From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp11.migadu.com ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms5.migadu.com with LMTPS id uEDJH5h72WKMZwAAbAwnHQ (envelope-from ) for ; Thu, 21 Jul 2022 18:15:20 +0200 Received: from aspmx1.migadu.com ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp11.migadu.com with LMTPS id 78bXH5h72WIP8wAA9RJhRA (envelope-from ) for ; Thu, 21 Jul 2022 18:15:20 +0200 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 32862E15A for ; Thu, 21 Jul 2022 18:15:20 +0200 (CEST) Received: from localhost ([::1]:55904 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1oEYpb-0003Eo-Bc for larch@yhetil.org; Thu, 21 Jul 2022 12:15:19 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:38856) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oEYlR-00067v-0v for guix-devel@gnu.org; Thu, 21 Jul 2022 12:11:01 -0400 Received: from jpoiret.xyz ([206.189.101.64]:42290) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oEYlP-0002Gu-5T for guix-devel@gnu.org; Thu, 21 Jul 2022 12:11:00 -0400 Received: from authenticated-user (jpoiret.xyz [206.189.101.64]) by jpoiret.xyz (Postfix) with ESMTPA id CCBEC185182; Thu, 21 Jul 2022 16:10:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jpoiret.xyz; s=dkim; t=1658419854; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=+D1H0rgOeR3wQgkvsVZlSmhjmvPdMcQLAJMJWhr2g4w=; b=NQOPqxuzjR03k8XDYVakRwPuj/oL8poaRob2TJdhcZWzymRXK6tleellVx0FCp/ojaKtZ8 hWHP8cRl32AB+eWiOnnVPUxiV8zyBq3w2N20d/F/HgOWW3SQUml6uYBFSi/9sprfwDXiuz a2wRDxSAy83O5nS4lfPiD59230sK0I02wvBXhhycVddhNYa4XdsXSKD9SIkfEACVRh029p 4QGhZIG0L7P+k2ADdcOLnCZ+I6QKx4N5ti81zO2pXZ4FAZSkzZQVd9tiah/pJ/y51RXs9L ueRof8VI0f3XlnIoNeyXyKS2d26h7eINhmRpFxVOq5fAmsGyil2BVXexL5QYlw== From: Josselin Poiret To: bokr@bokr.com Cc: Zhu Zihao , guix-devel@gnu.org Subject: Re: Building, packaging and updating Guix with confidence In-Reply-To: <20220717165219.GA19816@LionPure> References: <87let6roxo.fsf@jpoiret.xyz> <867d4pjedm.fsf@163.com> <87h73trnyu.fsf@jpoiret.xyz> <20220717165219.GA19816@LionPure> Date: Thu, 21 Jul 2022 18:10:53 +0200 Message-ID: <871quezbsi.fsf@jpoiret.xyz> MIME-Version: 1.0 Content-Type: text/plain X-Spamd-Bar: / Received-SPF: pass client-ip=206.189.101.64; envelope-from=dev@jpoiret.xyz; helo=jpoiret.xyz X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_SUSPICIOUS_NTLD=0.499, PDS_OTHER_BAD_TLD=1.997, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: guix-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+larch=yhetil.org@gnu.org Sender: "Guix-devel" X-Migadu-Flow: FLOW_IN X-Migadu-To: larch@yhetil.org X-Migadu-Country: US ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1658420120; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:in-reply-to:in-reply-to: references:references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:dkim-signature; bh=+D1H0rgOeR3wQgkvsVZlSmhjmvPdMcQLAJMJWhr2g4w=; b=NIF5Xl+eJ+7C0ORiCIgaLaan9Rclr5+xg15KC4CGqkg5T/v/7EvBwB2PIT/iRZVHpjlzTl Wjfbz1dZF3VUmR6akj3PNLDh3QlMM2KtpTWl6W0u0GBihOIV2Xwe0nEBT7I2fbPnE/MGKb SLn4ds+HzWqKR86twl1S7EboJBKTobfcHCTrrWjSSlHSL1mnMwy108WtBlNHr3w61fnSRu Xz6Oum87a4S04AlFnLR8BjNY/4iFADG/aVezvA1vUNKCGI55lYrDrWxIpttnjio4voUSm4 82guS+KoMcSrCdDAxiGSrgCRGq12t42dUTu6sgnEtaApnhVRjxB0+zUX3SCAvg== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1658420120; a=rsa-sha256; cv=none; b=EC2ZBjKVEe6OMaQNnpIq02QFxQAog25Jdr2b1rLVcLeZ4HxcWXfMxbMDs61bzwopt9VE6K dhHjMUWoXQojfkpcMyfThx3aSBMBLcUQ6tpUxRxUaUaU6W9sc1KtYluQZzJpDuqVxfgRbF bRc1TGzCJqjng0OKoiqL4PgjvXXkRVH7xhR2qXLHqhdfynXCnOvAuobOfJ1ZaIQd2qK9ci lB+A0niK6aRb/SHcUEnAqnpVqXNgsaaQEHycuVNeruBtJV0E3I2juDgKaFQqcbr65Tp2xu D1wvJsFpobrqD9849C/pDpsnQunLdiTvejxy3cX1LYmZsPyrp9+bfX3WJidaaw== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=pass header.d=jpoiret.xyz header.s=dkim header.b=NQOPqxuz; dmarc=pass (policy=reject) header.from=jpoiret.xyz; spf=pass (aspmx1.migadu.com: domain of "guix-devel-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-devel-bounces+larch=yhetil.org@gnu.org" X-Migadu-Spam-Score: -5.74 Authentication-Results: aspmx1.migadu.com; dkim=pass header.d=jpoiret.xyz header.s=dkim header.b=NQOPqxuz; dmarc=pass (policy=reject) header.from=jpoiret.xyz; spf=pass (aspmx1.migadu.com: domain of "guix-devel-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-devel-bounces+larch=yhetil.org@gnu.org" X-Migadu-Queue-Id: 32862E15A X-Spam-Score: -5.74 X-Migadu-Scanner: scn0.migadu.com X-TUID: Qy4gzO4GZkC6 Hello, bokr@bokr.com writes: > Naively: > > Why does "the" guix daemon per se need root access at all? The main thing is that all files in the store end up being written by the guix daemon user. So if we want the files to be easily substitutable, they'd need to have a fixed uid/gid, and the only one we can guarantee is root. Other than that, it needs to use a bunch of Linux namespaces to isolate the builds from the rest of the system, which depending on the kernel build-time configuration might not be possible when unprivileged. Best, -- Josselin Poiret