[Nix-dev] setuidwrapper questions

[Guillaume Maudoux (Layus)]

Hi Jon,

Unless I am terribly mistaken, setuid wrappers are only needed for 
executables in the nix store because the nix store fordids to set the 
suid bit.

For your executable, just set the suid bit and... Voilà :-).

-- Layus.


On 16/03/17 17:41, Jon Parris wrote:
> Hi All,
>
> NixOS noob here. I have two questions relating to setuid.
>
> First how do I create a wrapper for program (named buildenv) which is
> outside of nixpkgs? Here are the constraits for buildenv.
> * This is a internal tool - so I can't add it to the public nixpkgs.
> * This tool is written in C, it calls clone and chroot.
>
> Second buildenv is called with the wrong userid.
>
> The buildenv tool stores the uid from getuid, chroots, then restores the userid.
>
> What I see - buildenv is called with uid lroot.
> $ whoami
> parrisj
> $ buildenv 3.3.1
> $ whoami
> lroot
>
> Expected Behavior
> $ buildenv 3.3.1
> $ whoami
> parrisj
>
> How I kludged setuidwrapper to discover this.
> 1) Add a entry for buildenv in security.setuidPrograms in
> /etc/nixos/configuration.nix
> 2) nixos-rebuild switch
> 3) Overwrite /var/setuidwrappers/buildenv.real with the corrrect path.
>
> Thanks, Jon
> _______________________________________________
> nix-dev mailing list
> nix-dev at lists.science.uu.nl
> http://lists.science.uu.nl/mailman/listinfo/nix-dev