diff options
| author | Tobias Geerinckx-Rice <me@tobias.gr> | 2023-07-23 02:00:00 +0200 |
|---|---|---|
| committer | Tobias Geerinckx-Rice <me@tobias.gr> | 2024-08-11 02:00:00 +0200 |
| commit | 71f0676a295841e2cc662eec0d3e9b7e69726035 (patch) | |
| tree | a39d569981af5fbe9b19634a935c536709698915 /doc | |
| parent | 4e58dfee6c7456d1e662f66041b8a157efe8710a (diff) | |
| download | guix-71f0676a295841e2cc662eec0d3e9b7e69726035.tar.gz guix-71f0676a295841e2cc662eec0d3e9b7e69726035.zip | |
privilege: Add POSIX capabilities(7) support.
* gnu/system/privilege.scm (<privileged-program>): Add a field
representing the program's POSIX capabilities.
(privileged-program-capabilities): New public procedure.
* doc/guix.texi (Privileged Programs): Document it.
* gnu/build/activation.scm (activate-privileged-programs): Take a LIBCAP
package argument providing setcap(8) to apply said capabilities.
* gnu/services.scm (privileged-program->activation-gexp): Pass said
package argument where supported. Include privileged-program-capabilities
in the compatibility hack.
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/guix.texi | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/doc/guix.texi b/doc/guix.texi index f882eb70e4..0e1e253b02 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -41655,6 +41655,8 @@ invokation. @cindex privileged programs @cindex setuid programs @cindex setgid programs +@cindex capabilities, POSIX +@cindex setcap Some programs need to run with elevated privileges, even when they are launched by unprivileged users. A notorious example is the @command{passwd} program, which users can run to change their @@ -41720,6 +41722,11 @@ defaults to root. GID (integer) group name (string) for the group owner of the program, defaults to root. +@item @code{capabilities} (default: @code{#f}) +A string representing the program's POSIX capabilities, as described by +the @code{cap_to_text(3)} man page from the libcap package, or @code{#f} +to make no changes. + @end table @end deftp |