bug#60890: least-authority-wrapper and make-forkexec-constructor composition problem

[Ludovic Courtès]

Hello!

Maxim Cournoyer <maxim.cournoyer@gmail.com> skribis:

> It was found that using something like:
>
> (make-forkexec-constructor
>   (least-authority
>     (list (file-append coreutils "/bin/true"))
>     (mappings (delq 'user %namespaces))
>   #:user  "nobody"
>   #:group "nobody"))
>
> Would fail with EPERM, because in order to be able to drop the user
> namespace, the CAP_SYS_ADMIN capability is required, but in the above
> case, make-forkexec-constructor has already changed the user to
> "nobody", which lacks such capability.

Thanks for the reminder!

I guess the problem is limited to cases where you need the program to
run in the global user namespace.

For example, Tor does not need to run in the global user namespace, and
thus does the following:

--8<---------------cut here---------------start------------->8---
(define (tor-shepherd-service config)
  "Return a <shepherd-service> running Tor."
  (let* ((torrc (tor-configuration->torrc config))
         (tor   (least-authority-wrapper
                 (file-append (tor-configuration-tor config) "/bin/tor")
                 #:name "tor"
                 #:mappings (list …)
                 #:namespaces (delq 'net %namespaces))))
    (list (shepherd-service
           (provision '(tor))
           ;; …
           (start #~(make-forkexec-constructor
                     (list #$tor "-f" #$torrc)
                     #:user "tor" #:group "tor"))
           (stop #~(make-kill-destructor))
           (actions (list (shepherd-configuration-action torrc)))
           (documentation "Run the Tor anonymous network overlay.")))))
--8<---------------cut here---------------end--------------->8---

Here ‘make-forkexec-constructor’ calls setuid/setgid before it invokes
the wrapped program, and everything’s fine.

Ludo’.