs-Envelope-To: 53468 Cc: 53468@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) --==-=-= Content-Type: multipart/mixed; boundary="=-=-=" --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 2022-02-04 23:10, Ludovic Court=C3=A8s wrote: > Hi! > > Andrew Tropin skribis: > >> From ad876e5b134072601fa97d82a39b320a269f34a5 Mon Sep 17 00:00:00 2001 >> From: Andrew Tropin >> Date: Thu, 13 Jan 2022 21:41:58 +0300 >> Subject: [RFC PATCH v2] gnu: linux-pam: Change path to unix_chkpwd helpe= r. >> >> * gnu/packages/patches/change-path-to-unix_chkpwd.patch: New file >> * gnu/packages/linux.scm (linux-pam): Add patch. >> * gnu/system/pam.scm (pam-root-service-type): Add unix_chkpwd to setuid >> binaries. > > [...] > >> + DIAG_PUSH_IGNORE_CAST_QUAL; >> +- execve(CHKPWD_HELPER, (char *const *) args, envp); >> ++ execve("/run/setuid-programs/unix_chkpwd", (char *const *) args, e= nvp); >> + DIAG_POP_IGNORE_CAST_QUAL; > > Looks reasonable to me. However, could you change the CHKPWD_HELPER > macro definition in the Makefile template, as you suggested, instead of > patching the file? Sure, done in v3. --=-=-= Content-Type: text/x-patch Content-Disposition: inline; filename=v3-0001-gnu-linux-pam-Change-path-to-unix_chkpwd-helper.patch Content-Transfer-Encoding: quoted-printable From=20e96d3f6d82b134829fcb31777e81928c73847dcc Mon Sep 17 00:00:00 2001 From: Andrew Tropin Date: Sun, 6 Feb 2022 08:13:49 +0300 Subject: [PATCH v3] gnu: linux-pam: Change path to unix_chkpwd helper. * gnu/packages/patches/change-path-to-unix_chkpwd.patch: New file. * gnu/packages/linux.scm (linux-pam): Add patch. * gnu/system/pam.scm (pam-root-service-type): Add unix_chkpwd to setuid. =2D-- gnu/packages/linux.scm | 3 ++- .../patches/change-path-to-unix_chkpwd.patch | 13 +++++++++++++ gnu/system/pam.scm | 10 ++++++++-- 3 files changed, 23 insertions(+), 3 deletions(-) create mode 100644 gnu/packages/patches/change-path-to-unix_chkpwd.patch diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm index 2e2d01c656..bc2927d0b4 100644 =2D-- a/gnu/packages/linux.scm +++ b/gnu/packages/linux.scm @@ -1625,7 +1625,8 @@ (define-public linux-pam (sha256 (base32 "1z4jayf69qyyxln1gl6ch4qxfd66ib1g42garnrv2d8i1drl0790")) =2D (patches (search-patches "linux-pam-no-setfsuid.patch")))) + (patches (search-patches "change-path-to-unix_chkpwd.patch" + "linux-pam-no-setfsuid.patch")))) =20 (build-system gnu-build-system) (native-inputs diff --git a/gnu/packages/patches/change-path-to-unix_chkpwd.patch b/gnu/pa= ckages/patches/change-path-to-unix_chkpwd.patch new file mode 100644 index 0000000000..e5c6d2649c =2D-- /dev/null +++ b/gnu/packages/patches/change-path-to-unix_chkpwd.patch @@ -0,0 +1,13 @@ +From: Andrew Tropin +Date: Sat, 5 Feb 2022 21:06:42 +0300 +Subject: [PATCH] Change path to unix_chkpwd. + +unix_chkpwd is designed to have a suid bit, but it's not possible to set it +for files in /gnu/store, and this patch tells unix_pam.so to lookup up for +unix_chkpwd in directory generated by setuid-program system service. + +--- a/modules/pam_unix/Makefile.in ++++ b/modules/pam_unix/Makefile.in +@@ -651,1 +651,1 @@ +- -DCHKPWD_HELPER=3D\"$(sbindir)/unix_chkpwd\" \ ++ -DCHKPWD_HELPER=3D\"/run/setuid-programs/unix_chkpwd\" \ diff --git a/gnu/system/pam.scm b/gnu/system/pam.scm index 2574e019f1..b635681642 100644 =2D-- a/gnu/system/pam.scm +++ b/gnu/system/pam.scm @@ -21,6 +21,7 @@ (define-module (gnu system pam) #:use-module (guix derivations) #:use-module (guix gexp) #:use-module (gnu services) + #:use-module (gnu system setuid) #:use-module (ice-9 match) #:use-module (srfi srfi-1) #:use-module (srfi srfi-9) @@ -375,8 +376,13 @@ (define (extend-configuration initial extensions) =20 (define pam-root-service-type (service-type (name 'pam) =2D (extensions (list (service-extension etc-service-type =2D /etc-entry))) + (extensions + (list (service-extension + setuid-program-service-type + (lambda (_) + (list (file-like->setuid-program + (file-append linux-pam "/sbin/unix_chkpwd= "))))) + (service-extension etc-service-type /etc-entry))) =20 ;; Arguments include as well as procedures. (compose concatenate) =2D-=20 2.34.0 --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable =2D-=20 Best regards, Andrew Tropin --=-=-=-- --==-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQJDBAEBCgAtFiEEKEGaxlA4dEDH6S/6IgjSCVjB3rAFAmH/WccPHGFuZHJld0B0 cm9wLmluAAoJECII0glYwd6wRmwQAIfjH18DlBQfHarDxPLXNBBAnRBB6D/HV2v0 0DZ7pZi6kI6EwHSCm3fIXooEzFdBVQWWw77nLu6VSgdY00lFYIr31xUtqX/vfI/b YnpDPZ3MYBeW2Y1GOo0Zjqdco1J3u7oJdBlpt7U92Zh3KV6jBwQg7i5u8407PMYj R810YoKU7mO8Cgf8oSSkK4JuN+3btyrXQ947cOSYPhY0gqAf9CPi3hKPTnjbUi83 tGH4UsI8E+bJpZUfhutbsK++faviByjFphz1XgHrzXttBmNp591LvUghVIIt5du4 tyVuWLRA99dQu+8PX1DJMGqFOG/fS2jJrpj5UiYKGNVleAnjV8K7DkjPadMxh4II cHBDAaFnN7kR+SoJXct7c4wbScibzRqclTCuRe2EXMy3MNOxSSoXQHtnuhbyqUkf spJSraVEdUF6VfxmeR9SeY4gJpKcd2WsJz3qe0NXE6lFmuZoxpzRLAhl2TcmVZaq 7/iCr+cMSc5Am7mgH6Q0q/PSEkvbfWuryKpCxH0+Tc/yJBibAuyhc/ClM6aWYVdJ 6DqNSMLKpywyeCAFF85DLkcdtEYhGjMXGt3J4yCmi0eDm4HdXj64/ZlTX7X8z5D0 a6wpc3JfT3bHJ81VbbuIEpekDUUZsaJIaLYvymZW+cLKeItGp+KLta29OovPoykI ewmScXMb =O9fk -----END PGP SIGNATURE----- --==-=-=--