Heya,
I'm trying to /wrap/ my head around least-authority-wrapper.
Specifically, I have a guile script that sends an email with msmtp and
fetches secrets using cat. This is a script that is run by the laminar
service when a build job is complete. Since it doesn't need to access
all secrets I make available through sops-guix, I wanted to try to
containerize it and lock it down from accessing files outside of the
ones it needs.
This is the program that I have:
(least-authority-wrapper
(program-file "after" notify-mail-gexp)
#:name "after"
#:user "laminar"
#:group "laminar"
#:namespaces
'(mnt) ;; This is the namespace causing issues
#:mappings (list
(file-system-mapping
(source (file-append nss-certs "/etc/ssl/certs"))
(target source)
(writable? #t))
(file-system-mapping
(source "/var/lib/laminar")
(target source)
(writable? #t))
(file-system-mapping
(source "/run/secrets/after")
(target source)
(writable? #t)))
#:preserved-environment-variables
'( "USER" "TERM" "JOB" "RESULT" "RUN" "SSL_CERT_FILE" "SSL_CERT_DIR"
"GIT_SSL_CAINFO"))
After some debugging, I found that it was the namespace 'mnt that was
causing issues, the script works when I remove it.
The error I'm getting is
Backtrace:
5 (primitive-load "/var/lib/laminar/cfg/after")
In ice-9/eval.scm:
191:35 4 (_ #f)
In gnu/build/linux-container.scm:
300:8 3 (call-with-temporary-directory #<procedure 7f7e58d71a50?>)
397:16 2 (_ "/tmp/guix-directory.nIT1Mt")
239:7 1 (run-container "/tmp/guix-directory.nIT1Mt" (#<<fil?> ?) ?)
In guix/build/syscalls.scm:
1143:12 0 (_ 131089)
guix/build/syscalls.scm:1143:12: In procedure clone: 131089: Operation not
permitted
When I try to invoke the script.
Any clue why I'm getting the operation not permitted error?
--
Marc
