least-authority-wrapper: Set ‘LISTEN_PID’ to the right PID.

This fixes socket activation of least-authority-wrapped programs.
Partly addresses shepherd/shepherd#122.

* guix/least-authority.scm (least-authority-wrapper): Define ‘listen-pid?’ and
set ‘LISTEN_PID’ to namespace-local PID when it is set.

Reported-by: Maxim Cournoyer <maxim@guixotic.coop>
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #9866

1 files changed, 11 insertions, 1 deletions

diff --git a/guix/least-authority.scm b/guix/least-authority.scm
index cd846aaa61d..68dc7e68e8c 100644
--- a/guix/least-authority.scm
+++ b/guix/least-authority.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2022-2023 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2022-2023, 2026 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -82,6 +82,12 @@ resulting wrapper be executed as root so it can call setgid(2) and setuid(2)."
                                  (string-append variable "=" value))))
                         '#$preserved-environment-variables))
 
+          (define listen-pid?
+            ;; The 'LISTEN_PID' variable, used for socket activation, needs to
+            ;; point to the correct PID.
+            (eqv? (and=> (getenv "LISTEN_PID") string->number)
+                  (getpid)))
+
           (define (read-file file)
             (call-with-input-file file read))
 
@@ -136,6 +142,10 @@ resulting wrapper be executed as root so it can call setgid(2) and setuid(2)."
                (chdir #$directory)
                (environ variables)
 
+               (when listen-pid?
+                 ;; Set 'LISTEN_PID' to the PID in this namespace.
+                 (setenv "LISTEN_PID" (number->string (getpid))))
+
                (unless (memq 'user namespaces)
                  ;; This process lives in its parent user namespace,
                  ;; presumably as root; now is the time to setgid/setuid if