From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Subject: bug#35996: User account password got locked when booting old generation Date: Tue, 04 Jun 2019 23:21:05 +0200 Message-ID: <87o93d6o8u.fsf@gnu.org> References: <20190602070545.xp2pqlnzsthpjtbw@pelzflorian.localdomain> <87sgss9vj7.fsf@gnu.org> <20190602102122.bzapwt36vg32nmwq@pelzflorian.localdomain> <87o93g9dv5.fsf@gnu.org> <20190603060301.2nu2zqi5j3v3j5ki@pelzflorian.localdomain> <87tvd6erbo.fsf@gnu.org> <20190603145209.ub7663zp7yh7n7i4@pelzflorian.localdomain> <87d0jtemca.fsf@gnu.org> <20190604121710.uqni7cwp5jo4pwmq@pelzflorian.localdomain> <20190604141217.7tq33idseebne5v2@pelzflorian.localdomain> <20190604171715.gvwr54wiek4xs24e@pelzflorian.localdomain> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="=-=-=" Return-path: Received: from eggs.gnu.org ([209.51.188.92]:47993) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hYGsd-00008n-VW for bug-guix@gnu.org; Tue, 04 Jun 2019 17:22:05 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hYGsc-0002He-QQ for bug-guix@gnu.org; Tue, 04 Jun 2019 17:22:03 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:60586) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1hYGsc-0002HV-N1 for bug-guix@gnu.org; Tue, 04 Jun 2019 17:22:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1hYGsc-0006VR-GT for bug-guix@gnu.org; Tue, 04 Jun 2019 17:22:02 -0400 Sender: "Debbugs-submit" Resent-Message-ID: In-Reply-To: <20190604171715.gvwr54wiek4xs24e@pelzflorian.localdomain> (pelzflorian@pelzflorian.de's message of "Tue, 4 Jun 2019 19:17:15 +0200") List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org Sender: "bug-Guix" To: "pelzflorian (Florian Pelz)" Cc: 35996@debbugs.gnu.org --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi, "pelzflorian (Florian Pelz)" skribis: > I got a locked /etc/shadow again now despite Ludovic=E2=80=99s patches (w= hich > would nonetheless give me a better feeling when pushed). Will do. :-) > When booting an unbootable generation with Ludovic=E2=80=99s patches and = then > rebooting a normal generation with Ludovic=E2=80=99s patches, /etc/shadow= is > locked. So with this scenario, the problem is 100% reproducible, right? > Note that I get a message like =E2=80=9C/dev/mapper/Guix: recovering jour= nal=E2=80=9D > when booting (I did not pay attention to that before). I shut down > the unbootable generation with Ctrl+Alt+Del. When I normally shut > down with Ctrl+Alt+Del I get no such message. Indeed, =E2=80=98shepherd=E2=80=99 calls =E2=80=98disable-reboot-on-ctrl-al= t-del=E2=80=99 (which disables =E2=80=9Chard=E2=80=9D reboots upon ctrl-alt-del and instead notif= ies it) after it has loaded its config file. In your case, loading the config file never completes because the =E2=80=98start=E2=80=99 method is called from the config file for every ser= vice, and one of them, udev, never starts. Thus, when you press Ctrl-Alt-Del, you perform a hard reboot. The hard reboot happens after Guix has written to /etc/shadow. One possibility is that changes to this file haven=E2=80=99t been flushed to di= sk. Thus, on the next boot, we start off with an empty or truncated /etc/shadow, leading the activation snippet to initialize passwords. If that theory holds, the patch below (on top of the others) should help. Could you give it a try? Actually, the fact that =E2=80=98rename-file=E2=80=99 was called *before* = =E2=80=98close-port=E2=80=99 could be problematic in itself; so perhaps, even without the =E2=80=98fdata= sync=E2=80=99 call, we=E2=80=99d get better results=E2=80=A6 especially since =E2=80=98f= datasync=E2=80=99 won=E2=80=99t be available in the initrd anyway, hmm=E2=80=A6 Thanks, Ludo=E2=80=99. --=-=-= Content-Type: text/x-patch Content-Disposition: inline diff --git a/gnu/build/accounts.scm b/gnu/build/accounts.scm index 8687446aa6..c13e6f2e89 100644 --- a/gnu/build/accounts.scm +++ b/gnu/build/accounts.scm @@ -19,6 +19,7 @@ (define-module (gnu build accounts) #:use-module (guix records) #:use-module (guix combinators) + #:use-module ((guix build syscalls) #:select (fdatasync)) #:use-module (gnu system accounts) #:use-module (srfi srfi-1) #:use-module (srfi srfi-11) @@ -230,6 +231,14 @@ each field." ;; grab this lock with 'with-file-lock' when they access the databases. "/etc/.pwd.lock") +(define-syntax-rule (catch-ENOSYS exp) + (catch 'system-error + (lambda () exp) + (lambda args + (if (= ENOSYS (system-error-errno args)) + #f + (apply throw args))))) + (define (database-writer file mode entry->string) (lambda* (entries #:optional (file-or-port file)) "Write ENTRIES to FILE-OR-PORT. When FILE-OR-PORT is a file name, write @@ -249,9 +258,12 @@ to it atomically and set the appropriate permissions." (lambda () (chmod port mode) (write-entries port) - (rename-file template file-or-port)) - (lambda () + (catch-ENOSYS (fdatasync port)) (close-port port) + (rename-file template file-or-port)) + (lambda () + (unless (port-closed? port) + (close-port port)) (when (file-exists? template) (delete-file template)))))))) --=-=-=--