amaharaneko/guix-mirrors
1
1
Fork 0
mirror of https://codeberg.org/guix/guix.git synced 2025-10-02 02:15:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

services: Warn about unprivileged privileged-programs.

Browse source 
* gnu/services.scm (privileged-program->activation-gexp): Warn when a
privileged-program appears to lack all possible privilege.

Change-Id: I68ed8cb2cff88b11b090cf99a2cc7d6264b888e0
This commit is contained in:
Tobias Geerinckx-Rice 2024-09-01 02:00:00 +02:00
parent 3578fc58d2
commit 9c88f217be
No known key found for this signature in database
GPG key ID: 0DB0FF884F556D79
1 changed files with 20 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

13
gnu/services.scm
View file

@ -893,17 +893,20 @@ FILES must be a list of name/file-like object pairs."
(define (privileged-program->activation-gexp programs) (define (privileged-program->activation-gexp programs)
"Return an activation gexp for privileged-program from PROGRAMS." "Return an activation gexp for privileged-program from PROGRAMS."
(let ((programs (map (lambda (program) (let ((programs
;; FIXME This is really ugly, I didn't managed to use (map (lambda (program)
;; "inherit" ;; FIXME This is really ugly, I didn't manage to use "inherit".
(let ((program-name (privileged-program-program program)) (let ((program-name (privileged-program-program program))
(setuid? (privileged-program-setuid? program)) (setuid? (privileged-program-setuid? program))
(setgid? (privileged-program-setgid? program)) (setgid? (privileged-program-setgid? program))
(user (privileged-program-user program)) (user (privileged-program-user program))
(group (privileged-program-group program)) (group (privileged-program-group program))
(capabilities (privileged-program-capabilities program))) (capabilities (privileged-program-capabilities program)))
#~(privileged-program (unless (or setuid? setgid? capabilities)
(setuid? #$setuid?) (warning
(G_ "so-called privileged-program ~s lacks any privilege~%")
program-name))
#~(privileged-program (setuid? #$setuid?)
(setgid? #$setgid?) (setgid? #$setgid?)
(user #$user) (user #$user)
(group #$group) (group #$group)