[bug#54997] [PATCH 00/12] Add "least authority" program wrapper

[Ludovic Courtès]

Hi Maxime,

Maxime Devos <maximedevos@telenet.be> skribis:

> Ludovic Courtès schreef op zo 17-04-2022 om 23:04 [+0200]:
>> +                     ;; XXX: The daemon needs to live in the main user
>> +                     ;; namespace, as root, so it can access 
>> /var/lib/quassel
>> +                     ;; owned by "quasselcore".
>
> The previous code did not have this comment, was the old code broken or
> is this a limitation of least-authority-wrapper?

It’s just that ‘make-forkexec-constructor/container’ does it by default:

--8<---------------cut here---------------start------------->8---
(define (default-namespaces args)
  ;; Most daemons are here to talk to the network, and most of them expect to
  ;; run under a non-zero UID.
  (fold delq %namespaces '(net user)))
--8<---------------cut here---------------end--------------->8---

‘least-authority-wrapper’ is stricter by defaulting to ‘%namespaces’.

Ludo’.