diff options
| author | Tobias Geerinckx-Rice <me@tobias.gr> | 2023-07-23 02:00:00 +0200 |
|---|---|---|
| committer | Tobias Geerinckx-Rice <me@tobias.gr> | 2024-08-11 02:00:00 +0200 |
| commit | 71f0676a295841e2cc662eec0d3e9b7e69726035 (patch) | |
| tree | a39d569981af5fbe9b19634a935c536709698915 /gnu/services.scm | |
| parent | 4e58dfee6c7456d1e662f66041b8a157efe8710a (diff) | |
privilege: Add POSIX capabilities(7) support.
* gnu/system/privilege.scm (<privileged-program>): Add a field
representing the program's POSIX capabilities.
(privileged-program-capabilities): New public procedure.
* doc/guix.texi (Privileged Programs): Document it.
* gnu/build/activation.scm (activate-privileged-programs): Take a LIBCAP
package argument providing setcap(8) to apply said capabilities.
* gnu/services.scm (privileged-program->activation-gexp): Pass said
package argument where supported. Include privileged-program-capabilities
in the compatibility hack.
Diffstat (limited to 'gnu/services.scm')
| -rw-r--r-- | gnu/services.scm | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/gnu/services.scm b/gnu/services.scm index 553ec93a6c..610a2df395 100644 --- a/gnu/services.scm +++ b/gnu/services.scm @@ -46,6 +46,7 @@ #:use-module (gnu packages base) #:use-module (gnu packages bash) #:use-module (gnu packages hurd) + #:use-module (gnu packages linux) #:use-module (gnu system privilege) #:use-module (srfi srfi-1) #:use-module (srfi srfi-9) @@ -899,12 +900,14 @@ FILES must be a list of name/file-like object pairs." (setuid? (privileged-program-setuid? program)) (setgid? (privileged-program-setgid? program)) (user (privileged-program-user program)) - (group (privileged-program-group program)) ) + (group (privileged-program-group program)) + (capabilities (privileged-program-capabilities program))) #~(privileged-program (setuid? #$setuid?) (setgid? #$setgid?) (user #$user) (group #$group) + (capabilities #$capabilities) (program #$program-name)))) programs))) (with-imported-modules (source-module-closure @@ -912,7 +915,9 @@ FILES must be a list of name/file-like object pairs." #~(begin (use-modules (gnu system privilege)) - (activate-privileged-programs (list #$@programs)))))) + (activate-privileged-programs (list #$@programs) + #$(and (supported-package? libcap) + libcap)))))) (define privileged-program-service-type (service-type (name 'privileged-program) |