privilege: Add POSIX capabilities(7) support.

* gnu/system/privilege.scm (<privileged-program>): Add a field
representing the program's POSIX capabilities.
(privileged-program-capabilities): New public procedure.
* doc/guix.texi (Privileged Programs): Document it.
* gnu/build/activation.scm (activate-privileged-programs): Take a LIBCAP
package argument providing setcap(8) to apply said capabilities.
* gnu/services.scm (privileged-program->activation-gexp): Pass said
package argument where supported.  Include privileged-program-capabilities
in the compatibility hack.

1 files changed, 7 insertions, 2 deletions

diff --git a/gnu/services.scm b/gnu/services.scm
index 553ec93a6c7..610a2df3958 100644
--- a/gnu/services.scm
+++ b/gnu/services.scm
@@ -46,6 +46,7 @@
   #:use-module (gnu packages base)
   #:use-module (gnu packages bash)
   #:use-module (gnu packages hurd)
+  #:use-module (gnu packages linux)
   #:use-module (gnu system privilege)
   #:use-module (srfi srfi-1)
   #:use-module (srfi srfi-9)
@@ -899,12 +900,14 @@ FILES must be a list of name/file-like object pairs."
                                (setuid?      (privileged-program-setuid? program))
                                (setgid?      (privileged-program-setgid? program))
                                (user         (privileged-program-user program))
-                               (group        (privileged-program-group program)) )
+                               (group        (privileged-program-group program))
+                               (capabilities (privileged-program-capabilities program)))
                            #~(privileged-program
                               (setuid? #$setuid?)
                               (setgid? #$setgid?)
                               (user    #$user)
                               (group   #$group)
+                              (capabilities #$capabilities)
                               (program #$program-name))))
                        programs)))
     (with-imported-modules (source-module-closure
@@ -912,7 +915,9 @@ FILES must be a list of name/file-like object pairs."
       #~(begin
           (use-modules (gnu system privilege))
 
-          (activate-privileged-programs (list #$@programs))))))
+          (activate-privileged-programs (list #$@programs)
+                                        #$(and (supported-package? libcap)
+                                               libcap))))))
 
 (define privileged-program-service-type
   (service-type (name 'privileged-program)