From: Ricardo Wurmus <rekado@elephly.net>
To: Pjotr Prins <pjotr.public12@thebird.nl>
Cc: guix-devel@gnu.org, Ricardo Wurmus <ricardo.wurmus@mdc-berlin.de>
Subject: Re: [RFC] A simple draft for channels
Date: Tue, 23 Jan 2018 07:38:46 +0100 [thread overview]
Message-ID: <87vaftyt8v.fsf@elephly.net> (raw)
In-Reply-To: <20180119135658.GA5944@thebird.nl>
Hi Pjotr,
> On Fri, Jan 19, 2018 at 02:41:42PM +0100, Ludovic Courtès wrote:
>> Authorizing keys is necessarily limited to root since the store is
>> shared among all users of the machine. I don’t see any way around that
>
> Well, the daemon could update itself with its own privileges.
I think Ludo’s point is that this is a security issue, not a technical
limitation.
> How
> about maintaining authentication for a channel at runtime in RAM. When
> the daemon restarts it is lost. The channel will not be shared with
> other users. So every user maintains their own channels. When a
> channel reconnects it authenticates itself again.
It all ends up in the store though and is thus available to everybody.
> There really is no reason to share individual channels between users
> (other then their outputs).
Yes, channel configuration and state is kept in the user’s home
directory. But authorization for downloading and installing substitutes
in /gnu/store currently still falls to root.
--
Ricardo
GPG: BCA6 89B6 3655 3801 C3C6 2150 197A 5888 235F ACAC
https://elephly.net
next prev parent reply other threads:[~2018-01-23 6:39 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-19 8:24 [RFC] A simple draft for channels Ricardo Wurmus
2018-01-19 8:55 ` Jelle Licht
2018-01-19 11:30 ` Pjotr Prins
2018-01-19 13:41 ` Ludovic Courtès
2018-01-19 13:56 ` Pjotr Prins
2018-01-23 6:38 ` Ricardo Wurmus [this message]
2018-01-23 8:54 ` Pjotr Prins
2018-01-23 23:01 ` Carlo Zancanaro
2018-01-23 16:03 ` myglc2
2018-01-23 16:50 ` ng0
2018-01-24 5:44 ` myglc2
2018-01-24 12:33 ` ng0
2018-01-24 15:04 ` Konrad Hinsen
2018-01-23 20:39 ` Ricardo Wurmus
2018-01-23 20:37 ` Ricardo Wurmus
2018-01-24 12:01 ` Pjotr Prins
2018-01-20 5:45 ` 宋文武
2018-01-24 14:08 ` Ludovic Courtès
2018-01-24 17:55 ` myglc2
2018-01-24 18:20 ` Ricardo Wurmus
2018-01-26 17:23 ` myglc2
2018-01-26 18:53 ` Oleg Pykhalov
2018-03-19 12:46 ` ng0
2018-01-27 12:10 ` Chris Marusich
2018-03-19 12:04 ` [Orchestration][RFC] " Pjotr Prins
2018-03-19 12:36 ` ng0
2018-03-19 18:21 ` myglc2
2018-03-19 18:31 ` Pjotr Prins
2018-03-19 20:18 ` myglc2
2018-03-19 20:29 ` Pjotr Prins
2018-03-20 7:02 ` Pjotr Prins
2018-03-20 10:41 ` Ricardo Wurmus
2018-03-20 13:10 ` Pjotr Prins
2018-03-20 13:41 ` Ricardo Wurmus
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87vaftyt8v.fsf@elephly.net \
--to=rekado@elephly.net \
--cc=guix-devel@gnu.org \
--cc=pjotr.public12@thebird.nl \
--cc=ricardo.wurmus@mdc-berlin.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).