Enabling PAM support or not only..

[muradm <mail@muradm.net>]

[-- Attachment #1: Type: text/plain, Size: 2659 bytes --]


Hi,

Last week was quite challenging and frustraiting, culminated by
sleepless nights in the weekend. Among other things at least
two serivces was broken, which are cups-service-type and
swaylock with screen-locker-service-type. Both issues are not
easy troubleshootable due to nature of PAM.


cups-service-type:

core-updates merging commit 3bacd3c76a added linux-pam to cups
package. Resulting in https://issues.guix.gnu.org/issue/63198.
While switching cups-service-type's default package from cups
to cups-minimal solves authentication issue, it however
broke ipptool printer finder tool. When PAM support is
compiled in, it does not work without proper PAM entry.

While workaround could be as simple as:

--8<---------------cut here---------------start------------->8---
+(simple-service
+ 'cups-pam-service
+ pam-root-service-type
+ (list (unix-pam-service "cups" #:allow-empty-passwords? #f)))
--8<---------------cut here---------------end--------------->8---

Total solution could be:
https://issues.guix.gnu.org/issue/63198#4


swaylock with screen-locker-service-type:

commit 146bae3979 added linux-pam to swaylock package. Resulting
in https://issues.guix.gnu.org/issue/63357#2.

While workaround could be as simple as:

--8<---------------cut here---------------start------------->8---
-(service screen-locker-service-type
-         (screen-locker-configuration
-          "swaylock" (file-append swaylock "/bin/swaylock") 
           #f)))))
+(simple-service
+ 'cups-pam-service
+ pam-root-service-type
+ (list (unix-pam-service "cups" #:allow-empty-passwords? #f)))
--8<---------------cut here---------------end--------------->8---

Detailed explanation with total solution is provided in
https://issues.guix.gnu.org/issue/63652.


The following coming afterwards to my mind:

GUIX at first is package manager, so there are a lot of them,
but of two types:
  - BOUND - ones referenced from (gnu system) (gnu services)
  - FREE-STANDING - ones not referenced

Then for BOUND packages, changing their behavior requires
more careful handling and probably such change is always
news worthy.

And for FREE-STANDING packages, changing their behavior is
totaly up to maintainers of packages and their users, not
much could be done here.

Having said that, we could go further with something like:

guix package --list-available-bound[=...]

This would be different from things likes "installed" or
illustrated on the graph of running system. The point here
is to know the packages that are referenced/used by GUIX
it self, not only as package manager.

When that available, careful handling and news worthines
could be automated probably.


muradm

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]