guix_mirror_bot pushed a commit to branch master
in repository guix.
commit 46a6cfa7e3bfd6fa4646342196bac165efd275a2
Author: Ludovic Courtès <[email protected]>
AuthorDate: Sat Jul 11 10:24:56 2026 +0200
least-authority-wrapper: Set ‘LISTEN_PID’ to the right PID.
This fixes socket activation of least-authority-wrapped programs.
Partly addresses shepherd/shepherd#122.
* guix/least-authority.scm (least-authority-wrapper): Define ‘listen-pid?’
and
set ‘LISTEN_PID’ to namespace-local PID when it is set.
Reported-by: Maxim Cournoyer <[email protected]>
Signed-off-by: Ludovic Courtès <[email protected]>
Merges: #9866
---
guix/least-authority.scm | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/guix/least-authority.scm b/guix/least-authority.scm
index cd846aaa61..68dc7e68e8 100644
--- a/guix/least-authority.scm
+++ b/guix/least-authority.scm
@@ -1,5 +1,5 @@
;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2022-2023 Ludovic Courtès <[email protected]>
+;;; Copyright © 2022-2023, 2026 Ludovic Courtès <[email protected]>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -82,6 +82,12 @@ resulting wrapper be executed as root so it can call
setgid(2) and setuid(2)."
(string-append variable "=" value))))
'#$preserved-environment-variables))
+ (define listen-pid?
+ ;; The 'LISTEN_PID' variable, used for socket activation, needs to
+ ;; point to the correct PID.
+ (eqv? (and=> (getenv "LISTEN_PID") string->number)
+ (getpid)))
+
(define (read-file file)
(call-with-input-file file read))
@@ -136,6 +142,10 @@ resulting wrapper be executed as root so it can call
setgid(2) and setuid(2)."
(chdir #$directory)
(environ variables)
+ (when listen-pid?
+ ;; Set 'LISTEN_PID' to the PID in this namespace.
+ (setenv "LISTEN_PID" (number->string (getpid))))
+
(unless (memq 'user namespaces)
;; This process lives in its parent user namespace,
;; presumably as root; now is the time to setgid/setuid if
