From ad9323d5b3f774ee479cf16f41753dbbe2f90ff4 Mon Sep 17 00:00:00 2001 From: muradm Date: Fri, 22 Jul 2022 07:09:54 +0300 Subject: [PATCH v4] gnu: seatd-service-type: Should use seat group. To: 56690@debbugs.gnu.org * gnu/services/desktop.scm (seatd-service-type): Uses "seat" group. [extensions]: Added account-service-type with seatd-accounts. (seatd-accounts): Conditionally produces list with "seat" group. (): [user] Removed user field, since it is not going to be used. [group] Change default value to "seat" user-group. * doc/guix.texi: Mention that users may need to become members of "seat" group and update default value for group field. Add explanation on seatd.sock file. Remove dropped user field. --- doc/guix.texi | 29 +++++++++++++++++++++++++---- gnu/services/desktop.scm | 25 +++++++++++++++++++------ gnu/tests/desktop.scm | 9 +++++++++ 3 files changed, 53 insertions(+), 10 deletions(-) diff --git a/doc/guix.texi b/doc/guix.texi index 023b48ae35..40c6e66439 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -23189,6 +23189,30 @@ input), without requiring the applications needing access to be root. %base-services) @end lisp + +@code{seatd} operates over a UNIX domain socket, with @code{libseat} +providing the client-side of the protocol. Then applications dealing +with seat management (e.g. @code{sway}) connects to @code{seatd} via +mentioned socket. + +When seat management is provided by @code{seatd}, @code{libseat} users +that acquire resources provided by @code{seatd} should have permissions +to access its UNIX domain socket. By default, @code{seatd-service-type} +provides ``seat'' group. And @code{libseat} user should become its +member. + +@lisp +(user-account + (name "alice") + (group "users") + (supplementary-groups '("wheel" ;allow use of sudo, etc. + "seat" ;interact with seatd + "audio" ;sound card + "video" ;video devices such as webcams + "cdrom")) ;the good ol' CD-ROM + (comment "Bob's sister")) +@end lisp + @end defvr @deftp {Data Type} seatd-configuration @@ -23198,10 +23222,7 @@ Configuration record for the seatd daemon service. @item @code{seatd} (default: @code{seatd}) The seatd package to use. -@item @code{user} (default: @samp{"root"}) -User to own the seatd socket. - -@item @code{group} (default: @samp{"users"}) +@item @code{group} (default: @samp{"seat"}) Group to own the seatd socket. @item @code{socket} (default: @samp{"/run/seatd.sock"}) diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm index f891d1b5cc..2e7b751c1a 100644 --- a/gnu/services/desktop.scm +++ b/gnu/services/desktop.scm @@ -13,7 +13,7 @@ ;;; Copyright © 2020 Tobias Geerinckx-Rice ;;; Copyright © 2020 Reza Alizadeh Majd ;;; Copyright © 2021 Brice Waegeneire -;;; Copyright © 2021 muradm +;;; Copyright © 2021, 2022 muradm ;;; ;;; This file is part of GNU Guix. ;;; @@ -69,6 +69,7 @@ (define-module (gnu services desktop) #:use-module (guix records) #:use-module (guix packages) #:use-module (guix store) + #:use-module (guix ui) #:use-module (guix utils) #:use-module (guix gexp) #:use-module (srfi srfi-1) @@ -1643,12 +1644,21 @@ (define polkit-wheel-service ;;; seatd-service-type -- minimal seat management daemon ;;; +(define (seatd-make-group g) + (user-group (name g) (system? #t))) + +(define (seatd-group-sanitizer g) + (cond ((user-group? g) g) + ((string? g) (seatd-make-group g)) + (#t (leave (G_ "seatd: '~a' is not a valid group-%") (object->string g))))) + (define-record-type* seatd-configuration make-seatd-configuration seatd-configuration? (seatd seatd-package (default seatd)) - (user seatd-user (default "root")) - (group seatd-group (default "users")) + (group seatd-group + (default (seatd-make-group "seat")) + (sanitize seatd-group-sanitizer)) (socket seatd-socket (default "/run/seatd.sock")) (logfile seatd-logfile (default "/var/log/seatd.log")) (loglevel seatd-loglevel (default "info"))) @@ -1662,8 +1672,7 @@ (define (seatd-shepherd-service config) (provision '(seatd elogind)) (start #~(make-forkexec-constructor (list #$(file-append (seatd-package config) "/bin/seatd") - "-u" #$(seatd-user config) - "-g" #$(seatd-group config)) + "-g" #$(user-group-name (seatd-group config))) #:environment-variables (list (string-append "SEATD_LOGLEVEL=" #$(seatd-loglevel config)) @@ -1672,9 +1681,12 @@ (define (seatd-shepherd-service config) #:log-file #$(seatd-logfile config))) (stop #~(make-kill-destructor))))) +(define seatd-accounts + (match-lambda (($ _ group) (list group)))) + (define seatd-environment (match-lambda - (($ _ _ _ socket) + (($ _ _ socket) `(("SEATD_SOCK" . ,socket))))) (define seatd-service-type @@ -1685,6 +1697,7 @@ (define seatd-service-type applications needing access to be root.") (extensions (list + (service-extension account-service-type seatd-accounts) (service-extension session-environment-service-type seatd-environment) ;; TODO: once cgroups is separate dependency we should not mount it here ;; for now it is mounted here, because elogind mounts it diff --git a/gnu/tests/desktop.scm b/gnu/tests/desktop.scm index 25971f9225..6fe6ec21be 100644 --- a/gnu/tests/desktop.scm +++ b/gnu/tests/desktop.scm @@ -255,6 +255,15 @@ (define (sock-var-sock var) (socks (map wait-for-unix-socket-m socks))) (and (= 2 (length socks)) (every identity socks))))) + (test-equal "seatd.sock ownership" + '("root" "seat") + `(,(marionette-eval + '(passwd:name (getpwuid (stat:uid (stat "/run/seatd.sock")))) + marionette) + ,(marionette-eval + '(group:name (getgrgid (stat:gid (stat "/run/seatd.sock")))) + marionette))) + (test-assert "greetd is ready" (begin (marionette-type "ps -C greetd -o pid,args --no-headers > ps-greetd\n" -- 2.37.1