#78179 - [PATCH 0/4] Add wireshark-service-type with privileged wrapper

Package	Source(s)		Maintainer(s)
guix-patches		PTS Buildd Popcon

Message #17 received at 78179@debbugs.gnu.org (full text, mbox, reply):

Received: (at 78179) by debbugs.gnu.org; 1 May 2025 08:30:01 +0000
From debbugs-submit-bounces@debbugs.gnu.org Thu May 01 04:30:01 2025
Received: from localhost ([127.0.0.1]:48395 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1uAPIu-0005us-NL
	for submit@debbugs.gnu.org; Thu, 01 May 2025 04:30:01 -0400
Received: from ditigal.xyz ([78.46.201.50]:53198 helo=mail.ditigal.xyz)
 by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.84_2) (envelope-from <rutherther@ditigal.xyz>)
 id 1uAPIp-0005tw-S5
 for 78179@debbugs.gnu.org; Thu, 01 May 2025 04:29:57 -0400
Received: by cerebrum (OpenSMTPD) with ESMTPSA id 4d1bf36f
 (TLSv1.3:TLS_CHACHA20_POLY1305_SHA256:256:NO); 
 Thu, 1 May 2025 08:29:52 +0000 (UTC)
From: Rutherther <rutherther@ditigal.xyz>
To: 78179@debbugs.gnu.org
Subject: [PATCH 3/4] gnu: wireshark: Wrap dumpcap with wrap-privileged.
Date: Thu,  1 May 2025 10:29:36 +0200
Message-ID: <9df66aad0fb0acd1419c1a805896ad1d8ba174b0.1746086472.git.rutherther@ditigal.xyz>
X-Mailer: git-send-email 2.49.0
In-Reply-To: <cover.1746086472.git.rutherther@ditigal.xyz>
References: <cover.1746086472.git.rutherther@ditigal.xyz>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ditigal.xyz;
 i=@ditigal.xyz; q=dns/txt; s=20240917; t=1746088192; h=from : to : cc
 : subject : date : message-id : in-reply-to : references :
 mime-version : content-transfer-encoding : from;
 bh=UVd0wUvTqBuRE2zB5wHwNY8uXeWJ01Ny4MsQy791Za8=;
 b=DS9StrURv9Q1crkOoecp5UdIOzBmthbomNKaHdEVdy26ehFM2+IUVZMJnM2jqFYwZZAdn
 vMiCrBsj2TP804T9NqLbVLzdhU4VBvoxoNJjhu1tzuZDFl9SDuBnGUYTpzclHoG4jdtZNGh
 zxEcs21izIm8QmhVQlAPmxoFzbdIo9Q=
X-Spam-Score: 0.5 (/)
X-Debbugs-Envelope-To: 78179
Cc: Rutherther <rutherther@ditigal.xyz>
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -0.5 (/)

Wraps Wireshark so that dumpcap can be made a privileged program.
The ...wireshark/bin/dumpcap will be a shell script that tries to execute
/run/privileged/bin/dumpcap first and falls back to the original dumpcap that
is stored in ...wireshark/privileged/dumpcap.

* gnu/packages/networking.scm (wireshark)[modules]: Add guix build privileged.
* gnu/packages/networking.scm (wireshark)[imported-modules]: Add guix build privileged.
* gnu/packages/networking.scm (wireshark)[inputs]: Add bash.
* gnu/packages/networking.scm (wireshark)[phases]: Add wrap-dumpcap phase
executing wrap-privileged.

Change-Id: Ia19670d0372af40c01a26c1d15f41ce668ce023d
---
 gnu/packages/networking.scm | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/networking.scm b/gnu/packages/networking.scm
index 2a27474826..f957cc02e5 100644
--- a/gnu/packages/networking.scm
+++ b/gnu/packages/networking.scm
@@ -87,6 +87,7 @@ (define-module (gnu packages networking)
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (guix packages)
   #:use-module (guix download)
+  #:use-module (guix modules)
   #:use-module (guix gexp)
   #:use-module (guix git-download)
   #:use-module (guix build-system cmake)
@@ -1829,6 +1830,11 @@ (define-public wireshark
     (build-system qt-build-system)
     (arguments
      (list
+      #:modules `((guix build privileged)
+                  (guix build qt-build-system)
+                  (guix build utils))
+      #:imported-modules `(,@(source-module-closure '((guix build privileged)))
+                           ,@%qt-build-system-modules)
       ;; This causes the plugins to register runpaths for the wireshark
       ;; libraries, which would otherwise cause the validate-runpath phase to
       ;; fail.
@@ -1844,9 +1850,16 @@ (define-public wireshark
                 (invoke "ctest" "-VV"
                         "-j" (if parallel-tests?
                                  (number->string (parallel-job-count))
-                                 "1"))))))))
+                                 "1")))))
+          (add-after 'qt-wrap 'wrap-dumpcap
+            (lambda _
+              (wrap-privileged
+               #$output
+               "bin/dumpcap"
+               "dumpcap"))))))
     (inputs
-     (list c-ares
+     (list bash
+           c-ares
            glib
            gnutls
            brotli
-- 
2.49.0

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Tue Sep 9 16:23:43 2025; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#78179 [PATCH 0/4] Add wireshark-service-type with privileged wrapper