projects/guix·blob ruby-team · refs

66 lines · 2.8 KiB

1;;; GNU Guix --- Functional package management for GNU
2;;; Copyright © 2021 Brice Waegeneire <[email protected]>
3;;; Copyright © 2022 Tobias Geerinckx-Rice <[email protected]>
4;;;
5;;; This file is part of GNU Guix.
6;;;
7;;; GNU Guix is free software; you can redistribute it and/or modify it
8;;; under the terms of the GNU General Public License as published by
9;;; the Free Software Foundation; either version 3 of the License, or (at
10;;; your option) any later version.
11;;;
12;;; GNU Guix is distributed in the hope that it will be useful, but
13;;; WITHOUT ANY WARRANTY; without even the implied warranty of
14;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15;;; GNU General Public License for more details.
16;;;
17;;; You should have received a copy of the GNU General Public License
18;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
19
20(define-module (gnu system privilege)
21 #:use-module (guix records)
22 #:export (privileged-program
23 privileged-program?
24 privileged-program-program
25 privileged-program-setuid?
26 privileged-program-setgid?
27 privileged-program-user
28 privileged-program-group
29 privileged-program-capabilities
30
31 file-like->setuid-program))
32
33;;; Commentary:
34;;;
35;;; Data structures representing privileged programs: binaries with additional
36;;; permissions such as setuid/setgid, or POSIX capabilities. This is meant to
37;;; be used both on the host side and at run time--e.g., in activation snippets.
38;;;
39;;; Code:
40
41(define-record-type* <privileged-program>
42 privileged-program make-privileged-program
43 privileged-program?
44 ;; File name of the program to assign elevated privileges.
45 (program privileged-program-program) ;file-like
46 ;; Whether to set the setuid (‘set user ID’) bit.
47 (setuid? privileged-program-setuid? ;boolean
48 (default #f))
49 ;; Whether to set the setgid (‘set group ID’) bit.
50 (setgid? privileged-program-setgid? ;boolean
51 (default #f))
52 ;; The user name or ID this should be set to (defaults to root's).
53 (user privileged-program-user ;integer or string
54 (default 0))
55 ;; The group name or ID we want to set this to (defaults to root's).
56 (group privileged-program-group ;integer or string
57 (default 0))
58 ;; POSIX capabilities in cap_from_text(3) form (defaults to #f: none).
59 (capabilities privileged-program-capabilities ;string or #f
60 (default #f)))
61
62(define (file-like->setuid-program program)
63 "Simple wrapper to facilitate MAPping over a list of file-like objects and
64make them setuid, a pattern just common enough to justify a special helper."
65 (privileged-program (program program)
66 (setuid? #t)))