Enabling PAM support or not only..

Enabling PAM support or not only..

[muradm]

[-- Attachment #1: Type: text/plain, Size: 2659 bytes --]


Hi,

Last week was quite challenging and frustraiting, culminated by
sleepless nights in the weekend. Among other things at least
two serivces was broken, which are cups-service-type and
swaylock with screen-locker-service-type. Both issues are not
easy troubleshootable due to nature of PAM.


cups-service-type:

core-updates merging commit 3bacd3c76a added linux-pam to cups
package. Resulting in https://issues.guix.gnu.org/issue/63198.
While switching cups-service-type's default package from cups
to cups-minimal solves authentication issue, it however
broke ipptool printer finder tool. When PAM support is
compiled in, it does not work without proper PAM entry.

While workaround could be as simple as:

--8<---------------cut here---------------start------------->8---
+(simple-service
+ 'cups-pam-service
+ pam-root-service-type
+ (list (unix-pam-service "cups" #:allow-empty-passwords? #f)))
--8<---------------cut here---------------end--------------->8---

Total solution could be:
https://issues.guix.gnu.org/issue/63198#4


swaylock with screen-locker-service-type:

commit 146bae3979 added linux-pam to swaylock package. Resulting
in https://issues.guix.gnu.org/issue/63357#2.

While workaround could be as simple as:

--8<---------------cut here---------------start------------->8---
-(service screen-locker-service-type
-         (screen-locker-configuration
-          "swaylock" (file-append swaylock "/bin/swaylock") 
           #f)))))
+(simple-service
+ 'cups-pam-service
+ pam-root-service-type
+ (list (unix-pam-service "cups" #:allow-empty-passwords? #f)))
--8<---------------cut here---------------end--------------->8---

Detailed explanation with total solution is provided in
https://issues.guix.gnu.org/issue/63652.


The following coming afterwards to my mind:

GUIX at first is package manager, so there are a lot of them,
but of two types:
  - BOUND - ones referenced from (gnu system) (gnu services)
  - FREE-STANDING - ones not referenced

Then for BOUND packages, changing their behavior requires
more careful handling and probably such change is always
news worthy.

And for FREE-STANDING packages, changing their behavior is
totaly up to maintainers of packages and their users, not
much could be done here.

Having said that, we could go further with something like:

guix package --list-available-bound[=...]

This would be different from things likes "installed" or
illustrated on the graph of running system. The point here
is to know the packages that are referenced/used by GUIX
it self, not only as package manager.

When that available, careful handling and news worthines
could be automated probably.


muradm

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: Enabling PAM support or not only..

[Maxim Cournoyer]

Hi Muradm,

muradm <mail@muradm.net> writes:

[...]

> core-updates merging commit 3bacd3c76a added linux-pam to cups
> package. Resulting in https://issues.guix.gnu.org/issue/63198.
> While switching cups-service-type's default package from cups
> to cups-minimal solves authentication issue, it however
> broke ipptool printer finder tool. When PAM support is
> compiled in, it does not work without proper PAM entry.
>
> While workaround could be as simple as:
>
> +(simple-service
> + 'cups-pam-service
> + pam-root-service-type
> + (list (unix-pam-service "cups" #:allow-empty-passwords? #f)))
>
>
> Total solution could be:
> https://issues.guix.gnu.org/issue/63198#4

Now applied, thanks.

>
> swaylock with screen-locker-service-type:
>
> commit 146bae3979 added linux-pam to swaylock package. Resulting
> in https://issues.guix.gnu.org/issue/63357#2.
>
> While workaround could be as simple as:
>
> -(service screen-locker-service-type
> -         (screen-locker-configuration
> -          "swaylock" (file-append swaylock "/bin/swaylock") 
>            #f)))))
> +(simple-service
> + 'cups-pam-service
> + pam-root-service-type
> + (list (unix-pam-service "cups" #:allow-empty-passwords? #f)))
>
> Detailed explanation with total solution is provided in
> https://issues.guix.gnu.org/issue/63652.
>
>
> The following coming afterwards to my mind:
>
> GUIX at first is package manager, so there are a lot of them,
> but of two types:
>   - BOUND - ones referenced from (gnu system) (gnu services)
>   - FREE-STANDING - ones not referenced

I don't know about swaylock, but for CUPS, the change was strictly
required; you can't build the full CUPS without PAM anymore, I think.  I
had tried as a possible solution to the PAM problems.

So the distinction between bound and free-standing in this context is
not very useful (when the changes are forced by upstream rather than
chosen by the contributors).  What would be useful though is increasing
our test coverage to catch these issues.

-- 
Thanks,
Maxim