;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re>
;;; Copyright © 2022 Tobias Geerinckx-Rice <me@tobias.gr>
;;;
;;; This file is part of GNU Guix.
;;;
;;; GNU Guix is free software; you can redistribute it and/or modify it
;;; under the terms of the GNU General Public License as published by
;;; the Free Software Foundation; either version 3 of the License, or (at
;;; your option) any later version.
;;;
;;; GNU Guix is distributed in the hope that it will be useful, but
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

(define-module (gnu system privilege)
  #:use-module (guix records)
  #:export (privileged-program
            privileged-program?
            privileged-program-program
            privileged-program-setuid?
            privileged-program-setgid?
            privileged-program-user
            privileged-program-group
            privileged-program-capabilities))

;;; Commentary:
;;;
;;; Data structures representing privileged programs: binaries with additional
;;; permissions such as setuid/setgid, or POSIX capabilities.  This is meant to
;;; be used both on the host side and at run time--e.g., in activation snippets.
;;;
;;; Code:

(define-record-type* <privileged-program>
  privileged-program make-privileged-program
  privileged-program?
  ;; File name of the program to assign elevated privileges.
  (program       privileged-program-program) ;file-like
  ;; Whether to set the setuid (‘set user ID’) bit.
  (setuid?       privileged-program-setuid? ;boolean
                 (default #f))
  ;; Whether to set the setgid (‘set group ID’) bit.
  (setgid?       privileged-program-setgid? ;boolean
                 (default #f))
  ;; The user name or ID this should be set to (defaults to root's).
  (user          privileged-program-user ;integer or string
                 (default 0))
  ;; The group name or ID we want to set this to (defaults to root's).
  (group         privileged-program-group ;integer or string
                 (default 0))
  ;; POSIX capabilities in cap_from_text(3) form (defaults to #f: none).
  (capabilities  privileged-program-capabilities ;string or #f
                 (default #f)))
8da660a2f775de2656e47f3e9ec75bc&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2023-04-21 16:16:38 +0200'>2023-04-21</span></td><td><a href='/guix/commit/tests/guix-system.sh?id=37dd69b44511dc73eb04bdebe8d82c9a0386338e'>tests: Fix checks for expected failures.</a><span class='msg-avail'>...</span></td><td>Eric Bavier</td></tr>
<tr><td><span title='2023-04-18 11:43:14 -0400'>2023-04-18</span></td><td><a href='/guix/commit/tests/guix-system.sh?id=286cdf0bc55a29d5a63f7191edde7ea4dbd8cf2a'>tests: guix-system: Drop the i686-linux desktop image test.</a><span class='msg-avail'>...</span></td><td>Maxim Cournoyer</td></tr>
<tr><td><span title='2022-12-04 00:50:28 -0500'>2022-12-04</span></td><td><a href='/guix/commit/tests/guix-system.sh?id=93309efdce72ac5028944d5c1f7b081a7f62b84a'>tests: Fix guix-system.sh test.</a><span class='msg-avail'>...</span></td><td>Maxim Cournoyer</td></tr>
<tr><td><span title='2022-10-07 16:01:39 +0200'>2022-10-07</span></td><td><a href='/guix/commit/tests/guix-system.sh?id=31708431c53524f05e6a0c9fed920cb773e7dd21'>tests: Attempt to build 'desktop.tmpl' on all major architectures.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2022-09-04 23:10:10 +0200'>2022-09-04</span></td><td><a href='/guix/commit/tests/guix-system.sh?id=f1bbb06dad36c6262afac908c45038e5a3da7b16'>guix system: Do not use 'vm-image.tmpl' in tests.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2022-02-18 14:14:38 +0100'>2022-02-18</span></td><td><a href='/guix/commit/tests/guix-system.sh?id=5a57313918a5c1bd5cf8238c2dcae64a03523952'>profiles: 'profile-derivation' rejects unsupported packages.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2021-08-29 01:05:26 -0400'>2021-08-29</span></td><td><a href='/guix/commit/tests/guix-system.sh?id=2ca982ff41270288913ad6b7d5d9e1cad87b06d9'>gnu: bootloader: Support multiple targets.</a><span class='msg-avail'>...</span></td><td>Maxim Cournoyer</td></tr>
<tr><td><span title='2021-04-29 01:22:04 +0200'>2021-04-29</span></td><td><a href='/guix/commit/tests/guix-system.sh?id=524c9800afb433cc474132185d8e37f72004adb3'>diagnostics, ui: Adjust to 'read-error' and 'syntax-error' in Guile 3.0.6.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2021-02-17 10:57:02 +0100'>2021-02-17</span></td><td><a href='/guix/commit/tests/guix-system.sh?id=6e8cdf1d26092cb9654e179b04730fff7c15c94f'>scripts: system: Accept &lt;image&gt; records as input.</a><span class='msg-avail'>...</span></td><td>Mathieu Othacehe</td></tr>
<tr><td><span title='2021-02-17 10:52:28 +0100'>2021-02-17</span></td><td><a href='/guix/commit/tests/guix-system.sh?id=ee2a5da80a9bda25542c00a7a35a9ddddcbd58af'>scripts: system: Remove 'vm-image' command.</a><span class='msg-avail'>...</span></td><td>Mathieu Othacehe</td></tr>
<tr><td><span title='2021-01-30 15:36:58 +0100'>2021-01-30</span></td><td><a href='/guix/commit/tests/guix-system.sh?id=b84152439c298724c36e1282e4feb9ce246b76c3'>guix system: Test 'extension-graph' and 'shepherd-graph'.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2021-01-19 17:16:56 +0100'>2021-01-19</span></td><td><a href='/guix/commit/tests/guix-system.sh?id=e74baa124592428f05b17562f180469e405037f3'>system: Rename 'disk-image' command 'image'.</a><span class='msg-avail'>...</span></td><td>Mathieu Othacehe</td></tr>
<tr><td><span title='2021-01-13 22:24:18 +0100'>2021-01-13</span></td><td><a href='/guix/commit/tests/guix-system.sh?id=0d22fc8d36e4efba9748c94cab7cedbbe2bbb5bf'>services: shepherd: 'shepherd-service-type' requires documentation.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>