GNU logs - #60890, boring messages

Message sent to bug-guix@HIDDEN:

Subject: bug#60890: least-authority-wrapper and make-forkexec-constructor composition problem
Resent-From: Maxim Cournoyer <maxim.cournoyer@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Tue, 17 Jan 2023 19:31:01 +0000
Resent-Message-ID: <handler.60890.B.16739838126522 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 60890 <at> debbugs.gnu.org
From: Maxim Cournoyer <maxim.cournoyer@HIDDEN>
Date: Tue, 17 Jan 2023 14:30:03 -0500
Message-ID: <87zgahyn5w.fsf@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Received-SPF: pass client-ip=2607:f8b0:4864:20::832;
 envelope-from=maxim.cournoyer@HIDDEN; helo=mail-qt1-x832.google.com
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001,
 RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,
 SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: -1.3 (-)
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -2.3 (--)

Hi,

I'm creating a bug to keep track of a problem that was uncovered when
attempting to migrate the jami-service-type service to use the
least-authority-wrapper [0], to avoid forgetting about it.

It was found that using something like:

--8<---------------cut here---------------start------------->8---
(make-forkexec-constructor
  (least-authority
    (list (file-append coreutils "/bin/true"))
    (mappings (delq 'user %namespaces))
  #:user  "nobody"
  #:group "nobody"))
--8<---------------cut here---------------end--------------->8---

Would fail with EPERM, because in order to be able to drop the user
namespace, the CAP_SYS_ADMIN capability is required, but in the above
case, make-forkexec-constructor has already changed the user to
"nobody", which lacks such capability.

The solution proposed by Ludovic in would be to [1]:

> [...] add #:user and #:group to =E2=80=98least-authority-wrapper=E2=80=99=
 and
> have it call setuid/setgid.  =E2=80=98make-forkexec-constructor=E2=80=99 =
doesn=E2=80=99t need to
> be modified, but the user simply won=E2=80=99t pass #:user and #:group to=
 it.

[0]  https://issues.guix.gnu.org/54786#16
[1]  https://issues.guix.gnu.org/54786#17

--=20
Thanks,
Maxim

Message sent:

Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.505 (Entity 5.505)
Content-Type: text/plain; charset=utf-8
X-Loop: help-debbugs@HIDDEN
From: help-debbugs@HIDDEN (GNU bug Tracking System)
To: Maxim Cournoyer <maxim.cournoyer@HIDDEN>
Subject: bug#60890: Acknowledgement (least-authority-wrapper and
 make-forkexec-constructor composition problem)
Message-ID: <handler.60890.B.16739838126522.ack <at> debbugs.gnu.org>
References: <87zgahyn5w.fsf@HIDDEN>
X-Gnu-PR-Message: ack 60890
X-Gnu-PR-Package: guix
Reply-To: 60890 <at> debbugs.gnu.org
Date: Tue, 17 Jan 2023 19:31:01 +0000

Thank you for filing a new bug report with debbugs.gnu.org.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 bug-guix@HIDDEN

If you wish to submit further information on this problem, please
send it to 60890 <at> debbugs.gnu.org.

Please do not send mail to help-debbugs@HIDDEN unless you wish
to report a problem with the Bug-tracking system.

--=20
60890: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D60890
GNU Bug Tracking System
Contact help-debbugs@HIDDEN with problems

Last modified: Tue, 17 Jan 2023 19:45:01 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.