diff options
Diffstat (limited to 'gnu/system.scm')
| -rw-r--r-- | gnu/system.scm | 70 |
1 files changed, 51 insertions, 19 deletions
diff --git a/gnu/system.scm b/gnu/system.scm index a7c2b1bca4..2b919d8b4a 100644 --- a/gnu/system.scm +++ b/gnu/system.scm @@ -7,7 +7,7 @@ ;;; Copyright © 2019 Meiyo Peng <meiyo.peng@gmail.com> ;;; Copyright © 2019, 2020 Miguel Ángel Arruga Vivas <rosen644835@gmail.com> ;;; Copyright © 2020 Danny Milosavljevic <dannym@scratchpost.org> -;;; Copyright © 2020 Brice Waegeneire <brice@waegenei.re> +;;; Copyright © 2020, 2021 Brice Waegeneire <brice@waegenei.re> ;;; Copyright © 2020 Florian Pelz <pelzflorian@pelzflorian.de> ;;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com> ;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <jannek@gnu.org> @@ -74,6 +74,7 @@ #:use-module (gnu system locale) #:use-module (gnu system pam) #:use-module (gnu system linux-initrd) + #:use-module (gnu system setuid) #:use-module (gnu system uuid) #:use-module (gnu system file-systems) #:use-module (gnu system mapped-devices) @@ -268,7 +269,8 @@ (pam-services operating-system-pam-services ; list of PAM services (default (base-pam-services))) (setuid-programs operating-system-setuid-programs - (default %setuid-programs)) ; list of string-valued gexps + (default %setuid-programs) ; list of <setuid-program> + (sanitize ensure-setuid-program-list)) (sudoers-file operating-system-sudoers-file ; file-like (default %sudoers-specification)) @@ -967,7 +969,12 @@ fi\n"))) ;; Some programs (e.g., GLib) look at /etc/timezone to find the ;; name of the current timezone. For details, see ;; https://lists.gnu.org/archive/html/guix-devel/2019-07/msg00166.html - ("timezone" ,(plain-file "timezone" (operating-system-timezone os))) + ;; Some programs expect a terminating newline. + ("timezone" ,(plain-file "timezone" + (string-append + (string-trim-both + (operating-system-timezone os)) + "\n"))) ("localtime" ,(file-append tzdata "/share/zoneinfo/" (operating-system-timezone os))) ,@(if sudoers @@ -1065,25 +1072,50 @@ use 'plain-file' instead~%") ;; TODO: Remove when glibc@2.23 is long gone. ("GUIX_LOCPATH" . "/run/current-system/locale"))) +(define-syntax-rule (ensure-setuid-program-list lst) + "Ensure LST is a list of <setuid-program> records and warn otherwise." + (%ensure-setuid-program-list lst (current-source-location))) + +(define (%ensure-setuid-program-list lst location) + (define warned? #f) + + (define (warn-once) + (unless warned? + (warning (source-properties->location location) + (G_ "representing setuid programs with file-like objects is \ +deprecated; use 'setuid-program' instead~%")) + (set! warned? #t))) + + (map (match-lambda + ((? setuid-program? program) + program) + (program + ;; PROGRAM is a file-like or a gexp like #~(string-append #$foo + ;; "/bin/bar"). + (warn-once) + (setuid-program (program program)))) + lst)) + (define %setuid-programs ;; Default set of setuid-root programs. (let ((shadow (@ (gnu packages admin) shadow))) - (list (file-append shadow "/bin/passwd") - (file-append shadow "/bin/sg") - (file-append shadow "/bin/su") - (file-append shadow "/bin/newgrp") - (file-append shadow "/bin/newuidmap") - (file-append shadow "/bin/newgidmap") - (file-append inetutils "/bin/ping") - (file-append inetutils "/bin/ping6") - (file-append sudo "/bin/sudo") - (file-append sudo "/bin/sudoedit") - (file-append fuse "/bin/fusermount") - - ;; To allow mounts with the "user" option, "mount" and "umount" must - ;; be setuid-root. - (file-append util-linux "/bin/mount") - (file-append util-linux "/bin/umount")))) + (map file-like->setuid-program + (list (file-append shadow "/bin/passwd") + (file-append shadow "/bin/sg") + (file-append shadow "/bin/su") + (file-append shadow "/bin/newgrp") + (file-append shadow "/bin/newuidmap") + (file-append shadow "/bin/newgidmap") + (file-append inetutils "/bin/ping") + (file-append inetutils "/bin/ping6") + (file-append sudo "/bin/sudo") + (file-append sudo "/bin/sudoedit") + (file-append fuse "/bin/fusermount") + + ;; To allow mounts with the "user" option, "mount" and "umount" must + ;; be setuid-root. + (file-append util-linux "/bin/mount") + (file-append util-linux "/bin/umount"))))) (define %sudoers-specification ;; Default /etc/sudoers contents: 'root' and all members of the 'wheel' |