From mboxrd@z Thu Jan 1 00:00:00 1970 From: Florian Thevissen Subject: bug#34494: proot-based non-root setup: refusing to run with elevated privileges (UID 0) Date: Sat, 16 Feb 2019 11:07:42 +0100 Message-ID: References: <81415b97-6e02-33dc-a4da-b1b046d5a4e7@florian-thevissen.de> <20190216063452.xllpdkhz4lc4jz4q@thebird.nl> <0d4fc2ca-da74-dbb4-7e7d-df090b19a19f@florian-thevissen.de> <20190216091747.eb6g7znptifbqqbt@thebird.nl> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="------------E1817396E343EF5C6AD4E5A4" Return-path: Received: from eggs.gnu.org ([209.51.188.92]:40458) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1guwu9-0007w7-U2 for bug-guix@gnu.org; Sat, 16 Feb 2019 05:09:07 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1guwu8-0003OL-4D for bug-guix@gnu.org; Sat, 16 Feb 2019 05:09:05 -0500 Received: from debbugs.gnu.org ([209.51.188.43]:50721) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1guwu6-0003Nn-Pf for bug-guix@gnu.org; Sat, 16 Feb 2019 05:09:04 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1guwu6-0006po-K6 for bug-guix@gnu.org; Sat, 16 Feb 2019 05:09:02 -0500 Sender: "Debbugs-submit" Resent-Message-ID: Received: from eggs.gnu.org ([209.51.188.92]:40388) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1guwtN-0007se-UH for bug-Guix@gnu.org; Sat, 16 Feb 2019 05:08:19 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1guwtM-0002pb-AK for bug-Guix@gnu.org; Sat, 16 Feb 2019 05:08:17 -0500 In-Reply-To: <20190216091747.eb6g7znptifbqqbt@thebird.nl> Content-Language: en-US List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org Sender: "bug-Guix" To: Pjotr Prins Cc: bug-Guix@gnu.org This is a multi-part message in MIME format. --------------E1817396E343EF5C6AD4E5A4 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable Thanks, Pjotr. So I got it working on one system out of four, following the exact same=20 steps each time: * Debian 9 (Stretch) - 4.9.130-2 x86_64 (real system) - *_fail_* * Ubuntu 17.10 (Artful Aardvark) - 4.13.0-46-lowlatency (real system) =C2=A0=C2=A0=C2=A0=C2=A0 - _*fail*_ * Ubuntu 14.04 (Trusty Tahr)=C2=A0 - 4.4.0-31-generic - _*fail*_ * Debian 9 (Stretch) - 4.9.0-8-amd64 (VM) =C2=A0=C2=A0 - _*works*_ I don't know what the significant differentiating factor could be, that=20 lets guix behave correctly on that one debian system but not on the other= s. But what I also noticed, is that the "list of substitutes" is also not=20 being updated on the three failing systems. Is the update process using=20 the download script internally, maybe, and that silently fails? Or maybe=20 this hints at another problem? I fear there's nothing more I can immediately do. @Ludo - can you help? On 16/02/19 10:17, Pjotr Prins wrote: > Sorry about that. > > If you get it to work, do update the document - or me by E-mail. Maybe > Ludo has something to say about this. > > Pj. > > On Sat, Feb 16, 2019 at 10:04:03AM +0100, Florian Thevissen wrote: >> Hi pjotr, >> >> Did you try something like >> >> proot -0 -b /proc -b /dev -b /etc -r . -b etc_guix/acl:/etc/guix= /acl >> gnu/store/vir3l..-guix-0.x/bin/guix-daemon =E2=80=94disable-chro= ot >> >> Yes, this doesn=E2=80=99t work - with or without the -0 flag. >> >> That used to work. But maybe no longer? >> >> I tried the new guix binaries (0.16.0), and the ones that were rec= ent >> when you wrote the guide (0.13.0), and proot has not, if I see >> correctly, significantly changed since then (v.5.1.0). >> >> To me, this looks as if the setup on my particular system had some= thing >> special to it that would lead guix to not behave correctly. Here=E2= =80=99s a >> #guix chat-log, where Saone (at 00:25:29) comes to the same conclu= sion: >> [1]https://gnunet.org/bot/log/guix/2017-09-21 . >> For the record - this happens on an Debian 4.9.130-2 x86_64 system= . >> I'll try this out on other systems/VMs today... >> >> On 16/02/19 07:34, Pjotr Prins wrote: >> >> Did you try something like >> >> proot -0 -b /proc -b /dev -b /etc -r . -b etc_guix/acl:/etc/guix/acl g= nu/store/v >> ir3l..-guix-0.x/bin/guix-daemon --disable-chroot >> >> (note the extra -0 and chroot switches) and you should see on a guix p= ackage ins >> tall. >> >> That used to work. But maybe no longer? >> >> On Fri, Feb 15, 2019 at 09:39:21PM +0100, Florian Thevissen wrote: >> >> Hi, >> >> I am trying to get guix to run on a system where I do not have roo= t >> access, following a guide by pjotrp involving proot, here: >> [1][2]https://github.com/pjotrp/guix-notes/blob/master/GUIX-NO-ROO= T.org . >> >> All guix operations that involve the script perform-download fail = with >> the error: >> >> guix perform-download: error: refusing to run with elevated >> privileges (UID 0) >> >> I am not sure if this hints at a bug in guix itself, but a comment= in >> the guix sources lets me assume so. It says in >> package-management.scm:355 >> >> =E2=80=9CNote that scripts like =E2=80=98guix perform-download=E2= =80=99 do not run as root >> (=E2=80=A6)=E2=80=9D >> >> In my setup, following this guide, however, it apparently is run a= s >> root, and (assert-low-privileges) in the script perform-download.s= cm:89 >> acts accordingly by signalling the error and exiting. >> >> (By the way - running guix-daemon with proot root privileges fails >> (-0), and running it without (no -0) fails also.) >> >> Now my question: why is perform-download run as root following pjo= trs >> guide, and is there anything that can be done about it? >> >> I am a bit at a loss here, being unfamiliar with the guix sources = and >> overall system setup. >> >> Looking forward to help, thanks, >> >> Florian >> =E2=80=8B >> >> References >> >> 1. [3]https://github.com/pjotrp/guix-notes/blob/master/GUIX-NO-ROO= T.org >> >> =E2=80=8B >> >> References >> >> 1. https://gnunet.org/bot/log/guix/2017-09-21 >> 2. https://github.com/pjotrp/guix-notes/blob/master/GUIX-NO-ROOT.o= rg >> 3. https://github.com/pjotrp/guix-notes/blob/master/GUIX-NO-ROOT.o= rg --------------E1817396E343EF5C6AD4E5A4 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Thanks, Pjotr.

So I got it working on one system out of four, following the exact same steps each time:

  • Debian 9 (Stretch) - 4.9.130-2 x86_64 (real system) - fai= l
  • Ubuntu 17.10 (Artful Aardvark) - 4.13.0-46-lowlatency (real system) =C2=A0=C2=A0=C2=A0=C2=A0 - fail
  • Ubuntu 14.04 (Trusty Tahr)=C2=A0 - 4.4.0-31-generic -=C2=A0 = fail
  • Debian 9 (Stretch) - 4.9.0-8-amd64 (VM) =C2=A0=C2=A0 -=C2=A0 works

I don't know what the significant differentiating factor could be, that lets guix behave correctly on that one debian system but not on the others.

But what I also noticed, is that the "list of substitutes" is also not being updated on the three failing systems. Is the update process using the download script internally, maybe, and that silently fails? Or maybe this hints at another problem?

I fear there's nothing more I can immediately do. @Ludo - can you help?



On 16/02/19 10:17, Pjotr Prins wrote:<= br> 
Sorry about that.

If you get it to work, do update the document - or me by E-mail. Maybe
Ludo has something to say about this.

Pj.

On Sat, Feb 16, 2019 at 10:04:03AM +0100, Florian Thevissen wrote:

   Hi pjotr,

     Did you try something like

     proot -0 -b /proc -b /dev -b /etc -r . -b etc_guix/acl:/etc/guix/acl
     gnu/store/vir3l..-guix-0.x/bin/guix-daemon =E2=80=94disable-chroot

   Yes, this doesn=E2=80=99t work - with or without the -0 flag.

     That used to work. But maybe no longer?

   I tried the new guix binaries (0.16.0), and the ones that were recent
   when you wrote the guide (0.13.0), and proot has not, if I see
   correctly, significantly changed since then (v.5.1.0).

   To me, this looks as if the setup on my particular system had somethin=
g
   special to it that would lead guix to not behave correctly. Here=E2=80=
=99s a
   #guix chat-log, where Saone (at 00:25:29) comes to the same conclusion=
:
   [1]https://gnunet.org/bot/log/guix/2017-09-21 .
   For the record - this happens on an Debian 4.9.130-2 x86_64 system.
   I'll try this out on other systems/VMs today...

   On 16/02/19 07:34, Pjotr Prins wrote:

Did you try something like

proot -0 -b /proc -b /dev -b /etc -r . -b etc_guix/acl:/etc/guix/acl gnu/=
store/v
ir3l..-guix-0.x/bin/guix-daemon --disable-chroot

(note the extra -0 and chroot switches) and you should see on a guix pack=
age ins
tall.

That used to work. But maybe no longer?

On Fri, Feb 15, 2019 at 09:39:21PM +0100, Florian Thevissen wrote:

   Hi,

   I am trying to get guix to run on a system where I do not have root
   access, following a guide by pjotrp involving proot, here:
   [1][2]https://github.com/pjotrp/g=
uix-notes/blob/master/GUIX-NO-ROOT.org .

   All guix operations that involve the script perform-download fail with
   the error:

     guix perform-download: error: refusing to run with elevated
     privileges (UID 0)

   I am not sure if this hints at a bug in guix itself, but a comment in
   the guix sources lets me assume so. It says in
   package-management.scm:355

     =E2=80=9CNote that scripts like =E2=80=98guix perform-download=E2=80=
=99 do not run as root
     (=E2=80=A6)=E2=80=9D

   In my setup, following this guide, however, it apparently is run as
   root, and (assert-low-privileges) in the script perform-download.scm:8=
9
   acts accordingly by signalling the error and exiting.

   (By the way - running guix-daemon with proot root privileges fails
   (-0), and running it without (no -0) fails also.)

   Now my question: why is perform-download run as root following pjotrs
   guide, and is there anything that can be done about it?

   I am a bit at a loss here, being unfamiliar with the guix sources and
   overall system setup.

   Looking forward to help, thanks,

   Florian
   =E2=80=8B

References

   1. [3]https://github.com/pjotrp/g=
uix-notes/blob/master/GUIX-NO-ROOT.org

   =E2=80=8B

References

   1. https://gnunet.org/bot/log/guix/2017-09-21
   2. https://github.com/pjotrp/guix=
-notes/blob/master/GUIX-NO-ROOT.org
   3. https://github.com/pjotrp/guix=
-notes/blob/master/GUIX-NO-ROOT.org

--------------E1817396E343EF5C6AD4E5A4--