Ludovic Courtès a92d98a7fa daemon: Attempt to map the “kvm” group inside the build user namespace. ... Fixes <https://issues.guix.gnu.org/77862>. Previously, the ‘guix-daemon’ account (for unprivileged execution) would typically have “kvm” as a supplementary group, but that group would not be mapped in the build user namespace. Consequently, attempts to ‘chown’ a file to that supplementary group would fail with EINVAL. The test suites of Coreutils, Python, and Go (among others) exercise this chown-to-supplementary-group behavior, so they would all fail when started by the unprivileged ‘guix-daemon’ even though they succeed when started by ‘guix-daemon’ running as root. Thanks to keinflue <keinflue@posteo.net> and Reepca Russelstein <reepca@russelstein.xyz> for helping out. * nix/libstore/build.cc (initializeUserNamespace): Add ‘extraGIDs’ and ‘haveCapSetGID’ parameters. Invoke ‘newgidmap’ when ‘extraGIDs’ is non-empty and ‘haveCapSetGID’ is false. Honor ‘extraGIDs’ when ‘haveCapSetGID’ is true. (maxGroups, guestKVMGID): New variables. (kvmGIDMapping): New function. (DerivationGoal::startBuilder): Set ‘ctx.lockMountsMapAll’ in the CLONE_NEWUSER case. Pass ‘extraGIDs’ to ‘initializeUserNamespace’. * tests/store.scm ("kvm GID is mapped"): New test. Change-Id: I10ba710fc1b9ca1e3cd3122be1ec8ede5df18b40		2025-10-16 15:14:37 +02:00
..
boost
libstore	daemon: Attempt to map the “kvm” group inside the build user namespace.	2025-10-16 15:14:37 +02:00
libutil	daemon: Export as little as needed from libutil/spawn.cc.	2025-10-16 15:14:37 +02:00
nix-daemon	daemon: Consider the current user as trusted.	2025-07-16 23:50:51 +02:00
.gitignore
AUTHORS
COPYING
local.mk	daemon: add seccomp filter for slirp4netns.	2025-06-24 10:07:58 -04:00