GNU logs - #62725, boring messages

Message sent to bug-guix@HIDDEN:

Subject: bug#62725: Undefined activation ordering between =?UTF-8?Q?=E2=80=98setuid-program-service-type=E2=80=99?= and =?UTF-8?Q?=E2=80=98account-service-type=E2=80=99?=
Resent-From: Brian Cully <bjc@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Sat, 08 Apr 2023 15:05:02 +0000
Resent-Message-ID: <handler.62725.B.168096626724608 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 62725 <at> debbugs.gnu.org
User-agent: mu4e 1.10.0; emacs 28.2
From: Brian Cully <bjc@HIDDEN>
Date: Sat, 08 Apr 2023 10:53:07 -0400
Message-ID: <878rf24dqz.fsf@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: quoted-printable
Received-SPF: pass client-ip=166.84.7.167; envelope-from=bjc@HIDDEN;
 helo=mail.spork.org
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001,
 SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: -1.3 (-)
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -2.3 (--)


There is currently no way to ensure that an account exists before=20
creating /run/setuid-programs, which means a setuid-program which=20
uses a custom user or group will fail to be created if setuid=20
activation happens before account activation.

As an example, here's a system config where I'm trying to install=20
=E2=80=98/run/setuid-programs/dumpcap=E2=80=99 as setuid root with a primar=
y group=20
of =E2=80=98wireshark=E2=80=99, also created by this config:

--8<---------------cut here---------------start------------->8---
(use-modules (gnu)
             (gnu system setuid))
(use-package-modules networking)
(use-service-modules setuid)

;; TODO: make name configurable
(define %wireshark-groups
  (list (user-group
         (name "wireshark")
         (system? #t))))

(define %wireshark-setuid-programs
  (list (setuid-program
         (program (file-append wireshark "/bin/dumpcap"))
         (group "wireshark")
         #;(mask #o550))))

(define wireshark-service-type
  (service-type
   (name 'wireshark)
   (description "Allow use of wireshark by regular users in the=20
   @code{wireshark} group.")
   (extensions
    (list (service-extension account-service-type
                             (const %wireshark-groups))
          (service-extension setuid-program-service-type
                             (const %wireshark-setuid-programs))))
   (default-value #f)))

(operating-system
  (locale "en_US.utf8")
  (timezone "America/New_York")
  (keyboard-layout (keyboard-layout "us"))
  (host-name "wireshark-test")

  (users (cons* (user-account
                 (name "test")
                 (group "users")
                 (password (crypt "test" "$6$test"))
                 (supplementary-groups
                  '("wireshark")))
                %base-user-accounts))
  (packages
   (cons*
    (specification->package "wireshark")
    %base-packages))

  (services
   (cons*
    (service wireshark-service-type)
    %base-services))

  (bootloader
   (bootloader-configuration
    (bootloader grub-efi-bootloader)
    (targets '("/boot/efi"))
    (keyboard-layout keyboard-layout)))

  (file-systems
   (cons* (file-system
            (mount-point "/")
            (device
             (uuid "14f4e958-be9e-41bb-bd25-e90a7330093c"
                   'btrfs))
            (type "btrfs"))
          (file-system
            (mount-point "/boot/efi")
            (device (uuid "6866-56B1" 'fat32))
            (type "vfat"))
          %base-file-systems)))
--8<---------------cut here---------------end--------------->8---

When trying to boot this system in a VM, I'm told that the dumpcap=20
binary couldn't be created because the file wasn't found. The=20
returned error is improperly attributed: the source file does=20
exist, and the error code is actually coming from getgrent(3)=20
which cannot find the =E2=80=98wireshark=E2=80=99 group.

Tracing through the activation scripts shows this to be because,=20
in this case, setuid-program activation happens before=20
account-activation.

Thanks to jpoiret for doing a lot of the investigative work here,=20
which I'm merely verifying through testing.

I believe the correct solution here is to move =E2=80=98setuid-program=E2=
=80=99=20
activation to a one-shot Shepherd service, because Shepherd allows=20
explicit ordering, as well as other advantages. To that end, I=20
have a patch which does precisely that, which I will send to the=20
patches list shorty.

-bjc

Message sent:

Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.505 (Entity 5.505)
Content-Type: text/plain; charset=utf-8
X-Loop: help-debbugs@HIDDEN
From: help-debbugs@HIDDEN (GNU bug Tracking System)
To: Brian Cully <bjc@HIDDEN>
Subject: bug#62725: Acknowledgement (Undefined activation ordering between
 =?UTF-8?Q?=E2=80=98setuid-program-service-type=E2=80=99?= and
 =?UTF-8?Q?=E2=80=98account-service-type=E2=80=99?=)
Message-ID: <handler.62725.B.168096626724608.ack <at> debbugs.gnu.org>
References: <878rf24dqz.fsf@HIDDEN>
X-Gnu-PR-Message: ack 62725
X-Gnu-PR-Package: guix
Reply-To: 62725 <at> debbugs.gnu.org
Date: Sat, 08 Apr 2023 15:05:02 +0000

Thank you for filing a new bug report with debbugs.gnu.org.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 bug-guix@HIDDEN

If you wish to submit further information on this problem, please
send it to 62725 <at> debbugs.gnu.org.

Please do not send mail to help-debbugs@HIDDEN unless you wish
to report a problem with the Bug-tracking system.

--=20
62725: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D62725
GNU Bug Tracking System
Contact help-debbugs@HIDDEN with problems

Message received at control <at> debbugs.gnu.org:

Received: (at control) by debbugs.gnu.org; 8 Apr 2023 16:57:07 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Apr 08 12:57:07 2023
Received: from localhost ([127.0.0.1]:59404 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1plBsB-0001CY-23
	for submit <at> debbugs.gnu.org; Sat, 08 Apr 2023 12:57:07 -0400
Received: from out4-smtp.messagingengine.com ([66.111.4.28]:43331)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <leo@HIDDEN>) id 1plBs8-0001C2-N1
 for control <at> debbugs.gnu.org; Sat, 08 Apr 2023 12:57:05 -0400
Received: from compute2.internal (compute2.nyi.internal [10.202.2.46])
 by mailout.nyi.internal (Postfix) with ESMTP id 5C4635C00A8;
 Sat,  8 Apr 2023 12:56:59 -0400 (EDT)
Received: from mailfrontend1 ([10.202.2.162])
 by compute2.internal (MEProxy); Sat, 08 Apr 2023 12:56:59 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name;
 h=cc:content-type:content-type:date:date:from:from:in-reply-to
 :message-id:mime-version:reply-to:sender:subject:to:to; s=
 mesmtp; t=1680973019; x=1681059419; bh=Z1XD9tsgNYZeYYZm7J/Yxl1RA
 h7snzrwxP/aL3XguK4=; b=CeqdeqeHUzJuDlBAQ10j3CFLu4/iscDyo8/7TfrWv
 +g+saR5B9DdfrN45ilbQ5g+57HMnyF1SAh70QrpoqskKicuVh+CSojk9ScJ7Q/JB
 rX9fMue7AsyRp11tZ5Jlc9SZzFgsCn9R7UUUHbcW2Z938IPPeZdEzs/C746ZWEEb
 68=
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=
 messagingengine.com; h=cc:content-type:content-type:date:date
 :feedback-id:feedback-id:from:from:in-reply-to:message-id
 :mime-version:reply-to:sender:subject:to:to:x-me-proxy
 :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t=
 1680973019; x=1681059419; bh=Z1XD9tsgNYZeYYZm7J/Yxl1RAh7snzrwxP/
 aL3XguK4=; b=FU7IUdL4SG5SbR1hTavReH0t/14dZxkk0yp1KHwTquKQRJnvFcp
 5JCiDUHXoFnjOIklvubqlUr8XjuNTievPLkH88mCE4u/nt+SpKqBdz7ZBot+Lqs1
 0Oyd/rEYK8OHrLwoM69YuhjCooq2upoQX3zPaVE1Ar4OyMZVNCp8yFDIfXhvkI+x
 b1uUKbCmpw7iGPIMMTsGjux6EUlUk5QdVKxg4HD8dAcxGpAkLDSGqkzN9KNaPfVB
 pH5Fvm1KK8q8+eMSfSEmDHICfmxeNyxCzwweWlGgvbja1SsmE+5Tf/mlJRGZkVs6
 lkRauRJeC0OZMucq1luEfW7WHLR1UnS6YeA==
X-ME-Sender: <xms:25wxZPhcqOuirquzOjJgK9SKVZTqTmLL6SlUIBvMqftHt_3hs3nWdQ>
 <xme:25wxZMCBzKaPUvaz9Xyxldoa4vO7YBVvmcM4ysAbw3rMymzu87x_hPOZGKb9eEUkY
 oSMM4iRfRFY5wIiBg>
X-ME-Received: <xmr:25wxZPEWBtZsoYOtTRYjMqHSLsuvSnAMbN6a72pcWBaUEANo3i1GbkdTCJeeJooYatDxMVzBeVJXq-4bBeH2eyXf>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvhedrvdejjedguddtkecutefuodetggdotefrod
 ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh
 necuuegrihhlohhuthemuceftddtnecugfhmphhthicushhusghjvggtthculddutddmne
 cujfgurhepfffhvffkgggtugesthdtredttddtvdenucfhrhhomhepnfgvohcuhfgrmhhu
 lhgrrhhiuceolhgvohesfhgrmhhulhgrrhhirdhnrghmvgeqnecuggftrfgrthhtvghrnh
 ephfejiefgfeevvdefteehgeeltdekvedutdegtdduieetheetgedvfeffudfffeffnecu
 vehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomheplhgvohesfh
 grmhhulhgrrhhirdhnrghmvg
X-ME-Proxy: <xmx:25wxZMS2QwLO4C5ST5LGuWUHSRSmO-0GcVB-zCpsmqSCdetMDIli3g>
 <xmx:25wxZMyt_H1gh3rlCdlt4qjpvOaGlK9HHkHtaw1ac6wzzl08YBqjfQ>
 <xmx:25wxZC7ksUkQDYsXmoIevXIzhWsecQeK-Z8sLbHIJp7urp10QtBR_A>
 <xmx:25wxZJssd_Vf4yMUB-U2emzC_mvB6-MK1VFtC0l9mRi8jkBpAxiVbg>
Feedback-ID: i819c4023:Fastmail
Received: by mail.messagingengine.com (Postfix) with ESMTPA for
 <control <at> debbugs.gnu.org>; Sat, 8 Apr 2023 12:56:58 -0400 (EDT)
Date: Sat, 8 Apr 2023 12:56:43 -0400
From: Leo Famulari <leo@HIDDEN>
To: control <at> debbugs.gnu.org
Message-ID: <ZDGcy6RNtaSIyPQT@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
X-Spam-Score: 1.3 (+)
X-Spam-Report: Spam detection software, running on the system "debbugs.gnu.org",
 has NOT identified this incoming email as spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 the administrator of that system for details.
 Content preview:  block 62725 with 62726 
 Content analysis details:   (1.3 points, 10.0 required)
 pts rule name              description
 ---- ---------------------- --------------------------------------------------
 -0.0 SPF_HELO_PASS          SPF: HELO matches SPF record
 -0.0 SPF_PASS               SPF: sender matches SPF record
 -0.7 RCVD_IN_DNSWL_LOW      RBL: Sender listed at https://www.dnswl.org/,
 low trust [66.111.4.28 listed in list.dnswl.org]
 0.0 RCVD_IN_MSPIKE_H3      RBL: Good reputation (+3)
 [66.111.4.28 listed in wl.mailspike.net]
 0.0 RCVD_IN_MSPIKE_WL      Mailspike good senders
 1.8 MISSING_SUBJECT        Missing Subject: header
 0.2 NO_SUBJECT             Extra score for no subject
X-Debbugs-Envelope-To: control
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.3 (/)

block 62725 with 62726

Last modified: Sat, 8 Apr 2023 17:00:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.