Age | Commit message (Expand) | Author |
2024-11-11 | system: hurd: Add swap-services to hurd-default-essential-services....* gnu/services/base.scm (swap-service-type): Do not include 'udev' requirement
for the Hurd. Use system* with "swapon", "swapoff" for the Hurd.
* gnu/system.scm (hurd-default-essential-services): Add swap-services.
* gnu/services/base.scm (swap-service-type):
Change-Id: I1d4d445c614921752dc84aa0dd6ff42cdbf62aa8
| Janneke Nieuwenhuizen |
2024-11-03 | system: %default-privileged-programs: Set ping capabilities...Ping and ping6 don't need setuid, they can work with
cap_net_raw capability only. This means that even if
ping or ping6 had a vulnerability that could be
used for execution as root, it can't anymore if
the program is not setuid.
* gnu/system.scm (%default-privileged-programs): Remove ping, ping6 setuid
programs, add ping, ping6 programs with cap_net_raw=ep capabilities
Change-Id: Ie409b477f548dbff3318eec33d0d2ca16a1b3209
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
| Rutherther |
2024-10-24 | gnu: system: Privilege programs after creating accounts....Ensure that users and groups are already created when the privileging script
runs. The order these scripts appear in the folded activation-service depends
on the order these services are instantiated in the operating-system.
Fixes <https://issues.guix.gnu.org/73680>.
* gnu/system.scm (operating-system-default-essential-services): Move
privileged-program-service above account-service.
(hurd-default-essential-services): Likewise.
* gnu/tests/base.scm (%activation-os): New variable.
(run-activation-test): New procedure.
(%test-activation): New variable.
Change-Id: I59a191c5519475f256e81bdf2dc4cb01b96c31fe
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
| Dariqq |
2024-08-11 | system: Add privileged-programs to <operating-system>....* gnu/system.scm (<operating-system>): Add new privileged-programs
field, that defaults to…
(%default-privileged-programs): …this new variable, renamed from…
(%setuid-programs): …this, which is now defined as the empty list.
* doc/guix.texi (Setuid Programs): Rename this…
(Privileged Programs): …to this. Adjust all refs. Update all mentions
of ‘setuid’ (whether in prose, variable names, or code samples) to use
the new ‘privilege[d]’ terminology instead.
(operating-system Reference, X Window, Invoking guix system)
(Service Reference): Adjust likewise.
| Tobias Geerinckx-Rice |
2024-08-11 | system: Use privileged-program-service-type by default....* gnu/system.scm (operating-system-default-essential-services)
(hurd-default-essential-services): Substitute
privileged-program-service-type for setuid-program-service-type.
| Tobias Geerinckx-Rice |
2024-08-11 | system: Use /run/privileged/bin in search paths....* gnu/system.scm (operating-system-etc-service):
Substitute /run/privileged/bin for deprecated /run/setuid-programs.
| Tobias Geerinckx-Rice |
2024-08-11 | system: Disallow file-like setuid-programs....It has been a warning for well over a year now. Now, with
privileged-programs coming, don't let's support nested deprecation
hacks.
* gnu/system.scm (<operating-system>):
Don't ‘sanitize’ the setuid-programs field.
(ensure-setuid-program-list): Delete syntax.
(%ensure-setuid-program-list): Delete variable.
| Tobias Geerinckx-Rice |