projects/guix·blob javascript-team · refs

66 lines · 2.8 KiB

1;;; GNU Guix --- Functional package management for GNU
2;;; Copyright © 2021 Brice Waegeneire <[email protected]>
3;;; Copyright © 2022 Tobias Geerinckx-Rice <[email protected]>
4;;;
5;;; This file is part of GNU Guix.
6;;;
7;;; GNU Guix is free software; you can redistribute it and/or modify it
8;;; under the terms of the GNU General Public License as published by
9;;; the Free Software Foundation; either version 3 of the License, or (at
10;;; your option) any later version.
11;;;
12;;; GNU Guix is distributed in the hope that it will be useful, but
13;;; WITHOUT ANY WARRANTY; without even the implied warranty of
14;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15;;; GNU General Public License for more details.
16;;;
17;;; You should have received a copy of the GNU General Public License
18;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
19
20;;; Commentary:
21;;;
22;;; Data structures representing privileged programs: binaries with additional
23;;; permissions such as setuid/setgid, or POSIX capabilities. This is meant to
24;;; be used both on the host side and at run time--e.g., in activation snippets.
25;;;
26;;; Code:
27
28(define-module (gnu system privilege)
29 #:use-module (guix records)
30 #:export (privileged-program
31 privileged-program?
32 privileged-program-program
33 privileged-program-setuid?
34 privileged-program-setgid?
35 privileged-program-user
36 privileged-program-group
37 privileged-program-capabilities
38
39 file-like->setuid-program))
40
41(define-record-type* <privileged-program>
42 privileged-program make-privileged-program
43 privileged-program?
44 ;; File name of the program to assign elevated privileges.
45 (program privileged-program-program) ;file-like
46 ;; Whether to set the setuid (‘set user ID’) bit.
47 (setuid? privileged-program-setuid? ;boolean
48 (default #f))
49 ;; Whether to set the setgid (‘set group ID’) bit.
50 (setgid? privileged-program-setgid? ;boolean
51 (default #f))
52 ;; The user name or ID this should be set to (defaults to root's).
53 (user privileged-program-user ;integer or string
54 (default 0))
55 ;; The group name or ID we want to set this to (defaults to root's).
56 (group privileged-program-group ;integer or string
57 (default 0))
58 ;; POSIX capabilities in cap_from_text(3) form (defaults to #f: none).
59 (capabilities privileged-program-capabilities ;string or #f
60 (default #f)))
61
62(define (file-like->setuid-program program)
63 "Simple wrapper to facilitate MAPping over a list of file-like objects and
64make them setuid, a pattern just common enough to justify a special helper."
65 (privileged-program (program program)
66 (setuid? #t)))