[PATCH v2 1/7] guix: git: Support shallow git clones if a tag is available

[PATCH v2 1/7] guix: git: Support shallow git clones if a tag is available

[Andy Wingo]

* guix/build/git.scm (git-fetch): Instead of cloning the remote repo, use the
  lower-level "init" / "fetch" / "checkout" operations.  This lets us make a
  shallow checkout if we are checking out a tag.

* guix/git-download.scm (<git-reference>): Add tag field.
  (git-fetch): Support git references with tags but no commits.
---
 guix/build/git.scm    | 58 ++++++++++++++++++++++++++++++++++-----------------
 guix/git-download.scm | 10 +++++++--
 2 files changed, 47 insertions(+), 21 deletions(-)

diff --git a/guix/build/git.scm b/guix/build/git.scm
index 121f07a..1af547f 100644
--- a/guix/build/git.scm
+++ b/guix/build/git.scm
@@ -28,32 +28,52 @@
 ;;; Code:
 
 (define* (git-fetch url commit directory
-                    #:key (git-command "git") recursive?)
+                    #:key tag (git-command "git") recursive?)
   "Fetch COMMIT from URL into DIRECTORY.  COMMIT must be a valid Git commit
 identifier.  When RECURSIVE? is true, all the sub-modules of URL are fetched,
 recursively.  Return #t on success, #f otherwise."
-
   ;; Disable TLS certificate verification.  The hash of the checkout is known
   ;; in advance anyway.
   (setenv "GIT_SSL_NO_VERIFY" "true")
 
-  (let ((args `("clone" ,@(if recursive? '("--recursive") '())
-                ,url ,directory)))
-    (and (zero? (apply system* git-command args))
-         (with-directory-excursion directory
-           (system* git-command "tag" "-l")
-           (and (zero? (system* git-command "checkout" commit))
-                (begin
-                  ;; The contents of '.git' vary as a function of the current
-                  ;; status of the Git repo.  Since we want a fixed output, this
-                  ;; directory needs to be taken out.
-                  (delete-file-recursively ".git")
+  (mkdir directory)
+  (with-directory-excursion directory
+    (and (zero? (system* git-command "init"))
+         (zero? (system* git-command "remote" "add" "origin" url))
+         (cond
+          ;; If there's a tag, do a shallow fetch.  Otherwise we do a full
+          ;; fetch.
+          (tag
+           (and (zero? (system* git-command "fetch" "--depth=1" "origin" tag))
+                ;; Either there is no commit specified, in which case we are
+                ;; good, or there is a commit and it is the same as the tag,
+                ;; in which case we're still good, or there's a commit and
+                ;; it's under the tag so we have to unshallow the checkout and
+                ;; try again.
+                (if commit
+                    (or (zero? (system* git-command "checkout" commit))
+                        (and (zero? (system* git-command "fetch" "--unshallow"))
+                             (zero? (system* git-command "checkout" commit))))
+                    (zero? (system* git-command "checkout" "FETCH_HEAD")))))
+          (else
+           ;; Fall back to a full fetch.  In that case print available tags.
+           (and (zero? (system* git-command "fetch" "origin"))
+                (zero? (system* git-command "tag" "-l"))
+                (zero? (system* git-command "checkout" commit)))))
+         (or (not recursive?)
+             (zero? (system* git-command
+                             "submodule" "update" "--init" "--recursive")))
+         (begin
+           ;; The contents of '.git' vary as a function of the current
+           ;; status of the Git repo.  Since we want a fixed output, this
+           ;; directory needs to be taken out.
+           (delete-file-recursively ".git")
 
-                  (when recursive?
-                    ;; In sub-modules, '.git' is a flat file, not a directory,
-                    ;; so we can use 'find-files' here.
-                    (for-each delete-file-recursively
-                              (find-files directory "^\\.git$")))
-                  #t))))))
+           (when recursive?
+             ;; In sub-modules, '.git' is a flat file, not a directory,
+             ;; so we can use 'find-files' here.
+             (for-each delete-file-recursively
+                       (find-files directory "^\\.git$")))
+           #t))))
 
 ;;; git.scm ends here
diff --git a/guix/git-download.scm b/guix/git-download.scm
index 0f2218c..43bc466 100644
--- a/guix/git-download.scm
+++ b/guix/git-download.scm
@@ -28,6 +28,7 @@
             git-reference?
             git-reference-url
             git-reference-commit
+            git-reference-tag
             git-reference-recursive?
 
             git-fetch))
@@ -44,7 +45,8 @@
   git-reference make-git-reference
   git-reference?
   (url        git-reference-url)
-  (commit     git-reference-commit)
+  (commit     git-reference-commit (default #f))
+  (tag        git-reference-tag (default #f))
   (recursive? git-reference-recursive?   ; whether to recurse into sub-modules
               (default #f)))
 
@@ -81,8 +83,12 @@ HASH-ALGO (a symbol).  Use NAME as the file name, or a generic name if #f."
                                           dirs)))
 
         (git-fetch '#$(git-reference-url ref)
-                   '#$(git-reference-commit ref)
+                   (or '#$(git-reference-commit ref)
+                       '#$(git-reference-tag ref))
                    #$output
+                   ;; FIXME: Pass #:tag when fixed daemons are widely
+                   ;; deployed.
+                   ;; #:tag '#$(git-reference-tag ref)
                    #:recursive? '#$(git-reference-recursive? ref)
                    #:git-command (string-append #+git "/bin/git"))))
 
-- 
2.4.3

[PATCH v2 2/7] gnu: elogind: Update to version 219.5.

[Andy Wingo]

* gnu/packages/freedesktop.scm (elogind): Update to 219.5.
---
 gnu/packages/freedesktop.scm | 110 +++++++++++++++++++++----------------------
 1 file changed, 54 insertions(+), 56 deletions(-)

diff --git a/gnu/packages/freedesktop.scm b/gnu/packages/freedesktop.scm
index cbf26dc..7413456 100644
--- a/gnu/packages/freedesktop.scm
+++ b/gnu/packages/freedesktop.scm
@@ -130,65 +130,63 @@ the freedesktop.org XDG Base Directory specification.")
     (license license:expat)))
 
 (define-public elogind
-  (let ((commit "14405a9"))
-    (package
-      (name "elogind")
-      (version (string-append "219." commit))
-      (source (origin
-                (method git-fetch)
-                (uri (git-reference
-                      (url "http://git.elephly.net/software/elogind.git")
-                      (commit commit)))
-                (sha256
-                 (base32
-                  "1wz5lxj95qg64x2q5hf4zcb35hpxlw3wfswx6sb2srvsg50y3y72"))
-                (file-name (string-append name "-checkout-" commit))
-                (modules '((guix build utils)))
-                (snippet
-                 '(begin
-                    (use-modules (guix build utils))
-                    (substitute* "Makefile.am"
-                      ;; Avoid validation against DTD because the DTDs for
-                      ;; both doctype 4.2 and 4.5 are needed.
-                      (("XSLTPROC_FLAGS = ") "XSLTPROC_FLAGS = --novalid"))))))
-      (build-system gnu-build-system)
-      (arguments
-       `(#:configure-flags
-         (list
-          ;; pam_elogind fails because of bus-error.c hackery
-          "--disable-pam"
-          (string-append "--with-rootprefix=" (assoc-ref %outputs "out")))
-         #:phases
-         (modify-phases %standard-phases
-           (add-after 'unpack 'autogen
-                      (lambda _
-                        (and (zero? (system* "intltoolize" "--force" "--automake"))
-                             (zero? (system* "autoreconf" "-vif"))))))))
-      (native-inputs
-       `(("intltool" ,intltool)
-         ("gettext" ,gnu-gettext)
-         ("docbook-xsl" ,docbook-xsl)
-         ("docbook-xml" ,docbook-xml)
-         ("xsltproc" ,libxslt)
-         ("libxml2" ,libxml2)                     ;for XML_CATALOG_FILES
-         ("pkg-config", pkg-config)
-         ("autoconf" ,autoconf)
-         ("automake" ,automake)
-         ("libtool" ,libtool)
-         ("gperf" ,gperf)))
-      (inputs
-       `(("linux-pam" ,linux-pam)
-         ("linux-libre-headers" ,linux-libre-headers)
-         ("libcap" ,libcap)
-         ("dbus" ,dbus)
-         ("eudev" ,eudev)))
-      (home-page "https://github.com/andywingo/elogind")
-      (synopsis "User, seat, and session management service")
-      (description "Elogind is the systemd project's \"logind\" service,
+  (package
+    (name "elogind")
+    (version "219.5")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/andywingo/elogind")
+                    (tag (string-append "v" version))))
+              (sha256
+               (base32
+                "09ipra2q6gsdll3356jcb1yx2za9p4qab5qfk9g2z40msvb93hs5"))
+              (file-name (string-append name "-checkout-" version))
+              (modules '((guix build utils)))
+              (snippet
+               '(begin
+                  (use-modules (guix build utils))
+                  (substitute* "Makefile.am"
+                    ;; Avoid validation against DTD because the DTDs for
+                    ;; both doctype 4.2 and 4.5 are needed.
+                    (("XSLTPROC_FLAGS = ") "XSLTPROC_FLAGS = --novalid"))))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:configure-flags
+       (list (string-append "--with-udevrulesdir="
+                            (assoc-ref %outputs "out")
+                            "/lib/udev/rules.d"))
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'autogen
+                    (lambda _
+                      (and (zero? (system* "intltoolize" "--force" "--automake"))
+                           (zero? (system* "autoreconf" "-vif"))))))))
+    (native-inputs
+     `(("intltool" ,intltool)
+       ("gettext" ,gnu-gettext)
+       ("docbook-xsl" ,docbook-xsl)
+       ("docbook-xml" ,docbook-xml)
+       ("xsltproc" ,libxslt)
+       ("libxml2" ,libxml2)                     ;for XML_CATALOG_FILES
+       ("pkg-config", pkg-config)
+       ("autoconf" ,autoconf)
+       ("automake" ,automake)
+       ("libtool" ,libtool)
+       ("gperf" ,gperf)))
+    (inputs
+     `(("linux-pam" ,linux-pam)
+       ("linux-libre-headers" ,linux-libre-headers)
+       ("libcap" ,libcap)
+       ("dbus" ,dbus)
+       ("eudev" ,eudev)))
+    (home-page "https://github.com/andywingo/elogind")
+    (synopsis "User, seat, and session management service")
+    (description "Elogind is the systemd project's \"logind\" service,
 extracted out as a separate project.  Elogind integrates with PAM to provide
 the org.freedesktop.login1 interface over the system bus, allowing other parts
 of a the system to know what users are logged in, and where.")
-      (license license:lgpl2.1+))))
+    (license license:lgpl2.1+)))
 
 (define-public python-pyxdg
   (package
-- 
2.4.3

[PATCH v2 3/7] gnu: Allow OS configurations to add PAM session modules

[Andy Wingo]

* gnu/services/base.scm (mingetty-service):
* gnu/services/xorg.scm (slim-service):
* gnu/services/ssh.scm (lsh-service):
* gnu/system/linux.scm (unix-pam-service, base-pam-services): Add
  #:additional-session-modules keyword argument.
---
 gnu/services/base.scm |  6 ++++--
 gnu/services/ssh.scm  |  6 ++++--
 gnu/services/xorg.scm |  6 ++++--
 gnu/system/linux.scm  | 27 ++++++++++++++++-----------
 4 files changed, 28 insertions(+), 17 deletions(-)

diff --git a/gnu/services/base.scm b/gnu/services/base.scm
index 888e446..60dc93b 100644
--- a/gnu/services/base.scm
+++ b/gnu/services/base.scm
@@ -364,7 +364,8 @@ stopped before 'kill' is called."
                            ;; Allow empty passwords by default so that
                            ;; first-time users can log in when the 'root'
                            ;; account has just been created.
-                           (allow-empty-passwords? #t))
+                           (allow-empty-passwords? #t)
+                           (additional-session-modules '()))
   "Return a service to run mingetty on @var{tty}.
 
 When @var{allow-empty-passwords?} is true, allow empty log-in password.  When
@@ -416,7 +417,8 @@ the ``message of the day''."
        ;; duplicates are removed.
        (list (unix-pam-service "login"
                                #:allow-empty-passwords? allow-empty-passwords?
-                               #:motd motd)))))))
+                               #:motd motd
+                               #:additional-session-modules additional-session-modules)))))))
 
 (define-record-type* <nscd-configuration> nscd-configuration
   make-nscd-configuration
diff --git a/gnu/services/ssh.scm b/gnu/services/ssh.scm
index e2f8542..15e4052 100644
--- a/gnu/services/ssh.scm
+++ b/gnu/services/ssh.scm
@@ -86,7 +86,8 @@
                       (tcp/ip-forwarding? #t)
                       (password-authentication? #t)
                       (public-key-authentication? #t)
-                      (initialize? #t))
+                      (initialize? #t)
+                      (additional-session-modules '()))
   "Run the @command{lshd} program from @var{lsh} to listen on port @var{port-number}.
 @var{host-key} must designate a file containing the host key, and readable
 only by root.
@@ -162,7 +163,8 @@ The other options should be self-descriptive."
              (pam-services
               (list (unix-pam-service
                      "lshd"
-                     #:allow-empty-passwords? allow-empty-passwords?)))
+                     #:allow-empty-passwords? allow-empty-passwords?
+                     #:additional-session-modules additional-session-modules)))
              (activate #~(begin
                            (use-modules (guix build utils))
                            (mkdir-p "/var/spool/lsh")
diff --git a/gnu/services/xorg.scm b/gnu/services/xorg.scm
index 9ee8817..71bbb32 100644
--- a/gnu/services/xorg.scm
+++ b/gnu/services/xorg.scm
@@ -224,7 +224,8 @@ which should be passed to this script as the first argument.  If not, the
                        (xauth xauth) (dmd dmd) (bash bash)
                        (auto-login-session #~(string-append #$windowmaker
                                                             "/bin/wmaker"))
-                       startx)
+                       startx
+                       (additional-session-modules '()))
   "Return a service that spawns the SLiM graphical login manager, which in
 turn starts the X display server with @var{startx}, a command as returned by
 @code{xorg-start-command}.
@@ -305,6 +306,7 @@ reboot_cmd " dmd "/sbin/reboot
        ;; Tell PAM about 'slim'.
        (list (unix-pam-service
               "slim"
-              #:allow-empty-passwords? allow-empty-passwords?)))))))
+              #:allow-empty-passwords? allow-empty-passwords?
+              #:additional-session-modules additional-session-modules)))))))
 
 ;;; xorg.scm ends here
diff --git a/gnu/system/linux.scm b/gnu/system/linux.scm
index aaaa8c6..d6a9959 100644
--- a/gnu/system/linux.scm
+++ b/gnu/system/linux.scm
@@ -133,7 +133,8 @@ dumped in /etc/pam.d/NAME, where NAME is the name of SERVICE."
   (let ((unix (pam-entry
                (control "required")
                (module "pam_unix.so"))))
-    (lambda* (name #:key allow-empty-passwords? motd)
+    (lambda* (name #:key allow-empty-passwords? motd
+                   (additional-session-modules '()))
       "Return a standard Unix-style PAM service for NAME.  When
 ALLOW-EMPTY-PASSWORDS? is true, allow empty passwords.  When MOTD is true, it
 should be the name of a file used as the message-of-the-day."
@@ -149,14 +150,16 @@ should be the name of a file used as the message-of-the-day."
                           (arguments '("nullok")))
                          unix)))
          (password (list unix))
-         (session (if motd
-                      (list unix
-                            (pam-entry
-                             (control "optional")
-                             (module "pam_motd.so")
-                             (arguments
-                              (list #~(string-append "motd=" #$motd)))))
-                      (list unix))))))))
+         (session (append
+                   (if motd
+                       (list unix
+                             (pam-entry
+                              (control "optional")
+                              (module "pam_motd.so")
+                              (arguments
+                               (list #~(string-append "motd=" #$motd)))))
+                       (list unix))
+                   additional-session-modules)))))))
 
 (define (rootok-pam-service command)
   "Return a PAM service for COMMAND such that 'root' does not need to
@@ -173,14 +176,16 @@ authenticate to run COMMAND."
      (password (list unix))
      (session (list unix)))))
 
-(define* (base-pam-services #:key allow-empty-passwords?)
+(define* (base-pam-services #:key allow-empty-passwords?
+                            (additional-session-modules '()))
   "Return the list of basic PAM services everyone would want."
   ;; TODO: Add other Shadow programs?
   (append (list %pam-other-services)
 
           ;; These programs are setuid-root.
           (map (cut unix-pam-service <>
-                    #:allow-empty-passwords? allow-empty-passwords?)
+                    #:allow-empty-passwords? allow-empty-passwords?
+                    #:additional-session-modules additional-session-modules)
                '("su" "passwd" "sudo"
                  "xlock" "xscreensaver"))
 
-- 
2.4.3

[PATCH v2 4/7] gnu: polkit: Use elogind for seat management.

[Andy Wingo]

* gnu/packages/polkit.scm (polkit): Depend on elogind.
---
 gnu/packages/polkit.scm | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/polkit.scm b/gnu/packages/polkit.scm
index 172b0e1..6a89d6b 100644
--- a/gnu/packages/polkit.scm
+++ b/gnu/packages/polkit.scm
@@ -23,6 +23,7 @@
   #:use-module (guix build-system cmake)
   #:use-module (guix build-system gnu)
   #:use-module (gnu packages)
+  #:use-module (gnu packages freedesktop)
   #:use-module (gnu packages glib)
   #:use-module (gnu packages gnuzilla)
   #:use-module (gnu packages linux)
@@ -44,13 +45,33 @@
              (sha256
               (base32
                "109w86kfqrgz83g9ivggplmgc77rz8kx8646izvm2jb57h4rbh71"))
-             (patches (list (search-patch "polkit-drop-test.patch")))))
+             (patches (list (search-patch "polkit-drop-test.patch")))
+             (modules '((guix build utils)))
+             (snippet
+              '(begin
+                 (use-modules (guix build utils))
+                 (substitute* "configure"
+                   ;; Replace libsystemd-login with libelogind.
+                   (("libsystemd-login") "libelogind")
+                   ;; Skip the sanity check that the current system runs
+                   ;; systemd.
+                   (("test ! -d /sys/fs/cgroup/systemd/") "false"))
+                 (substitute* "src/polkit/polkitunixsession-systemd.c"
+                   (("systemd") "elogind"))
+                 (substitute* "src/polkitbackend/polkitbackendsessionmonitor-systemd.c"
+                   (("systemd") "elogind"))
+                 (substitute* "src/polkitbackend/polkitbackendjsauthority.c"
+                   (("systemd") "elogind"))))))
     (build-system gnu-build-system)
     (inputs
       `(("expat" ,expat)
         ("glib:bin" ,glib "bin") ; for glib-mkenums
+        ("elogind" ,elogind)
         ("intltool" ,intltool)
         ("linux-pam" ,linux-pam)
+        ;; FIXME: Shouldn't need libcap, it should be correctly propagated
+        ;; from elogind.
+        ("libcap" ,libcap)
         ("mozjs" ,mozjs)
         ("nspr" ,nspr)))
     (propagated-inputs
-- 
2.4.3

[PATCH v2 5/7] gnu: colord: Add libcap input.

[Andy Wingo]

* gnu/packages/gnome.scm (colord): Add libcap as an input.  I don't know why;
  I suspect something libtool-related with libelogind.la.
---
 gnu/packages/gnome.scm | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm
index 1c31be2..8763380 100644
--- a/gnu/packages/gnome.scm
+++ b/gnu/packages/gnome.scm
@@ -2202,6 +2202,8 @@ keyboard shortcuts.")
     (inputs
      `(("dbus-glib" ,dbus-glib)
        ("libusb" ,libusb)
+       ;; FIXME: propagated in from elogind via polkit.  Why?
+       ("libcap" ,libcap)
        ("sqlite" ,sqlite)
        ("polkit" ,polkit)
        ("sane-backends" ,sane-backends)))
-- 
2.4.3

[PATCH v2 6/7] gnu: Add elogind service.

[Andy Wingo]

* gnu/services/desktop.scm (elogind-service): New function.
  (%desktop-services): Add elogind-service.
---
 gnu/services/desktop.scm | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm
index 4e4b49d..4973e82 100644
--- a/gnu/services/desktop.scm
+++ b/gnu/services/desktop.scm
@@ -26,6 +26,7 @@
   #:use-module (gnu system shadow)
   #:use-module (gnu packages glib)
   #:use-module (gnu packages admin)
+  #:use-module (gnu packages freedesktop)
   #:use-module (gnu packages gnome)
   #:use-module (gnu packages avahi)
   #:use-module (gnu packages wicd)
@@ -39,6 +40,7 @@
             geoclue-application
             %standard-geoclue-applications
             geoclue-service
+            elogind-service
             %desktop-services))
 
 ;;; Commentary:
@@ -374,6 +376,28 @@ site} for more information."
 
 \f
 ;;;
+;;; Elogind login and seat management service.
+;;;
+
+(define* (elogind-service #:key (elogind elogind))
+  "Return a service that runs the @command{elogind} login and seat management
+service.  The @command{elogind} service integrates with PAM to allow other
+system components to know the set of logged-in users as well as their session
+types (graphical, console, remote, etc.).  It can also clean up after users
+when they log out."
+  (with-monad %store-monad
+    (return
+     (service
+      (documentation "Run the elogind login and seat management service.")
+      (provision '(elogind))
+      (requirement '(dbus-system))
+
+      (start #~(make-forkexec-constructor
+                (list (string-append #$elogind "/libexec/elogind/elogind"))))
+      (stop #~(make-kill-destructor))))))
+
+\f
+;;;
 ;;; The default set of desktop services.
 ;;;
 (define %desktop-services
@@ -389,7 +413,8 @@ site} for more information."
          ;; time, so we currently add them to the set of default services.
          (colord-service)
          (geoclue-service)
-         (dbus-service (list avahi wicd upower colord geoclue))
+         (elogind-service)
+         (dbus-service (list avahi wicd upower colord geoclue elogind))
 
          (ntp-service)
 
-- 
2.4.3

[PATCH v2 7/7] gnu: Add polkit service.

[Andy Wingo]

* gnu/services/desktop.scm (polkit-service): New function.
  (%desktop-services): Add polkit service.
---
 gnu/services/desktop.scm | 48 +++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 43 insertions(+), 5 deletions(-)

diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm
index 4973e82..543b452 100644
--- a/gnu/services/desktop.scm
+++ b/gnu/services/desktop.scm
@@ -30,6 +30,7 @@
   #:use-module (gnu packages gnome)
   #:use-module (gnu packages avahi)
   #:use-module (gnu packages wicd)
+  #:use-module (gnu packages polkit)
   #:use-module (guix monads)
   #:use-module (guix store)
   #:use-module (guix gexp)
@@ -40,6 +41,7 @@
             geoclue-application
             %standard-geoclue-applications
             geoclue-service
+            polkit-service
             elogind-service
             %desktop-services))
 
@@ -376,6 +378,40 @@ site} for more information."
 
 \f
 ;;;
+;;; Polkit privilege management service.
+;;;
+
+(define* (polkit-service #:key (polkit polkit))
+  "Return a service that runs the @command{polkit} privilege management
+service.  By querying the @command{polkit} service, a privileged system
+component can know when it should grant additional capabilities to ordinary
+users.  For example, an ordinary user can be granted the capability to suspend
+the system if the user is logged in locally."
+  (with-monad %store-monad
+    (return
+     (service
+      (documentation "Run the polkit privilege management service.")
+      (provision '(polkit-daemon))
+      (requirement '(dbus-system))
+
+      (start #~(make-forkexec-constructor
+                (list (string-append #$polkit "/lib/polkit-1/polkitd"))))
+      (stop #~(make-kill-destructor))
+
+      (user-groups (list (user-group
+                          (name "polkitd")
+                          (system? #t))))
+      (user-accounts (list (user-account
+                            (name "polkitd")
+                            (group "polkitd")
+                            (system? #t)
+                            (comment "Polkit daemon user")
+                            (home-directory "/var/empty")
+                            (shell
+                             "/run/current-system/profile/sbin/nologin"))))))))
+
+\f
+;;;
 ;;; Elogind login and seat management service.
 ;;;
 
@@ -407,14 +443,16 @@ when they log out."
          (avahi-service)
          (wicd-service)
          (upower-service)
-         ;; FIXME: The colord and geoclue services could all be bus-activated
-         ;; by default, so they don't run at program startup.  However, user
-         ;; creation and /var/lib.colord creation happen at service activation
-         ;; time, so we currently add them to the set of default services.
+         ;; FIXME: The colord, geoclue, and polkit services could all be
+         ;; bus-activated by default, so they don't run at program startup.
+         ;; However, user creation and /var/lib/colord creation happen at
+         ;; service activation time, so we currently add them to the set of
+         ;; default services.
          (colord-service)
          (geoclue-service)
+         (polkit-service)
          (elogind-service)
-         (dbus-service (list avahi wicd upower colord geoclue elogind))
+         (dbus-service (list avahi wicd upower colord geoclue polkit elogind))
 
          (ntp-service)
 
-- 
2.4.3

Re: [PATCH v2 2/7] gnu: elogind: Update to version 219.5.

[Ludovic Courtès]

Andy Wingo <wingo@pobox.com> skribis:

> * gnu/packages/freedesktop.scm (elogind): Update to 219.5.

Sure!

> +    (version "219.5")
> +    (source (origin
> +              (method git-fetch)
> +              (uri (git-reference
> +                    (url "https://github.com/andywingo/elogind")
> +                    (tag (string-append "v" version))))

Maybe use ‘commit’ instead of ‘tag’ for now, or wait for the other
patch?

It would actually be ideal if you could upload a ‘make dist’-produced
tarball somewhere, but if not that’s fine.

Thanks,
Ludo’.

Re: [PATCH v2 3/7] gnu: Allow OS configurations to add PAM session modules

[Ludovic Courtès]

Andy Wingo <wingo@pobox.com> skribis:

> * gnu/services/base.scm (mingetty-service):
> * gnu/services/xorg.scm (slim-service):
> * gnu/services/ssh.scm (lsh-service):
> * gnu/system/linux.scm (unix-pam-service, base-pam-services): Add
>   #:additional-session-modules keyword argument.

I wonder if we really need #:additional-session-modules passed around.

My first suggestion would be to do ‘unix-pam-service’ or
‘base-pam-services’ in the OS declaration along these lines:

  (operating-system
    ;; ...
    (pam-services (map (lambda (service)
                         (pam-service
                           (inherit service)
                           (session (cons ...))))
                       (base-pam-services))))

But maybe that turned out to be inconvenient?  If so, perhaps we could
solve it by introducing helper procedures, like
‘add-pam-service-session’ or something?

Or am I missing something?  :-)

BTW, I realize we should rename (gnu system linux) to (gnu system pam)
and then document it in the manual.

Thanks,
Ludo’.

Re: [PATCH v2 4/7] gnu: polkit: Use elogind for seat management.

[Ludovic Courtès]

Andy Wingo <wingo@pobox.com> skribis:

> * gnu/packages/polkit.scm (polkit): Depend on elogind.

OK to push!

> +        ;; FIXME: Shouldn't need libcap, it should be correctly propagated
> +        ;; from elogind.
> +        ("libcap" ,libcap)

Let’s do that.  :-)

Thank you,
Ludo’.

Re: [PATCH v2 5/7] gnu: colord: Add libcap input.

[Ludovic Courtès]

Andy Wingo <wingo@pobox.com> skribis:

> * gnu/packages/gnome.scm (colord): Add libcap as an input.  I don't know why;
>   I suspect something libtool-related with libelogind.la.

If libelogind.la has a -lcap without -L/...-libcap, then could you add a
phase there to do that instead?  (For example the recipe for hwloc does
that.)

If it’s libelogind.pc that “Requires” libcap’s .pc, then the solution is
to propagate libcap from elogind.

Hope this makes sense!

Ludo’.

Re: [PATCH v2 6/7] gnu: Add elogind service.

[Ludovic Courtès]

Andy Wingo <wingo@pobox.com> skribis:

> * gnu/services/desktop.scm (elogind-service): New function.
>   (%desktop-services): Add elogind-service.

Could you add an @deffn under “Desktop Services” in the manual?

OK to push with this change.

Thanks!
Ludo’.

Re: [PATCH v2 7/7] gnu: Add polkit service.

[Ludovic Courtès]

Andy Wingo <wingo@pobox.com> skribis:

> * gnu/services/desktop.scm (polkit-service): New function.
>   (%desktop-services): Add polkit service.

Could you add it in guix.texi as well?

OK with this change.

It’s great that you got this far, thanks.

Ludo’.

Re: [PATCH v2 3/7] gnu: Allow OS configurations to add PAM session modules

[Andy Wingo]

On Tue 25 Aug 2015 16:55, ludo@gnu.org (Ludovic Courtès) writes:

> Andy Wingo <wingo@pobox.com> skribis:
>
>> * gnu/services/base.scm (mingetty-service):
>> * gnu/services/xorg.scm (slim-service):
>> * gnu/services/ssh.scm (lsh-service):
>> * gnu/system/linux.scm (unix-pam-service, base-pam-services): Add
>>   #:additional-session-modules keyword argument.
>
> I wonder if we really need #:additional-session-modules passed around.
>
> My first suggestion would be to do ‘unix-pam-service’ or
> ‘base-pam-services’ in the OS declaration along these lines:
>
>   (operating-system
>     ;; ...
>     (pam-services (map (lambda (service)
>                          (pam-service
>                            (inherit service)
>                            (session (cons ...))))
>                        (base-pam-services))))
>
> But maybe that turned out to be inconvenient?  If so, perhaps we could
> solve it by introducing helper procedures, like
> ‘add-pam-service-session’ or something?
>
> Or am I missing something?  :-)
>
> BTW, I realize we should rename (gnu system linux) to (gnu system pam)
> and then document it in the manual.

How would that work for other services like slim, mingetty, etc?

Re: [PATCH v2 4/7] gnu: polkit: Use elogind for seat management.

[Andy Wingo]

On Tue 25 Aug 2015 16:56, ludo@gnu.org (Ludovic Courtès) writes:

>> +        ;; FIXME: Shouldn't need libcap, it should be correctly propagated
>> +        ;; from elogind.
>> +        ("libcap" ,libcap)
>
> Let’s do that.  :-)

It didn't work, oddly.  I would have done that :P

A

Re: [PATCH v2 5/7] gnu: colord: Add libcap input.

[Andy Wingo]

On Tue 25 Aug 2015 17:03, ludo@gnu.org (Ludovic Courtès) writes:

> Andy Wingo <wingo@pobox.com> skribis:
>
>> * gnu/packages/gnome.scm (colord): Add libcap as an input.  I don't know why;
>>   I suspect something libtool-related with libelogind.la.
>
> If libelogind.la has a -lcap without -L/...-libcap, then could you add a
> phase there to do that instead?  (For example the recipe for hwloc does
> that.)

Ah sure.  Actually re: elogind we can make whatever modifications are
necessary to "upstream", like --with-libcap or whatever.  I'll give it a
poke.

A

Re: [PATCH v2 3/7] gnu: Allow OS configurations to add PAM session modules

[Ludovic Courtès]

Andy Wingo <wingo@igalia.com> skribis:

> On Tue 25 Aug 2015 16:55, ludo@gnu.org (Ludovic Courtès) writes:
>
>> Andy Wingo <wingo@pobox.com> skribis:
>>
>>> * gnu/services/base.scm (mingetty-service):
>>> * gnu/services/xorg.scm (slim-service):
>>> * gnu/services/ssh.scm (lsh-service):
>>> * gnu/system/linux.scm (unix-pam-service, base-pam-services): Add
>>>   #:additional-session-modules keyword argument.
>>
>> I wonder if we really need #:additional-session-modules passed around.
>>
>> My first suggestion would be to do ‘unix-pam-service’ or
>> ‘base-pam-services’ in the OS declaration along these lines:
>>
>>   (operating-system
>>     ;; ...
>>     (pam-services (map (lambda (service)
>>                          (pam-service
>>                            (inherit service)
>>                            (session (cons ...))))
>>                        (base-pam-services))))
>>
>> But maybe that turned out to be inconvenient?  If so, perhaps we could
>> solve it by introducing helper procedures, like
>> ‘add-pam-service-session’ or something?
>>
>> Or am I missing something?  :-)
>>
>> BTW, I realize we should rename (gnu system linux) to (gnu system pam)
>> and then document it in the manual.
>
> How would that work for other services like slim, mingetty, etc?

Oh, it wouldn’t.

Just to help me understand, could you explain the typical use case you
have in mind?

Thanks,
Ludo’.

Re: [PATCH v2 5/7] gnu: colord: Add libcap input.

[Ludovic Courtès]

Andy Wingo <wingo@igalia.com> skribis:

> On Tue 25 Aug 2015 17:03, ludo@gnu.org (Ludovic Courtès) writes:
>
>> Andy Wingo <wingo@pobox.com> skribis:
>>
>>> * gnu/packages/gnome.scm (colord): Add libcap as an input.  I don't know why;
>>>   I suspect something libtool-related with libelogind.la.
>>
>> If libelogind.la has a -lcap without -L/...-libcap, then could you add a
>> phase there to do that instead?  (For example the recipe for hwloc does
>> that.)
>
> Ah sure.  Actually re: elogind we can make whatever modifications are
> necessary to "upstream", like --with-libcap or whatever.  I'll give it a
> poke.

Cool, thanks!

Ludo'.

Re: [PATCH v2 3/7] gnu: Allow OS configurations to add PAM session modules

[Andy Wingo]

On Tue 25 Aug 2015 23:39, ludo@gnu.org (Ludovic Courtès) writes:

> Andy Wingo <wingo@igalia.com> skribis:
>
>> On Tue 25 Aug 2015 16:55, ludo@gnu.org (Ludovic Courtès) writes:
>>
>>>   (operating-system
>>>     ;; ...
>>>     (pam-services (map (lambda (service)
>>>                          (pam-service
>>>                            (inherit service)
>>>                            (session (cons ...))))
>>>                        (base-pam-services))))
>>>
>> How would that work for other services like slim, mingetty, etc?
>
> Oh, it wouldn’t.
>
> Just to help me understand, could you explain the typical use case you
> have in mind?

Sure.  So right now on a Guix system you have /etc/pam.d, and it
contains configurations for all services that interact with PAM.
Notably there is "login", for console login, but also slim and lsh.
Elogind wants to know about all user sessions so it should add a
"session required /path/to/pam_elogind.so" line to all files in
/etc/pam.d.  This causes login and logout to signal elogind.

That's how I ended up adding #:additional-session-modules to all the
other services: mingetty, slim, lsh.

I don't know what the right design is.  I think ideally anything that
would log in would include some central file rather than having to
repeat the rules everywhere.

Andy

Re: [PATCH v2 3/7] gnu: Allow OS configurations to add PAM session modules

[宋文武]

2015-08-26 15:21 GMT+08:00 Andy Wingo <wingo@igalia.com>:
> On Tue 25 Aug 2015 23:39, ludo@gnu.org (Ludovic Courtès) writes:
>
>> Andy Wingo <wingo@igalia.com> skribis:
>>
>>> On Tue 25 Aug 2015 16:55, ludo@gnu.org (Ludovic Courtès) writes:
>>>
>>>>   (operating-system
>>>>     ;; ...
>>>>     (pam-services (map (lambda (service)
>>>>                          (pam-service
>>>>                            (inherit service)
>>>>                            (session (cons ...))))
>>>>                        (base-pam-services))))
>>>>
>>> How would that work for other services like slim, mingetty, etc?
>>
>> Oh, it wouldn’t.
>>
>> Just to help me understand, could you explain the typical use case you
>> have in mind?
>
> Sure.  So right now on a Guix system you have /etc/pam.d, and it
> contains configurations for all services that interact with PAM.
> Notably there is "login", for console login, but also slim and lsh.
> Elogind wants to know about all user sessions so it should add a
> "session required /path/to/pam_elogind.so" line to all files in
> /etc/pam.d.  This causes login and logout to signal elogind.
>
> That's how I ended up adding #:additional-session-modules to all the
> other services: mingetty, slim, lsh.
>
> I don't know what the right design is.  I think ideally anything that
> would log in would include some central file rather than having to
> repeat the rules everywhere.
Yes, we can ues 'include' in pam config, this is how the ArchLinux do it:
  https://projects.archlinux.org/svntogit/packages.git/tree/trunk?h=packages/pambase
  https://projects.archlinux.org/svntogit/packages.git/tree/trunk/slim.pam?h=packages/slim

Re: [PATCH v2 3/7] gnu: Allow OS configurations to add PAM session modules

[Ludovic Courtès]

Andy Wingo <wingo@igalia.com> skribis:

> On Tue 25 Aug 2015 23:39, ludo@gnu.org (Ludovic Courtès) writes:
>
>> Andy Wingo <wingo@igalia.com> skribis:
>>
>>> On Tue 25 Aug 2015 16:55, ludo@gnu.org (Ludovic Courtès) writes:
>>>
>>>>   (operating-system
>>>>     ;; ...
>>>>     (pam-services (map (lambda (service)
>>>>                          (pam-service
>>>>                            (inherit service)
>>>>                            (session (cons ...))))
>>>>                        (base-pam-services))))
>>>>
>>> How would that work for other services like slim, mingetty, etc?
>>
>> Oh, it wouldn’t.
>>
>> Just to help me understand, could you explain the typical use case you
>> have in mind?
>
> Sure.  So right now on a Guix system you have /etc/pam.d, and it
> contains configurations for all services that interact with PAM.
> Notably there is "login", for console login, but also slim and lsh.
> Elogind wants to know about all user sessions so it should add a
> "session required /path/to/pam_elogind.so" line to all files in
> /etc/pam.d.  This causes login and logout to signal elogind.
>
> That's how I ended up adding #:additional-session-modules to all the
> other services: mingetty, slim, lsh.

Right, got it.

So as I suggested elsewhere (perhaps not clearly), I would do something
like:

  (define %desktop-services
    (append ...
            (map (lambda (mservice)
                   (with-monad %store-monad
                     (>>= mservice add-pam-session-thing)))
                 %base-service)))

Ludo’.